Ensure IAM Does Not Allow Public Access to Cloud Services

높음레벨 1수동 검토ibmcloud

설명

IBM Cloud features the capability for users with specific access roles to create access policies that allow all users (authenticated and non-authenticated) to access resources in the account. This “all users” access in turn ends up in public (including non- authenticated) access to resources. Determine if this capability is required by your organization and disable if not required. Some customer use cases require that certain files or data are made available for all users to access, both authenticated and non-authenticated. Even if the public access setting is enabled, resources in your account are not publicly accessible unless an administrator level user has explicitly created a policy to create public access for a resource. As a best practice, if this capability is not required by your organization, it must be disabled to prevent unintentional misuse.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access (IAM). 3. Click Settings. 4. In the public access section of IAM Settings, observe the Public access group setting. 5. If the Public access group setting is disabled, IAM is not providing public access. 6. If the Public access group setting is enabled, proceed to the Access groups page by clicking Access Groups. 7. From the list of Access Groups, select Public Access by clicking on the Access Group name. 8. Ensure that there are no access policies present for services in the list of access policies.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Using Console: To disable the Public Access Group: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access (IAM). 3. Click Settings, Public Access. 4. Disable Public Access to disable the Public Access Group. To keep the Public Access Group enabled and verify that no access policies exist: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access (IAM). 3. Click Settings. 4. In the public access section of IAM Settings, observe the Public access group setting. 5. If the Public access group setting is disabled, IAM is not providing public access. 6. If the Public access group setting is enabled, proceed to the Access groups page by clicking Access Groups. 7. From the list of Access Groups, select Public Access by clicking on the Access Group name. 8. Ensure that there are no access policies present in the list of access policies. 9. To delete an access policy, click on the action menu icon for the access policy and click Remove.

속성

운영 체제: 모두
태그: access-controlcloudiamibmcloud
참고 자료: CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.18 Ensure IAM Does Not Allow Public Access to Cloud Services