Ensure network access for Cloud Object Storage is set to be exposed only on Private end-points

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

To check or confirm that an IBM Cloud Object Storage bucket is accessible only from a list of authorized IP addresses from private subnets, you can navigate to Access policies section available under your bucket information and check Authorized IPs list. Using Console: 1. Go to IBM Cloud Console: https://cloud.ibm.com/resources 2. Under Storage click on the Cloud Object Storage instance you want to check. (you will be directed to a default bucket listing page) 3. Click on the Cloud Object Storage bucket for which you want to review the bucket policy/context-based restriction information 4. At the bucket information screen, click on the Permissions section on the right navigation in the bucket description. 5. Within Bucket access policies one can view the tab Context-based restrictions 6. Review the list of rules to ensure one includes the IPs/subnets you want authorized, for example, 10.0.0.0/8 would authorize all the private IP addresses that are part of the IBM Cloud Infrastructure to access the bucket.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Follow the steps outlined to add an IP/subnet to the list of Authorized IPs in bucket context-based restriction policies. Using Console: From the IBM Cloud console dashboard, you can restrict access to your content by setting a Context-based Restriction. Set a list of authorized IP addresses 1. Start by selecting Storage to view your resource list. 2. Next, select the service instance with the target bucket from within the Storage menu. The Object Storage Console will be displayed. 3. Select the bucket to navigate to the bucket details interface. 4. Select Permissions from the navigation menu. 5. Select the Context-based restrictions tab. 6. Click on Create rule and follow the instructions here: https://cloud.ibm.com/docs/account?topic=account-context-restrictions- create&interface=ui Note that all objects in this bucket are only accessible from those IP addresses.