漏洞管理服务 CodeArts Inspector
Organizations服务中的服务控制策略（Service Control Policy，以下简称SCP）可以使用以下授权项元素设置访问控制策略。
SCP不直接进行授权，只划定权限边界。将SCP绑定到组织单元或者成员账号时，并没有直接对组织单元或成员账号授予操作权限，而是规定了成员账号或组织单元包含的成员账号的授权范围。
本章节介绍组织服务中SCP使用的元素，这些元素包含了操作（Action）、资源（Resource）和条件（Condition）。
如何使用这些元素编辑SCP自定义策略，请参考创建SCP。
操作（Action）
操作（Action）即为SCP中支持的授权项。
- “访问级别”列描述如何对操作进行分类（list、read和write等）。此分类可帮助您了解在SCP中相应操作对应的访问级别。
- “资源类型”列指每个操作是否支持资源级权限。
- 资源类型支持通配符号*表示所有。如果此列没有值（-），则必须在SCP语句的Resource元素中指定所有资源类型（“*”）。
- 如果该列包含资源类型，则必须在具有该操作的语句中指定该资源的URN。
- 资源类型列中必需资源在表中用星号（*）标识，表示使用此操作必须指定该资源类型。
关于CodeArts Inspector定义的资源类型的详细信息请参见资源类型（Resource）。
- “条件键”列包括了可以在SCP语句的Condition元素中支持指定的键值。
- 如果该授权项资源类型列存在值，则表示条件键仅对列举的资源类型生效。
- 如果该授权项资源类型列没有值（-），则表示条件键对整个授权项生效。
- 如果此列条件键没有值（-），表示此操作不支持指定条件键。
关于CodeArts Inspector定义的条件键的详细信息请参见条件（Condition）。
您可以在SCP语句的Action元素中指定以下CodeArts Inspector的相关操作。
|
授权项 |
描述 |
访问级别 |
资源类型（*为必须） |
条件键 |
|---|---|---|---|---|
|
codeartsinspector:host:batchUpdate |
批量编辑主机信息 |
write |
- |
- |
|
codeartsinspector:host:list |
获取主机列表 |
read |
- |
- |
|
codeartsinspector:host:batchCreate |
添加主机 |
write |
- |
- |
|
codeartsinspector:host:checkConnection |
主机互通性测试 |
read |
- |
- |
|
codeartsinspector:host:batchwrite |
批量删除主机 |
write |
- |
- |
|
codeartsinspector:host:createGroup |
添加主机组 |
write |
- |
- |
|
codeartsinspector:host:listGroups |
获取主机组列表 |
read |
- |
- |
|
codeartsinspector:host:updateGroup |
编辑主机组 |
write |
- |
- |
|
codeartsinspector:host:writeGroup |
删除主机组 |
write |
- |
- |
|
codeartsinspector:host:createJumpServer |
添加跳板机 |
write |
- |
- |
|
codeartsinspector:host:updateJumpServer |
编辑跳板机 |
write |
- |
- |
|
codeartsinspector:host:writeJumpServer |
删除跳板机 |
write |
- |
- |
|
codeartsinspector:host:listJumpServers |
获取跳板机列表 |
read |
- |
- |
|
codeartsinspector:host:getJumpServer |
获取跳板机信息 |
read |
- |
- |
|
codeartsinspector::createHostKey |
创建KMS密钥 |
write |
- |
- |
|
codeartsinspector::listHostKeys |
获取已创建的KMS密钥 |
read |
- |
- |
|
codeartsinspector:host:getReport |
获取主机扫描漏洞列表 |
read |
- |
- |
|
codeartsinspector:host:getTask |
获取扫描任务详细信息 |
read |
- |
- |
|
codeartsinspector:host:listTasks |
获取历史扫描任务列表 |
read |
- |
- |
|
codeartsinspector:host:writeSmbCredential |
删除smb授权信息 |
write |
- |
- |
|
codeartsinspector:host:createSmbCredential |
添加smb授权信息 |
write |
- |
- |
|
codeartsinspector:host:updateSmbCredential |
编辑smb授权信息 |
write |
- |
- |
|
codeartsinspector:host:listSmbCredentials |
获取smb授权信息列表 |
read |
- |
- |
|
codeartsinspector:host:getSmbCredential |
获取smb授权详细信息 |
read |
- |
- |
|
codeartsinspector:host:writeSshCredential |
删除ssh授权信息 |
write |
- |
- |
|
codeartsinspector:host:listSshCredentials |
获取ssh授权信息列表 |
read |
- |
- |
|
codeartsinspector:host:getSshCredential |
获取ssh授权详细信息 |
read |
- |
- |
|
codeartsinspector:host:createSshCredential |
添加ssh授权信息 |
write |
- |
- |
|
codeartsinspector:host:updateSshCredential |
编辑ssh授权信息 |
write |
- |
- |
|
codeartsinspector:host:getReportFileStatus |
获取主机扫描报告状态 |
read |
- |
- |
|
codeartsinspector:host:downloadReportFile |
获取主机扫描漏洞报告 |
read |
- |
- |
|
codeartsinspector:host:batchGenerateReportFiles |
生成报告 |
read |
- |
- |
|
codeartsinspector:host:changeVulnerability |
取消忽略漏洞 |
write |
- |
- |
|
codeartsinspector::getDashboard |
页面反攻，查询租户主机资产统计信息 |
read |
- |
- |
|
codeartsinspector:website:resumeOrPauseMonitorTask |
开始/暂停/重启 监测任务 |
write |
- |
- |
|
codeartsinspector::getSubscription |
订阅查询接口 |
read |
- |
- |
|
codeartsinspector:website:update |
编辑域名 |
write |
- |
- |
|
codeartsinspector:website:batchCreate |
批量创建域名 |
write |
- |
- |
|
codeartsinspector:website:batchwrite |
批量删除域名 |
write |
- |
- |
|
codeartsinspector:website:list |
域名列表 |
read |
- |
- |
|
codeartsinspector:website:list |
域名列表（含扫描信息） |
write |
- |
- |
|
codeartsinspector:website:list |
域名列表（不分页） |
read |
- |
- |
|
codeartsinspector:website:startTask |
新版创建扫描任务 |
write |
- |
- |
|
codeartsinspector:website:batchStartTasks |
批量创建扫描任务 |
write |
- |
- |
|
codeartsinspector:website:getReport |
报告总览 |
read |
- |
- |
|
codeartsinspector:website:getTask |
获取扫描任务详情 |
read |
- |
- |
|
codeartsinspector:website:batchStopTasks |
批量取消或重启扫描任务 |
write |
- |
- |
|
codeartsinspector:website:downloadReportFile |
下载漏洞报告 |
read |
- |
- |
|
codeartsinspector:website:getReportFileStatus |
获取漏洞报告状态 |
read |
- |
- |
|
codeartsinspector:website:generateReportFile |
生成漏洞报告 |
write |
- |
- |
|
codeartsinspector::listReportFiles |
通过条件查询扫描报告信息 |
read |
- |
- |
|
codeartsinspector::batchDownloadReportFiles |
报告中心下载扫描报告 |
write |
- |
- |
|
codeartsinspector::batchwriteReportFiles |
报告中心删除报告 |
write |
- |
- |
|
codeartsinspector:website:create |
创建域名资产 |
write |
- |
- |
|
codeartsinspector:website:write |
删除域名资产 |
write |
- |
- |
|
codeartsinspector:website:list |
获取域名资产 |
read |
- |
- |
|
codeartsinspector:website:authorize |
认证域名资产 |
write |
- |
- |
|
codeartsinspector:website:updateSettings |
更新域名配置 |
write |
- |
- |
|
codeartsinspector:website:getSettings |
获取域名配置 |
read |
- |
- |
|
codeartsinspector:website:stopTask |
取消或重启域名漏洞扫描任务 |
write |
- |
- |
|
codeartsinspector:website:listTasks |
获取域名的历史扫描任务 |
read |
- |
- |
|
codeartsinspector:website:changeVulnerability |
更新漏洞的误报状态 |
write |
- |
- |
|
codeartsinspector::createOrder |
console调用，订购下单 |
write |
- |
- |
|
codeartsinspector::updateOrder |
console调用，变更下单 |
write |
- |
- |
|
codeartsinspector:host:BatchStartTasks |
批量启动或取消主机扫描任务 |
write |
- |
- |
|
codeartsinspector::getWeakPasswordDictionary |
获取自定义弱密码字典 |
read |
- |
- |
|
codeartsinspector::updateWeakPasswordDictionary |
更新自定义弱密码字典 |
write |
- |
- |
CodeArts Inspector的API通常对应着一个或多个授权项。表2展示了API与授权项的关系，以及该API需要依赖的授权项。
|
API |
对应的授权项 |
依赖的授权项 |
|---|---|---|
|
GET/v1/{project_id}/hostscan/dashboard/recentscans |
codeartsinspector::getDashboard |
- |
|
GET/v1/{project_id}/hostscan/dashboard/assets |
codeartsinspector::getDashboard |
- |
|
GET/v1/{project_id}/hostscan/dashboard/lastscan |
codeartsinspector::getDashboard |
- |
|
POST/v1/{project_id}/hostscan/hosts/batch/edit |
codeartsinspector:host:batchUpdate |
- |
|
POST/v1/{project_id}/hostscan/hosts/batch/changegroup |
codeartsinspector:host:batchUpdate |
- |
|
GET/v1/{project_id}/hostscan/hosts |
codeartsinspector:host:list |
- |
|
GET/v1/{project_id}/hostscan/hosts/ecslist |
codeartsinspector:host:list |
- |
|
POST/v1/{project_id}/hostscan/hosts /v2/{project_id}/hostscan/hosts |
codeartsinspector:host:batchCreate |
- |
|
GET/v1/{project_id}/hostscan/host/ssh-check/{hostId} |
codeartsinspector:host:checkConnection |
- |
|
POST/v1/{project_id}/hostscan/hosts/batch/delete |
codeartsinspector:host:batchDelete |
- |
|
POST/v1/{project_id}/hostscan/hostgroups |
codeartsinspector:host:createGroup |
- |
|
GET/v1/{project_id}/hostscan/hostgroups |
codeartsinspector:host:listGroups |
- |
|
PUT/v1/{project_id}/hostscan/hostgroups/{hostgroupid} |
codeartsinspector:host:updateGroup |
- |
|
DELETE/v1/{project_id}/hostscan/hostgroups/{hostgroupid} |
codeartsinspector:host:deleteGroup |
- |
|
POST/v1/{project_id}/hostscan/jumperservers /v2/{project_id}/hostscan/jumperservers |
codeartsinspector:host:createJumpServer |
- |
|
PUT/v1/{project_id}/hostscan/jumperservers/{jumper_server_id} |
codeartsinspector:host:updateJumpServer |
- |
|
DELETE/v1/{project_id}/hostscan/jumperservers/{jumper_server_id} |
codeartsinspector:host:deleteJumpServer |
- |
|
GET/v1/{project_id}/hostscan/jumperservers |
codeartsinspector:host:listJumpServers |
- |
|
GET/v1/{project_id}/hostscan/jumperservers/{jumper_server_id} |
codeartsinspector:host:getJumpServer |
- |
|
POST/v1/{project_id}/hostscan/kms-create |
codeartsinspector::createHostKey |
- |
|
GET/v1/{project_id}/hostscan/kms-keys |
codeartsinspector::listHostKeys |
- |
|
GET/v1/{project_id}/hostscan/shosts/{shostid}/sysvulns |
codeartsinspector:host:getReport |
- |
|
GET/v1/{project_id}/hostscan/shosts/{shostid}/scanitems |
codeartsinspector:host:getReport |
- |
|
GET/v1/{project_id}/hostscan/shosts/{shostid}/benchmarks |
codeartsinspector:host:getReport |
- |
|
GET/v1/{project_id}/hostscan/shosts/{shostid}/sysvulns/{vulnid} |
codeartsinspector:host:getReport |
- |
|
GET/v1/{project_id}/hostscan/shosts/{shostid}/gradedprotection |
codeartsinspector:host:getReport |
- |
|
GET/v1/{project_id}/hostscan/shosts/{shostid}/scaninfo |
codeartsinspector:host:getTask |
- |
|
GET/v1/{project_id}/hostscan/hosts/{hostid}/scanhistory |
codeartsinspector:host:listTasks |
- |
|
POST/v1/{project_id}/hostscan/hosts/batch/scans |
codeartsinspector:host:BatchStartTasks |
- |
|
DELETE/v1/{project_id}/hostscan/smbcredentials/{smb_credential_id} |
codeartsinspector:host:deleteSmbCredential |
- |
|
POST/v1/{project_id}/hostscan/smbcredentials |
codeartsinspector:host:createSmbCredential |
- |
|
PUT/v1/{project_id}/hostscan/smbcredentials/{smb_credential_id} |
codeartsinspector:host:updateSmbCredential |
- |
|
GET/v1/{project_id}/hostscan/smbcredentials |
codeartsinspector:host:listSmbCredentials |
- |
|
GET/v1/{project_id}/hostscan/smbcredentials/{smb_credential_id} |
codeartsinspector:host:getSmbCredential |
- |
|
DELETE/v1/{project_id}/hostscan/sshcredentials/{ssh_credential_id} |
codeartsinspector:host:deleteSshCredential |
- |
|
GET/v1/{project_id}/hostscan/sshcredentials |
codeartsinspector:host:listSshCredentials |
- |
|
GET/v1/{project_id}/hostscan/sshcredentials/{ssh_credential_id} |
codeartsinspector:host:getSshCredential |
- |
|
POST/v1/{project_id}/hostscan/sshcredentials /v2/{project_id}/hostscan/sshcredentials |
codeartsinspector:host:createSshCredential |
- |
|
PUT/v1/{project_id}/hostscan/sshcredentials/{ssh_credential_id} |
codeartsinspector:host:updateSshCredential |
- |
|
GET/v1/{project_id}/hostscan/vuln/report/status |
codeartsinspector:host:getReportFileStatus |
- |
|
GET/v1/{project_id}/hostscan/vuln/report |
codeartsinspector:host:downloadReportFile |
- |
|
GET/v1/{project_id}/hostscan/vuln/report/gradedprotection |
codeartsinspector:host:downloadReportFile |
- |
|
GET/v1/{project_id}/hostscan/vuln/report/generate |
codeartsinspector:host:batchGenerateReportFiles |
- |
|
GET/v1/{project_id}/hostscan/vuln/report/download |
codeartsinspector:host:downloadReportFile |
- |
|
GET/v1/{project_id}/hostscan/vuln/{hostid}/{vulnid}/falsepositive |
codeartsinspector:host:getReport |
- |
|
DELETE/v1/{project_id}/hostscan/vuln/{hostid}/{vulnid}/falsepositive |
codeartsinspector:host:changeVulnerability |
- |
|
PUT/v1/{project_id}/hostscan/vuln/{hostid}/{vulnid}/falsepositive |
codeartsinspector:host:changeVulnerability |
- |
|
POST/v1/{project_id}/hostscan/vuln/{hostid}/falsepositives |
codeartsinspector:host:changeVulnerability |
- |
|
GET/v2/{project_id}/hostscan/dashboard/asset-risk |
codeartsinspector::getDashboard |
- |
|
GET/v2/{project_id}/hostscan/dashboard/assets |
codeartsinspector::getDashboard |
- |
|
GET/v2/{project_id}/hostscan/dashboard/top-vul |
codeartsinspector::getDashboard |
- |
|
GET/v2/{project_id}/hostscan/dashboard/vul |
codeartsinspector::getDashboard |
- |
|
GET/v1/{project_id}/webscan/redirect |
codeartsinspector::getDashboard |
- |
|
GET/v1/{project_id}/webscan/dashboard |
codeartsinspector::getDashboard |
- |
|
GET/v1/{project_id}/vssscan/dashboard/assets |
codeartsinspector::getDashboard |
- |
|
GET/v1/{project_id}/vssscan/dashboard/lastscan |
codeartsinspector::getDashboard |
- |
|
GET/v1/{project_id}/vssscan/dashboard/recentscans |
codeartsinspector::getDashboard |
- |
|
POST/v1/{project_id}/webscan/monitor/{jobid} |
codeartsinspector:website:resumeOrPauseMonitorTask |
- |
|
GET/v2/{project_id}/{service}/subscription |
codeartsinspector::getSubscription |
- |
|
GET/v2/{project_id}/webscan/resource/generate |
codeartsinspector::getSubscription |
- |
|
PUT/v1/{project_id}/webscan/domain/edit /v2/{project_id}/webscan/domain/edit |
codeartsinspector:website:update |
- |
|
POST/v2/{project_id}/webscan/domain/create /v1/{project_id}/webscan/domain/create |
codeartsinspector:website:create |
- |
|
POST/v2/{project_id}/webscan/domains/create |
codeartsinspector:website:batchCreate |
- |
|
POST/v2/{project_id}/webscan/domain/batch-create |
codeartsinspector:website:batchCreate |
- |
|
DELETE/v1/{project_id}/webscan/domain |
codeartsinspector:website:delete |
- |
|
DELETE/v2/{project_id}/webscan/domain/batch-delete |
codeartsinspector:website:batchDelete |
- |
|
GET/v2/{project_id}/webscan/domains |
codeartsinspector:website:list |
- |
|
POST/v2/{project_id}/webscan/domains/info |
codeartsinspector:website:list |
- |
|
GET/v1/{project_id}/webscan/domain |
codeartsinspector:website:list |
- |
|
POST/v1/{project_id}/webscan/domain/authorize |
codeartsinspector:website:authorize |
- |
|
POST/v2/{project_id}/webscan/domain/editsetting |
codeartsinspector:website:updateSettings |
- |
|
GET/v2/{project_id}/webscan/domain/getsetting |
codeartsinspector:website:getSettings |
- |
|
POST/v1/{project_id}/webscan/scan /v2/{project_id}/webscan/scan |
codeartsinspector:website:startTask |
- |
|
POST/v2/{project_id}/webscan/scan/create |
codeartsinspector:website:startTask |
- |
|
POST/v2/{project_id}/webscan/batch-scan |
codeartsinspector:website:batchStartTasks |
- |
|
GET/v1/{project_id}/webscan/scan/snippet |
codeartsinspector:website:listTasks |
- |
|
GET/v1/{project_id}/webscan/scan/{sid}/overview |
codeartsinspector:website:getReport |
- |
|
GET/v1/{project_id}/webscan/scan/scanitems |
codeartsinspector:website:getReport |
- |
|
GET/v1/{project_id}/webscan/scan |
codeartsinspector:website:getTask |
- |
|
PUT/v1/{project_id}/webscan/scan |
codeartsinspector:website:stopTask |
- |
|
PUT/v1/{project_id}/webscan/batch-scan |
codeartsinspector:website:batchStopTasks |
- |
|
GET/v1/{project_id}/webscan/ports |
codeartsinspector:website:getReport |
- |
|
GET/v1/{project_id}/webscan/scan/{scanID}/content /v1/{project_id}/webscan/scan/{scanID}/business_risk |
codeartsinspector:website:getReport |
- |
|
GET/v1/{project_id}/webscan/structure |
codeartsinspector:website:getReport |
- |
|
GET/v1/{project_id}/webscan/export |
codeartsinspector:website:downloadReportFile |
- |
|
GET/v1/{project_id}/webscan/reports/status |
codeartsinspector:website:getReportFileStatus |
- |
|
POST/v1/{project_id}/webscan/reports |
codeartsinspector:website:generateReportFile |
- |
|
POST/v1/{projectid}/webscan/reports/batch |
codeartsinspector:website:generateReportFile |
- |
|
GET/v1/{project_id}/webscan/reports |
codeartsinspector:website:downloadReportFile |
- |
|
GET/v1/{project_id}/webscan/vulns |
codeartsinspector:website:getReport |
- |
|
GET/v1/{project_id}/webscan/vuln/statistics |
codeartsinspector:website:getReport |
- |
|
GET/v2/{project_id}/webscan/fingerprint/get |
codeartsinspector:website:getReport |
- |
|
PUT/v1/{project_id}/webscan/vuln |
codeartsinspector:website:changeVulnerability |
- |
|
PUT/v1/{project_id}/webscan/vuln/batch |
codeartsinspector:website:changeVulnerability |
- |
|
GET/v2/{project_id}/webscan/dashboard/assets |
codeartsinspector::getDashboard |
- |
|
GET/v2/{project_id}/webscan/dashboard/asset-risk |
codeartsinspector::getDashboard |
- |
|
GET/v2/{project_id}/webscan/dashboard/vul |
codeartsinspector::getDashboard |
- |
|
GET/v2/{project_id}/webscan/dashboard/top-vul |
codeartsinspector::getDashboard |
- |
|
GET/v1/{project_id}/webscan/reportcenter/reports |
codeartsinspector::listReportFiles |
- |
|
POST/v1/{project_id}/webscan/reportcenter/download |
codeartsinspector::batchDownloadReportFiles |
- |
|
DELETE/v1/{project_id}/webscan/reportcenter/delete |
codeartsinspector::batchDeleteReportFiles |
- |
|
POST/v3/{project_id}/webscan/domains |
codeartsinspector:website:create |
- |
|
DELETE/v3/{project_id}/webscan/domains |
codeartsinspector:website:delete |
- |
|
GET/v3/{project_id}/webscan/domains |
codeartsinspector:website:list |
- |
|
POST/v3/{project_id}/webscan/domains/authenticate |
codeartsinspector:website:authorize |
- |
|
POST/v3/{project_id}/webscan/domains/settings |
codeartsinspector:website:updateSettings |
- |
|
GET/v3/{project_id}/webscan/domains/settings |
codeartsinspector:website:getSettings |
- |
|
POST/v3/{project_id}/webscan/tasks |
codeartsinspector:website:startTask |
- |
|
PUT/v3/{project_id}/webscan/tasks |
codeartsinspector:website:stopTask |
- |
|
GET/v3/{project_id}/webscan/tasks |
codeartsinspector:website:getTask |
- |
|
GET/v3/{project_id}/webscan/tasks/histories |
codeartsinspector:website:listTasks |
- |
|
GET/v3/{project_id}/webscan/results |
codeartsinspector:website:getReport |
- |
|
GET/v3/{project_id}/webscan/results/ports |
codeartsinspector:website:getReport |
- |
|
GET/v3/{project_id}/webscan/results/business-risk |
codeartsinspector:website:getReport |
- |
|
GET/v3/{project_id}/webscan/report/status |
codeartsinspector:website:getReportFileStatus |
- |
|
POST/v3/{project_id}/webscan/report |
codeartsinspector:website:generateReportFile |
- |
|
GET/v3/{project_id}/webscan/report |
codeartsinspector:website:downloadReportFile |
- |
|
POST/v3/{project_id}/webscan/vulnerability/false-positive |
codeartsinspector:website:changeVulnerability |
- |
|
POST/v1/{project_id}/{service}/subscription/purchase |
codeartsinspector::createOrder |
- |
|
POST/v1/{project_id}/{service}/subscription/alter |
codeartsinspector::updateOrder |
- |
|
POST/v3/{project_id}/hostscan/hosts |
codeartsinspector:host:batchCreate |
- |
|
GET/v3/{project_id}/hostscan/hosts |
codeartsinspector:host:list |
- |
|
DELETE/v3/{project_id}/hostscan/hosts/delete/{host_id} |
codeartsinspector:host:batchDelete |
- |
|
GET/v3/{project_id}/hostscan/groups |
codeartsinspector:host:listGroups |
- |
|
POST/v3/{project_id}/hostscan/groups |
codeartsinspector:host:createGroup |
- |
|
DELETE/v3/{project_id}/hostscan/groups/{group_id} |
codeartsinspector:host:deleteGroup |
- |
|
POST/v3/{project_id}/hostscan/hosts/scan |
codeartsinspector:host:BatchStartTasks |
- |
|
GET/v3/{project_id}/hostscan/hosts/{host_id}/sys-vulns |
codeartsinspector:host:getReport |
- |
|
GET/v3/{project_id}/hostscan/config/weak-passwords |
codeartsinspector::getWeakPasswordDictionary |
- |
|
GET/v3/{project_id}/hostscan/config/default-weak-passwords |
codeartsinspector::getWeakPasswordDictionary |
- |
|
POST/v3/{project_id}/hostscan/config/weak-passwords |
codeartsinspector::updateWeakPasswordDictionary |
- |
资源类型（Resource）
CodeArts Inspector服务不支持在SCP中的资源中指定资源进行权限控制。如需允许访问CodeArts Inspector服务，请在SCP的Resource元素中使用通配符号*，表示SCP将应用到所有资源。
条件（Condition）
CodeArts Inspector服务不支持在SCP中的条件键中配置服务级的条件键。
CodeArts Inspector可以使用适用于所有服务的全局条件键，请参考全局条件键。
