TMA-IBMCLOUD-2.1.5
Ensure Public (anonymous) Access to IBM Cloud Object Storage buckets is Disabled
Descripción
You can disable public (anonymous) access to IBM Cloud Object Storage buckets. Buckets might have to hold open data sets for academic, research, or image repositories that are used by web applications and content delivery networks. You can make these buckets publicly accessible by using the Public Access group. But when buckets contain non-public data (e.g., restricted, internal, confidential or sensitive data), it is important to have public access disabled. To disable the public access, a previously defined access policy must be removed. By default, public access to Cloud Object Storage buckets is disabled. If an access policy is defined that allows public access, you can disable the policy by using the console.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
To check if an access policy exists for a Cloud Object Storage bucket, you can list the access policies for the Public Access group. Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access (IAM). 3. Click Access groups. 4. Select Public Access 5. Check the list of access polices to see if one exists for the relevant Cloud Object Storage bucket.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
To disable public access for buckets, complete the following steps: Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access (IAM). 3. Click Access groups. 4. Click Public Access to see a list of all public access policies currently in use. 5. Find the policy that corresponds to the bucket that you want to return to enforced access control. 6. From the list of actions, select Remove. 7. Confirm that you want to remove the policy.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- access-controlcloudibmcloud
- Referencia
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.1.5 Ensure Public (anonymous) Access to IBM Cloud Object Storage buckets is Disabled