Ensure Key Protect root keys have a rotation policy

MittelStufe 1Automatisiertibmcloud

Beschreibung

Rotation policies regularly re-wrap data encryption keys with new root key material. Every root (non-extractable) key in every Key Protect instance must have a rotation policy with interval_month (requires the kp plugin; keys are queried in the targeted region). Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

inst=$(ibmcloud resource service-instances --service-name kms --output json 2>/dev/null) || exit 1
bad=0
for g in $(printf '%s\n' "$inst" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 1 && /"guid"[[:space:]]*:/ { s = $0; sub(/^[^:]*:[[:space:]]*"/, "", s); sub(/".*/, "", s); print s } { d += o - c }'); do
  ks=$(ibmcloud kp keys -i "$g" --output json 2>/dev/null) || exit 1
  ids=$(printf '%s\n' "$ks" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 0 && o > 0 { id = ""; ex = "" } d == 1 && /"id"[[:space:]]*:/ { id = $0; sub(/^[^:]*:[[:space:]]*"/, "", id); sub(/".*/, "", id) } d == 1 && /"extractable"[[:space:]]*:/ { ex = $0 } { d += o - c } d == 0 && c > 0 && ex ~ /false/ { print id }')
  for k in $ids; do
    p=$(ibmcloud kp key policies "$k" -i "$g" --output json 2>/dev/null) || exit 1
    printf '%s\n' "$p" | grep -q '"interval_month"' || { echo "no rotation policy: $g $k"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

ibmcloud kp key policy-update rotation <key-id> -i <instance-id> --monthly-interval 12 (or shorter); alternatively set an instance-level rotation policy (ibmcloud kp instance policy-update rotation).

Eigenschaften

Betriebssysteme: Beliebig
Tags: ibmcloudkms
Referenz: CIS IBM Cloud Foundations Benchmark v2.0.0 - Storage - Key Protect root key rotation (verify section number for your release)

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target ibmcloud