Ensure Minimal Number of Service IDs are Granted Administrative Privileges

MittelStufe 1Manuelle Prüfungibmcloud

Beschreibung

Comply with the principle of granting least privilege by using Access Groups to manage admin privileges and by avoiding the use of many Service IDs with Administrative Privileges. The principle of granting least privilege mandates that a Service ID must only be given access to the resources that are required to complete their task. This task can be hard to maintain when managing large numbers of users. Instead of assigning administrative privileges to an individual Service ID, create Access Groups with administrative privileges and add or remove Service IDs from these Access Groups as needed. Additionally, instead of using the Platform Administrator role for all Platform Services or IAM-enabled services, IBM Cloud users can grant access to specific resources and account management services to better comply with the principle of granting least privilege.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access(IAM). 3. Click Service IDs and select a Service ID by clicking on the Service ID name. 4. Click on the Access Policies tab. 5. View the access policies assigned to the Service ID to verify if that Service ID has Administrator Role assigned on all Platform Services or all IAM-enabled services 6. Verify that all service IDs that have Administrator privileges are in use and have a legitimate need for those privileges.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Using Console: To remove excessive number of Users with Administrative privileges, follow the following steps. 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access(IAM). 3. Click Service IDs and select a Service ID by clicking on the Service ID name. 4. Click on the Access Policies tab. 5. View the access policies assigned to the Service IDUser to verify if that Service ID has Administrator Role assigned on all IAM-Enabled services or all Platform Service 6. Review Access Groups and Trusted Profiles to determine which grant Administrator privileges. 7. For Access Groups and Trusted Profiles that grant Administrator privileges, review which Service IDs are members of the Access Groups or allowed to assume the Trusted Profiles. 8. If there are Service IDs that have Administrator privileges but do not have a legitimate need for them, remove the Service ID’s access policy or remove the Service ID from the Access Group or Trusted Profile. Alternatively you may remove the Service ID from the account.

Eigenschaften

Betriebssysteme: Beliebig
Tags: cloudibmcloud
Referenz: CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.17 Ensure Minimal Number of Service IDs are Granted Administrative Privileges