Ensure limitations on External Identity Interactions are Enabled

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

To check if you have the External identities interactions limitation set in IBM Cloud, follow these steps: 1. Log in to the IBM Cloud Console 2. Go to Manage, IAM 3. Select Settings in the left-hand menu 4. Select the Resources tab 5. In the External identity interactions box, select Edit 6. Ensure the Limited option is selected

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Log in to the IBM Cloud Console 2. Go to Manage, IAM 3. Select Settings in the left-hand menu 4. Select the Resources tab 5. In the External identity interactions box, select Edit 6. When turning the setting on for the first time in an existing account, it is recommended to enable the setting in Report-only mode for 30 days, then monitor ICL logs for any calls made from other accounts. If valid cross-account flows are found, they can be explicitly allowed by creating a trusted profile with the appropriate access and allowing the identity in a different account to assume the trusted profile in your account. 7. After remediating any desired cross-account interactions, set the value of the setting to Limited.