TMA-OCI-1.17

Ensure there is only one active API Key for any single OCI IAM user

高レベル 1自動oci

説明

API Keys are long-term credentials for an OCI IAM user. They can be used to make programmatic requests to the OCI APIs directly or via, OCI SDKs or the OCI CLI. Having a single API Key for an OCI IAM reduces attack surface area and makes it easier to manage. No ACTIVE user may have more than one ACTIVE API key. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

チェック方法

監査方法: シェルコマンド

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
us=$(oci iam user list --compartment-id "$t" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
for u in $(printf '%s\n' "$us" | grep -o 'ocid1\.user\.[^"]*'); do
  n=$(oci iam user api-key list --user-id "$u" --query 'length(data[?"lifecycle-state"==`"ACTIVE"`])' --raw-output 2>/dev/null) || exit 1
  [ "${n:-0}" -le 1 ] || { echo "$n active API keys: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Delete all but one API key for each listed user (oci iam user api-key delete --user-id <ocid> --fingerprint <fp>).

プロパティ

オペレーティングシステム: すべて
タグ: ociiam
参照: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.17 Ensure there is only one active API Key for any single OCI IAM user

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target oci