diff --git a/par-api/src/main/java/com/par/api/controller/RiskRuleController.java b/par-api/src/main/java/com/par/api/controller/RiskRuleController.java
index 08f1584..9a5a6a8 100644
--- a/par-api/src/main/java/com/par/api/controller/RiskRuleController.java
+++ b/par-api/src/main/java/com/par/api/controller/RiskRuleController.java
@@ -17,6 +17,7 @@ import java.util.Map;
 public class RiskRuleController {
 
     private final RiskRuleService riskRuleService;
+    private final com.par.core.storage.CachedStorageService storageService;
 
     @GetMapping("/api/v1/risk-rules/{siteType}")
     public ResponseEntity<?> getRules(@PathVariable String siteType,
@@ -38,6 +39,19 @@ public class RiskRuleController {
         return ApiResponse.success();
     }
 
+    /** 发布风险规则到云存储 */
+    @PostMapping("/api/v1/risk-rules/{siteType}/upload")
+    public ApiResponse<Void> uploadRules(@PathVariable String siteType,
+            @RequestBody Map<String, Object> payload) {
+        @SuppressWarnings("unchecked")
+        var rules = (List<Map<String, Object>>) payload.get("rules");
+        if (rules == null || rules.isEmpty()) return ApiResponse.error(400, "rules is required");
+        riskRuleService.saveRules(siteType, rules);
+        String json = new com.fasterxml.jackson.databind.ObjectMapper().writeValueAsString(rules);
+        storageService.store("rules/" + siteType + ".json", json);
+        return ApiResponse.success();
+    }
+
     @GetMapping("/api/v1/admin/risk-rules")
     public ApiResponse<List<Map<String, Object>>> adminList(HttpServletRequest request) {
         checkAdmin(request);
@@ -93,6 +107,19 @@ public class RiskRuleController {
         return ApiResponse.success();
     }
 
+    /** 发布默认风险规则到云存储 */
+    @PostMapping("/api/v1/admin/default-rules/{type}/upload")
+    public ApiResponse<Void> uploadDefaultRules(
+            @PathVariable String type, @RequestBody Map<String, Object> payload, HttpServletRequest request) {
+        checkAdmin(request);
+        @SuppressWarnings("unchecked")
+        var rules = (List<Map<String, Object>>) payload.get("rules");
+        riskRuleService.saveRules("default:" + type, rules != null ? rules : List.of());
+        String json = new com.fasterxml.jackson.databind.ObjectMapper().writeValueAsString(rules);
+        storageService.store("rules/default/" + type + ".json", json);
+        return ApiResponse.success();
+    }
+
     private void checkAdmin(HttpServletRequest request) {
         var level = request.getAttribute("trustLevel");
         if (level == null || !"ADMIN".equals(level.toString())) {
diff --git a/web/src/views/RiskRules.vue b/web/src/views/RiskRules.vue
index 48a7a59..0ef5e95 100644
--- a/web/src/views/RiskRules.vue
+++ b/web/src/views/RiskRules.vue
@@ -32,6 +32,7 @@
       <h2 style="margin:0">编辑: {{ editType }}</h2>
       <div style="display:flex;gap:8px">
         <el-button size="small" type="primary" @click="saveRules" :loading="saving">保存</el-button>
+        <el-button size="small" @click="uploadRules" :loading="uploading">上传</el-button>
         <el-button size="small" @click="editType=''">返回列表</el-button>
       </div>
     </div>
@@ -80,7 +81,7 @@
 <script setup>
 import api from '../api'; import { Refresh } from '@element-plus/icons-vue'
 
-const loading = ref(false), saving = ref(false), sites = ref([]), rulesMap = ref({})
+const loading = ref(false), saving = ref(false), uploading = ref(false), sites = ref([]), rulesMap = ref({})
 const editType = ref(''), editorJson = ref('[]')
 const fmt = (t) => t ? (t.substring(0,19)||'').replace('T',' ') : '-'
 const parsed = computed(() => { try { return JSON.parse(editorJson.value) } catch { return [] } })
@@ -113,6 +114,13 @@ const editRule = async (row) => {
 const sync = () => { editorJson.value = JSON.stringify(parsed.value, null, 2) }
 const remove = (idx) => { parsed.value.splice(idx,1); sync() }
 const addRule = () => { parsed.value.push({type:'TRAFFIC',name:'',metric:'',threshold:0,unit:'DAY',condition:'GT',level:'WARN'}); sync() }
+const uploadRules = async () => {
+  uploading.value = true
+  try { await api.raw.post('/risk-rules/'+editType.value+'/upload', { rules: parsed.value }); ElMessage.success('已上传') }
+  catch { ElMessage.error('上传失败') }
+  finally { uploading.value = false }
+}
+
 const saveRules = async () => {
   saving.value = true
   try { await api.raw.post('/risk-rules/'+editType.value, { rules: parsed.value }); ElMessage.success('已保存'); editType.value=''; fetchAll() }