Ensure creation of platform API keys is restricted

MittelStufe 2Automatisiertibmcloud

Beschreibung

Restricting API key creation to explicitly authorised users reduces unmanaged long-lived credentials. restrict_create_platform_apikey must be RESTRICTED. Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

out=$(ibmcloud iam account-settings --output json 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/.*"restrict_create_platform_apikey"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
[ "$v" = RESTRICTED ] && echo compliant

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

ibmcloud iam account-settings-update --restrict-create-platform-apikey RESTRICTED, then grant 'User API key creator' only to those who need it.

Eigenschaften

Betriebssysteme: Beliebig
Tags: ibmcloudiam
Referenz: CIS IBM Cloud Foundations Benchmark v2.0.0 - Identity and Access Management - restrict user API key creation (verify section number for your release)

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target ibmcloud --level 2