Ensure Cloud Object Storage bucket access is restricted by using IAM and S3 access control

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Using Console: Complete the following steps to review your assigned access in an account that you have been added to: 1. In the console, click Manage, Access (IAM), and select Users or Manage, Access (IAM), and select Service IDs, depending on which identity you want to review. 2. Select your name or the service ID. 3. Review the assigned access in the Access policies section. Using CLI: Reviewing S3 ACLs to buckets View the S3 ACLs via API or CLI. A typical API call is shown: curl -X "GET" "https://{endpoint}/{bucket-name}?acl" \ -H "Authorization: Bearer {token}" \

How it is fixed

Fix method: Guidance or infrastructure patch

Granting Access to a COS Bucket using IAM Using Console: To create a new bucket-level policy: 1. Navigate to the Access IAM console from the Manage menu. 2. Select Users from the left navigation menu. 3. Select a user. 4. Select the Access Policies tab to view the user's existing policies, assign a new policy, or edit an existing policy. 5. Click Assign access to create a new policy. 6. Choose Assign access to resources. 7. First, select Cloud Object Storage from the services menu. 8. Then, select the appropriate service instance. Enter bucket in the Resource type field and the bucket name in the Resource ID field. 9. Select the wanted service access role. Selecting the lozenge with the number of actions show the actions available to the role. 10. Click Assign Using CLI: From a terminal run the following command: ibmcloud iam user-policy-create <user-name> \ --roles <role> \ --service-name cloud-object-storage \ --service-instance <resource-instance-id> \ --resource-type bucket \ --resource <bucket-name> To list existing policies: ibmcloud iam user-policies <user-name> To edit an existing policy: ibmcloud iam user-policy-update <user-name> <policy-id> \ --roles <role> \ --servic...