TMA-IBMCLOUD-2.2.3
Ensure boot volumes are encrypted with Customer managed keys
説明
By default, IBM Cloud® Block Storage for Virtual Private Cloud provides provider- managed encryption for all data. For enhanced security, customers can bring their own encryption keys and manage them through IBM Key Management Services – Key Protect or Hyper Protect Crypto Services (HPCS). With customer-managed keys, only customers can access and manage their master root keys, giving them full control over their data security.
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
You can use the IBM® Cloud Block Storage for Virtual Private Cloud configuration properties to verify whether a block volume is enabled to use Key Protect or Hyper Protect key management services. From Console, Navigate to your block volume resource: 1. In the IBM Cloud console, go to Menu icon, VPC Infrastructure, Storage, Block storage volumes. A list of all block storage volumes displays. 2. For each volumes listed with Attachment Type column value Boot, ensure the encryption field is Not pointing to Provider Managed.
修正方法
修正方法: ガイダンスまたは IaC パッチ
You will not be able to change encryption option once data is already written to a Cloud Block Storage Volume. In order to ensure that data is encrypted using customer managed keys you will need to create a new Cloud Block Storage volume, set it to use either Key Protect or Hyper Protect key management service and then upload/copy the existing objects to this new volume.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- cloudcryptoencryptionibmcloud
- 参照
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.2.3 Ensure boot volumes are encrypted with Customer managed keys