Ensure Trusted Profiles are used in place of ServiceIDs wherever feasible

中レベル 1手動レビューibmcloud

説明

IBM Cloud trusted profiles are used to securely manage identity and access for applications running on IBM Cloud without relying on static credentials like API keys. One use of Trusted Profiles is to allow an application running on an IBM Cloud compute resource to assume the Trusted Profile and its access based on the identity of the compute resource where it is running, eliminating the need for the application to store and manage an API key. Trusted Profiles are preferred over ServiceIDs because they offer a more secure, scalable, and maintainable approach to identity and access management. Unlike ServiceIDs, which are static and tied to specific credentials, Trusted Profiles leverage the built-in identities of compute resources to assign least privilege access to applications running on those compute resources. They reduce the risk of credential sprawl and simplify auditing and comp...

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

To check if you have trusted profiles set up in your IBM Cloud account 1. Log in to the IBM Cloud Console 2. Navigate to IAM, Trusted Profiles. This section displays all existing profiles, including those assigned to users, federated identities, or compute resources like Kubernetes clusters.

修正方法

修正方法: ガイダンスまたは IaC パッチ

To create new trusted profile, complete the following steps: 1. Log in to the IBM Cloud Console 2. Navigate to Manage, Access (IAM), Trusted profiles 3. Click Create and define the profile’s name, description, trusted entity type (such as federated users or compute resources), and access conditions.

プロパティ

オペレーティングシステム: すべて
タグ: cloudibmcloud
参照: CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.11 Ensure Trusted Profiles are used in place of ServiceIDs wherever feasible