权限说明
腾讯云安全中心调用阿里云账号需要的权限和说明如下：
产品 | 参考的系统策略 | 配置项 | 说明 |
费用与成本（BSS） | AliyunBSSFullAccess 管理费用与成本（BSS）的权限 | { "Action": [ "bss:", "bssapi:" ], "Resource": "*", "Effect": "Deny" } | 拦截所有费用与成本相关的访问，避免访问用户费用清单。 |
所有 | ReadOnlyAccess 只读访问所有阿里云资源的权限 | { "Action": [ ":Describe", ":List", ":Get", ":Read", ":BatchGet", ":BatchDescribe", ":Query", ":BatchQuery", "actiontrail:Lookup*", "actiontrail:Check*", "dm:Desc*", "dm:SenderStatistics*", "ram:GenerateCredentialReport", "cloudsso:Check*", "notifications:Read*", "selectdb:Check*", "hbr:Search*", "hbr:BrowseFiles", "hbr:BatchCountTables", "hbr:CheckRole", "hbr:PreCheckSourceGroup", "nis:Count*", "nis:Check*", "nis:Is*", "sr:HasRole", "resourcecenter:Search*", "resourcecenter:ExecuteSQLQuery", "resourcecenter:ExecuteMultiAccountSQLQuery", "clickhouse:Check*" ], "Resource": "*", "Effect": "Allow" } | 只读访问所有阿里云资源 |
消息队列 RocketMQ 版 | - | { "Action": [ "mq:OnsRegionList", "mq:OnsInstanceInServiceList", "ons:OnsRegionList", "mq:OnsInstanceInServiceList" ], "Resource": "*", "Effect": "Allow" } | 读取消息队列 RocketMQ 版的Region和服务列表 |
云安全中心（SAS） | AliyunYundunSASFullAccess 管理云安全中心（SAS）的权限 | { "Action": [ "yundun-sas:", "yundun-aegis:", "sasti:" ], "Resource": "", "Effect": "Allow" }, { "Action": "ram:CreateServiceLinkedRole", "Resource": "*", "Effect": "Allow", "Condition": { "StringEquals": { "ram:ServiceName": [ "sas.aliyuncs.com", "cloudsiem.sas.aliyuncs.com", "cspm.sas.aliyuncs.com" ] } } } | 阿里云云安全中心管理权限，未来可能用于漏洞修复、告警确认等场景，变更动作均由用户通过控制台触发，云安全中心仅主动触发查询操作。 |
云盾应用防火墙（WAF） | AliyunYundunWAFFullAccess 管理云盾应用防火墙（WAF）的权限 | { "Action": "yundun-waf:", "Resource": "", "Effect": "Allow" } | 应用防火墙（WAF）管理，变更动作均由用户通过控制台触发，云安全中心仅主动触发查询操作。 |
云盾云防火墙（CloudFirewall） | AliyunYundunCloudFirewallFullAccess 管理云盾云防火墙（CloudFirewall）的权限 | { "Action": [ "yundun-cloudfirewall:*", "sasti:Get*", "sasti:Describe*", "sasti:Query*", "sasti:List*", "sasti:Grant*", "bss:QueryAvailableInstances", "bssapi:QuerySavingsPlansInstance" ], "Resource": "*", "Effect": "Allow" } | 云防火墙（CloudFirewall）管理，变更动作均由用户通过控制台触发，云安全中心仅主动触发查询操作。 |
云服务器（ECS） | 安全组相关操作 | { "Action": [ "ecs:CreateSecurityGroup", "ecs:ModifySecurityGroupPolicy", "ecs:ModifySecurityGroupAttribute", "ecs:DeleteSecurityGroup", "ecs:AuthorizeSecurityGroup", "ecs:ModifySecurityGroupRule", "ecs:RevokeSecurityGroup", "ecs:AuthorizeSecurityGroupEgress", "ecs:ModifySecurityGroupEgressRule", "ecs:RevokeSecurityGroupEgress", "ecs:JoinSecurityGroup", "ecs:LeaveSecurityGroup", ], "Resource": "*", "Effect": "Allow" } | 安全组操作，用于主机入侵时，进行隔离。由用户通过控制台触发。 |
权限脚本配置
{"Version": "1","Statement": [{"Action": ["bss:*","bssapi:*"],"Resource": "*","Effect": "Deny"},{"Action": ["*:Describe*","*:List*","*:Get*","*:Read*","*:BatchGet*","*:BatchDescribe*","*:Query*","*:BatchQuery*","actiontrail:Lookup*","actiontrail:Check*","dm:Desc*","dm:SenderStatistics*","ram:GenerateCredentialReport","cloudsso:Check*","notifications:Read*","selectdb:Check*","hbr:Search*","hbr:BrowseFiles","hbr:BatchCountTables","hbr:CheckRole","hbr:PreCheckSourceGroup","nis:Count*","nis:Check*","nis:Is*","sr:HasRole","resourcecenter:Search*","resourcecenter:ExecuteSQLQuery","resourcecenter:ExecuteMultiAccountSQLQuery","clickhouse:Check*","yundun-waf:*","yundun-cloudfirewall:*","sasti:Get*","sasti:Describe*","sasti:Query*","sasti:List*","sasti:Grant*","ecs:CreateSecurityGroup","ecs:ModifySecurityGroupPolicy","ecs:ModifySecurityGroupAttribute","ecs:DeleteSecurityGroup","ecs:AuthorizeSecurityGroup","ecs:ModifySecurityGroupRule","ecs:RevokeSecurityGroup","ecs:AuthorizeSecurityGroupEgress","ecs:ModifySecurityGroupEgressRule","ecs:RevokeSecurityGroupEgress","ecs:JoinSecurityGroup","ecs:LeaveSecurityGroup"],"Resource": "*","Effect": "Allow"},{"Action": ["mq:OnsRegionList","mq:OnsInstanceInServiceList","ons:OnsRegionList","ons:OnsInstanceInServiceList"],"Resource": "*","Effect": "Allow"},{"Action": ["yundun-sas:*","yundun-aegis:*","sasti:*"],"Resource": "*","Effect": "Allow"},{"Action": "ram:CreateServiceLinkedRole","Resource": "*","Effect": "Allow","Condition": {"StringEquals": {"ram:ServiceName": ["sas.aliyuncs.com","cloudsiem.sas.aliyuncs.com","cspm.sas.aliyuncs.com"]}}}]}
