TMA-IBMCLOUD-1.18
Ensure IAM Does Not Allow Public Access to Cloud Services
Descripción
IBM Cloud features the capability for users with specific access roles to create access policies that allow all users (authenticated and non-authenticated) to access resources in the account. This “all users” access in turn ends up in public (including non- authenticated) access to resources. Determine if this capability is required by your organization and disable if not required. Some customer use cases require that certain files or data are made available for all users to access, both authenticated and non-authenticated. Even if the public access setting is enabled, resources in your account are not publicly accessible unless an administrator level user has explicitly created a policy to create public access for a resource. As a best practice, if this capability is not required by your organization, it must be disabled to prevent unintentional misuse.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access (IAM). 3. Click Settings. 4. In the public access section of IAM Settings, observe the Public access group setting. 5. If the Public access group setting is disabled, IAM is not providing public access. 6. If the Public access group setting is enabled, proceed to the Access groups page by clicking Access Groups. 7. From the list of Access Groups, select Public Access by clicking on the Access Group name. 8. Ensure that there are no access policies present for services in the list of access policies.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Using Console: To disable the Public Access Group: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access (IAM). 3. Click Settings, Public Access. 4. Disable Public Access to disable the Public Access Group. To keep the Public Access Group enabled and verify that no access policies exist: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access (IAM). 3. Click Settings. 4. In the public access section of IAM Settings, observe the Public access group setting. 5. If the Public access group setting is disabled, IAM is not providing public access. 6. If the Public access group setting is enabled, proceed to the Access groups page by clicking Access Groups. 7. From the list of Access Groups, select Public Access by clicking on the Access Group name. 8. Ensure that there are no access policies present in the list of access policies. 9. To delete an access policy, click on the action menu icon for the access policy and click Remove.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- access-controlcloudiamibmcloud
- Referencia
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.18 Ensure IAM Does Not Allow Public Access to Cloud Services