Authorizing SecMaster

Scenario

SecMaster depends on some other cloud services. To better use SecMaster, you can authorize SecMaster to perform some operations on some cloud services on your behalf. For example, you can allow SecMaster to execute scheduling tasks and manage resources.

Your authorization is required first time you try to use SecMaster. The following table lists the permissions you need to assign to SecMaster.

**Table 1** Agency permissions
Permission	Description	Assign To	When to Use
ECS FullAccess	All permissions for ECS	SecMaster_Agency	Used to obtain the ECS asset information in the account when you purchase SecMaster for the first time. Used to synchronize ECS asset information for asset management. Used to execute ECS-related playbook workflows, such as one-click host de-isolation and one-click host isolation workflows.
WAF FullAccess	Web Application Firewall (WAF) administrator	SecMaster_Agency	Used to execute WAF-related playbook workflows, such as WAF blocking and WAF address group association policy configuration workflows. Used to obtain website information in WAF for executing baseline inspections in playbook workflows.
SecMaster FullAccess	SecMaster administrator	SecMaster_Agency	Used to perform operations such as alert handling.
HSS FullAccess	Full permissions for HSS	SecMaster_Agency	Used to obtain asset information in HSS for asset information synchronization in the asset management scenario. Used to execute HSS-related playbook workflows, such as vulnerability management and host isolation workflows. Used to obtain HSS status for executing baseline inspections in playbook workflows. Used to execute the vulnerability fixing workflow in the host security vulnerability fixing scenario.
EPS ReadOnlyAccess	Read-only permissions for EPS.	SecMaster_Agency	Used to obtain the list and details of enterprise projects for asset management. Used to obtain the enterprise project ID and name for executing WAF-related playbook workflows, such as "WAF clear Non-domain Policy."
Anti-DDoS ReadOnlyAccess	Read-only permissions for Anti-DDoS.	SecMaster_Agency	Used to query asset information in Anti-DDoS for asset management. Used to obtain Anti-DDoS information for executing baseline inspections in playbook workflows.
IAM ReadOnlyAccess	Read-only permissions for IAM.	SecMaster_Agency	Used to obtain IAM usernames for executing playbook workflows of batch blocking or unblocking IAM users.
WAF Administrator	WAF administrator, who has all permissions for WAF.	SecMaster_Agency	Used to obtain website information in WAF for asset information synchronization in the asset management scenario. Used to execute WAF-related playbook workflows, such as WAF blocking and WAF address group association policy configuration workflows. Used to obtain website information in WAF for executing baseline inspections in playbook workflows.
SMN FullAccess	All permissions for SMN.	SecMaster_Agency	Used to execute playbook workflows related to notifications, for example, the "Automatic Notification of High-Risk Alerts" workflow.
RDS ReadOnlyAccess	Read-only permissions for RDS	SecMaster_Agency	Used to obtain asset information in RDS for asset information synchronization in the asset management scenario. Used to obtain the RDS instance list and details for executing baseline checks in playbook workflows.
EIP ReadOnlyAccess	Read-only permissions for EIP	SecMaster_Agency	Used to obtain the EIP list and details for asset management. Used to obtain the EIP list and details for executing baseline checks in playbook workflows.
Tenant Guest	Read-only permissions for all cloud services except IAM	SecMaster_Agency	Used to query resource information of cloud services except IAM in the baseline check scenario.
NAT ReadOnlyAccess	Read-only permissions for NAT Gateway.	SecMaster_Agency	Used to obtain asset information in NAT Gateway for asset information synchronization in the asset management scenario.
VPC FullAccess	All permissions for VPC.	SecMaster_Agency	Used to obtain asset information in VPC for asset information synchronization in the asset management scenario. Used to execute VPC-related playbook workflows, such as security group blocking and security group blocking cancellation workflows. Used to obtain security group information for executing baseline inspections in playbook workflows.
OBS OperateAccess	Allows a user to perform the basic operations, such as viewing the bucket list, obtaining bucket metadata, listing objects in a bucket, querying bucket location, uploading objects, obtaining objects, deleting objects, and obtaining an object ACL.	SecMaster_Agency	Used to query, upload, and download objects when the OBS plug-in is used.
ELB ReadOnlyAccess	Read-only permissions for ELB.	SecMaster_Agency	Used to synchronize asset information in ELB and provide details about affected assets. Used to obtain asset information in ELB for executing baseline inspections in playbook workflows.
CFW FullAccess	All permissions for CFW.	SecMaster_Agency	Used to obtain asset information in CFW for asset information synchronization in the asset management scenario. Used to execute CFW-related playbook workflows, such as CFW blocking and one-click CFW unblocking workflows.

Prerequisites

The IAM account has been authorized. For details, see How Do I Grant Permissions to an IAM User?
You have purchased SecMaster.

Authorizing SecMaster

Log in to the management console.
Click in the upper left corner of the management console and select a region or project.
Click in the upper left corner of the page and choose Security & Compliance > SecMaster.
In the navigation pane on the left, choose Workspaces > Management.

Figure 1 Workspaces > Management
(Optional) In the upper part of the workspace management page, click Entrusted Service Authorization - Current Tenant.

The service authorization page is automatically displayed the first time you log in.
On the page for assigning permissions, select all required permissions (which are selected by default), select Agree to authorize, and click Confirm.