Ensure network access for Cloud Object Storage is set to be exposed only on Private end-points

보통레벨 1수동 검토ibmcloud

설명

IBM Cloud Object Storage bucket context-based restrictions allows administrators to restricts all access to data unless the request originates from a list of allowed IP addresses that are part of the private subnets only. Restrict access to data stored in Cloud Object Storage buckets and enhance security controls by creating a context-based restriction rule that will only allow data access to the list of IP addresses that are part of your private subnet.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

To check or confirm that an IBM Cloud Object Storage bucket is accessible only from a list of authorized IP addresses from private subnets, you can navigate to Access policies section available under your bucket information and check Authorized IPs list. Using Console: 1. Go to IBM Cloud Console: https://cloud.ibm.com/resources 2. Under Storage click on the Cloud Object Storage instance you want to check. (you will be directed to a default bucket listing page) 3. Click on the Cloud Object Storage bucket for which you want to review the bucket policy/context-based restriction information 4. At the bucket information screen, click on the Permissions section on the right navigation in the bucket description. 5. Within Bucket access policies one can view the tab Context-based restrictions 6. Review the list of rules to ensure one includes the IPs/subnets you want authorized, for example, 10.0.0.0/8 would authorize all the private IP addresses that are part of the IBM Cloud Infrastructure to access the bucket.

조치 방법

조치 방식: 가이드 또는 인프라 패치

Follow the steps outlined to add an IP/subnet to the list of Authorized IPs in bucket context-based restriction policies. Using Console: From the IBM Cloud console dashboard, you can restrict access to your content by setting a Context-based Restriction. Set a list of authorized IP addresses 1. Start by selecting Storage to view your resource list. 2. Next, select the service instance with the target bucket from within the Storage menu. The Object Storage Console will be displayed. 3. Select the bucket to navigate to the bucket details interface. 4. Select Permissions from the navigation menu. 5. Select the Context-based restrictions tab. 6. Click on Create rule and follow the instructions here: https://cloud.ibm.com/docs/account?topic=account-context-restrictions- create&interface=ui Note that all objects in this bucket are only accessible from those IP addresses.

속성

운영 체제: 모두
태그: access-controlcloudibmcloudnetwork
참고 자료: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.1.3 Ensure network access for Cloud Object Storage is set to be exposed only on Private end-points