Alibabacloud Sas Multiaccount Manage — 阿里云SAS多账户管理

Alibaba Cloud Security Center Multi-Account Management and Baseline 报告 导出

Use aliyun 命令行工具 and Python scripts to manage multiple Alibaba Cloud accounts in a resource directory and batch-导出 Security Center baseline 报告s for each account.

Prerequisites and 环境 设置up

• 安装 Alibaba Cloud 命令行工具

# Or 下载 from GitHub: https://github.com/aliyun/aliyun-命令行工具/releases

检查 凭证s:

aliyun sts 获取-caller-身份

If the call fAIls, instruct the user to 运行 aliyun 配置 and 设置 up 凭证s (interactive step, must be completed by the user).

1.1 配置 AI mode and 插件 mode (required)

This 技能 requires aliyun 命令行工具 插件 mode commands (kebab-case) and a fixed User-代理 declaration.

# Keep 插件s up to date aliyun 插件 更新

# 安装 required product 插件s if missing aliyun 插件 安装 --names aliyun-命令行工具-sts,aliyun-命令行工具-sas

# Enable AI mode and 设置 required UA segment aliyun 配置 AI-mode enable aliyun 配置 AI-mode 设置-user-代理 --user-代理 AlibabaCloud-代理-技能s

# Optional 检查s / 回滚 aliyun 配置 AI-mode show aliyun 配置 AI-mode disable

• 安装 Python ≥ 3.6

• 创建 Virtual 环境 and 安装 Dependencies

创建 a virtual 环境 in <技能-path>/scripts/ and 安装 dependencies declared in pyproject.toml:

cd scripts/

# Option A: use venv python3 -m venv .venv .venv/bin/pip 安装 -e .

# Option B: use uv (optional) uv 同步

# Option C: if current Python version is unsupported, 安装 as 系统 dependencies pip 安装 -r requirements.txt

• 运行 Commands

All scripts must be 执行d with Python from the virtual 环境 (whether 创建d via venv, uv, conda, etc.). This document uses .venv/bin/python in examples; replace it with your actual virtual 环境 path.

Working Directory

accounts.json and 导出ed Excel files are saved in the 代理's current working directory (the directory where the command is 执行d). Script files themselves are located in <技能-path>/scripts/. Do not switch into the scripts directory when 运行ning commands, or accounts.json location may shift unexpectedly.

# Example: 运行 from any directory .venv/bin/python /path/to/scripts/accounts.py refresh

Feature 1: Account Management (accounts.py) 工作流 First use: 运行 refresh to fetch account 列出 from the resource directory. 过滤器 as needed: use 搜索 to find tar获取 accounts and 获取 AccountId. Enable/disable control: use enable / disable to decide which accounts participate in batch 导出. Quick 启动 Refresh account 列出

Fetch the latest account 列出 from Alibaba Cloud resource directory and write to accounts.json. Existing enable 状态s are preserved; new accounts are enabled by default.

.venv/bin/python accounts.py refresh

列出 all accounts .venv/bin/python accounts.py 列出

Sample 输出:

1225574417218097 cwx [enabled] 1234567890123456 prod-account [disabled]

搜索 accounts

Fuzzy-搜索 by DisplayName, returning AccountId and enable 状态.

.venv/bin/python accounts.py 搜索 cwx .venv/bin/python accounts.py 搜索 prod

Enable / disable accounts

Control whether an account participates in subsequent batch 导出s.

.venv/bin/python accounts.py enable 1225574417218097 .venv/bin/python accounts.py disable 1234567890123456

accounts.json Structure [ { "AccountId": "1225574417218097", "DisplayName": "cwx", "FolderId": "r-1Q4pqB", "IsMaAccount": "NO", "SasVersion": "0", "enable": true } ]

Feature 2: Batch Baseline 导出 (baseline.py)

Launch 导出 tasks concurrently for all accounts with enable=true. After polling completion, files are 下载ed, 提取ed, and merged into a single Excel file.

工作流 Concurrent submission: submit 导出-record 请求s for all enabled accounts (QPS ≤ 5). Concurrent polling: poll describe-导出-信息 for each account until 导出 completes. 下载 and 提取: 下载 zip and 提取 xlsx. Merge 输出: merge all account xlsx files into one file via merge.py, 应用ending a “Resource Directory Account” column. 清理up temporary files: 删除 per-account temporary xlsx files after merge. Prerequisites accounts.py refresh has been 执行d and account enable/disable configuration is complete. aliyun 命令行工具 is 配置d with valid 凭证s and has SAS 导出-record and describe-导出-信息 权限s. Accounts must have Security Center purchased (free edition accounts are skipped automatically). 导出 cloud 平台 configuration 检查 结果s (CSPM)

导出 baselineCspm 结果s for all enabled accounts and merge into baseline-cspm-merged-{date}.xlsx.

# 导出 for all enabled accounts .venv/bin/python baseline.py 导出-cspm

# 导出 for one specific account .venv/bin/python baseline.py 导出-cspm --account-id 1225574417218097

导出 系统 baseline risk 列出

导出 导出Hc警告 risk 列出 (high/med