TMA-IBMCLOUD-1.13
Ensure limitations on External Identity Interactions are Enabled
설명
Use IAM settings to restrict external identity interactions in your account. This will block all API calls if the calling userID is not authenticated to your account and has logged in using an API key in a different account. When a user authenticates using an API key in one account, that user can use their token to do actions in any account they are a member of providing they have access policy.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
To check if you have the External identities interactions limitation set in IBM Cloud, follow these steps: 1. Log in to the IBM Cloud Console 2. Go to Manage, IAM 3. Select Settings in the left-hand menu 4. Select the Resources tab 5. In the External identity interactions box, select Edit 6. Ensure the Limited option is selected
조치 방법
조치 방식: 가이드 또는 인프라 패치
1. Log in to the IBM Cloud Console 2. Go to Manage, IAM 3. Select Settings in the left-hand menu 4. Select the Resources tab 5. In the External identity interactions box, select Edit 6. When turning the setting on for the first time in an existing account, it is recommended to enable the setting in Report-only mode for 30 days, then monitor ICL logs for any calls made from other accounts. If valid cross-account flows are found, they can be explicitly allowed by creating a trusted profile with the appropriate access and allowing the identity in a different account to assume the trusted profile in your account. 7. After remediating any desired cross-account interactions, set the value of the setting to Limited.
속성
- 운영 체제
- 모두
- 태그
- cloudibmcloud
- 참고 자료
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.13 Ensure limitations on External Identity Interactions are Enabled