Ensure creation of platform API keys is restricted

MediaNivel 2Automatizadaibmcloud

Descripción

Restricting API key creation to explicitly authorised users reduces unmanaged long-lived credentials. restrict_create_platform_apikey must be RESTRICTED. Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(ibmcloud iam account-settings --output json 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/.*"restrict_create_platform_apikey"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
[ "$v" = RESTRICTED ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

ibmcloud iam account-settings-update --restrict-create-platform-apikey RESTRICTED, then grant 'User API key creator' only to those who need it.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: ibmcloudiam
Referencia: CIS IBM Cloud Foundations Benchmark v2.0.0 - Identity and Access Management - restrict user API key creation (verify section number for your release)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target ibmcloud --level 2