TMA-IBMCLOUD-1.11

Ensure Trusted Profiles are used in place of ServiceIDs wherever feasible

MittelStufe 1Manuelle Prüfungibmcloud

Beschreibung

IBM Cloud trusted profiles are used to securely manage identity and access for applications running on IBM Cloud without relying on static credentials like API keys. One use of Trusted Profiles is to allow an application running on an IBM Cloud compute resource to assume the Trusted Profile and its access based on the identity of the compute resource where it is running, eliminating the need for the application to store and manage an API key. Trusted Profiles are preferred over ServiceIDs because they offer a more secure, scalable, and maintainable approach to identity and access management. Unlike ServiceIDs, which are static and tied to specific credentials, Trusted Profiles leverage the built-in identities of compute resources to assign least privilege access to applications running on those compute resources. They reduce the risk of credential sprawl and simplify auditing and comp...

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

To check if you have trusted profiles set up in your IBM Cloud account 1. Log in to the IBM Cloud Console 2. Navigate to IAM, Trusted Profiles. This section displays all existing profiles, including those assigned to users, federated identities, or compute resources like Kubernetes clusters.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To create new trusted profile, complete the following steps: 1. Log in to the IBM Cloud Console 2. Navigate to Manage, Access (IAM), Trusted profiles 3. Click Create and define the profile’s name, description, trusted entity type (such as federated users or compute resources), and access conditions.

Eigenschaften

Betriebssysteme: Beliebig
Tags: cloudibmcloud
Referenz: CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.11 Ensure Trusted Profiles are used in place of ServiceIDs wherever feasible