Ensure OCI Console Access Is Restricted to Trusted Networks

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

1. Navigate to Identity & Security, Domains, Security, Sign-On Policies. Confirm that console login rules reference a defined network source (for example, request.networkSource.name = <TrustedSource>). Verify that there is no policy rule permitting console access from any network. 2. Navigate to Identity & Security, Network Sources. Confirm that the trusted network source contains only approved IP addresses, CIDR blocks, or VCN subnets.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

1. Define a Network Source with trusted IP ranges or VCN subnets: Navigate to Identity & Security, Network Sources, Create Network Source. Add approved IPs or CIDRs. 2. Update the Sign-On Policy for the identity domain: Add a rule that allows console login only if request.networkSource.name matches the trusted network source. Add a default deny rule for all other networks. 3. Test access from both inside and outside the trusted network. 4. Maintain a secure break-glass account exempt from the restriction.