TMA-IBMCLOUD-1.11
Ensure Trusted Profiles are used in place of ServiceIDs wherever feasible
Description
IBM Cloud trusted profiles are used to securely manage identity and access for applications running on IBM Cloud without relying on static credentials like API keys. One use of Trusted Profiles is to allow an application running on an IBM Cloud compute resource to assume the Trusted Profile and its access based on the identity of the compute resource where it is running, eliminating the need for the application to store and manage an API key. Trusted Profiles are preferred over ServiceIDs because they offer a more secure, scalable, and maintainable approach to identity and access management. Unlike ServiceIDs, which are static and tied to specific credentials, Trusted Profiles leverage the built-in identities of compute resources to assign least privilege access to applications running on those compute resources. They reduce the risk of credential sprawl and simplify auditing and comp...
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
To check if you have trusted profiles set up in your IBM Cloud account 1. Log in to the IBM Cloud Console 2. Navigate to IAM, Trusted Profiles. This section displays all existing profiles, including those assigned to users, federated identities, or compute resources like Kubernetes clusters.
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
To create new trusted profile, complete the following steps: 1. Log in to the IBM Cloud Console 2. Navigate to Manage, Access (IAM), Trusted profiles 3. Click Create and define the profile’s name, description, trusted entity type (such as federated users or compute resources), and access conditions.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- cloudibmcloud
- Référence
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.11 Ensure Trusted Profiles are used in place of ServiceIDs wherever feasible