Ensure creation of service IDs is restricted

MediaNivel 2Automatizadaibmcloud

Descripción

Restricting service ID creation keeps machine identities under central control. restrict_create_service_id must be RESTRICTED. Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(ibmcloud iam account-settings --output json 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/.*"restrict_create_service_id"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n 1)
[ "$v" = RESTRICTED ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

ibmcloud iam account-settings-update --restrict-create-service-id RESTRICTED, then grant 'Service ID creator' only where needed.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: ibmcloudiam
Referencia: CIS IBM Cloud Foundations Benchmark v2.0.0 - Identity and Access Management - restrict service ID creation (verify section number for your release)

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target ibmcloud --level 2