TMA-OCI-1.9

Ensure user customer secret keys rotate every 90 days

AltaNivel 1Automatizadaoci

Descripción

Object Storage provides an API to enable interoperability with Amazon S3. To use this Amazon S3 Compatibility API, you need to generate the signing key required to authenticate with Amazon S3. This special signing key is an Access Key/Secret Key pair. It is important to rotate customer secret keys at least every 90 days, as they provide the same level of object storage access that the user they are associated with has. No ACTIVE user may hold a customer secret key created more than 90 days ago (users of the Default identity domain, as listed by oci iam user list). Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Cómo se verifica

Método de auditoría: Comando de shell

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cutoff=$(date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%S 2>/dev/null || date -u -v-90d +%Y-%m-%dT%H:%M:%S 2>/dev/null) || exit 1
us=$(oci iam user list --compartment-id "$t" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
for u in $(printf '%s\n' "$us" | grep -o 'ocid1\.user\.[^"]*'); do
  ks=$(oci iam customer-secret-key list --user-id "$u" --query 'data[?"lifecycle-state"==`"ACTIVE"`]."time-created"' --raw-output 2>/dev/null) || exit 1
  old=$(printf '%s\n' "$ks" | grep -o '"[0-9][^"]*"' | tr -d '"' | awk -v c="$cutoff" '$1 < c')
  [ -z "$old" ] || { echo "customer secret key older than 90 days: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Create a new customer secret key (oci iam customer-secret-key create), update S3-compatible clients, then delete the old key.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: ociiam
Referencia: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.9 Ensure user customer secret keys rotate every 90 days

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target oci