Ensure static REST API tokens are used only when necessary and configured to expire periodically

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

From the CLI: ; Run the command pureadmin list --api-token to list all accounts and their API token status. ; Review the Created and Expires columns to identify tokens that lack an expiration date (indicated by a -) or have existed longer than the organization's rotation policy allows. ; Verify that each token-holding account is assigned the minimum required management access policy.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

To align with the security recommendations, delete unauthorized or stale API tokens, and ensure that any newly issued tokens are configured with a strict validity period (timeout) so they expire automatically. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the Users panel, click the Edit icon for the user you want to modify. ; To delete a token: Select Remove API Token... and click Remove to confirm. ; To rotate or create an expiring token: Select Create API Token... (or Recreate API Token... to overwrite an existing one). In the prompt, enter a validity period in the Expires In field so the token does not live indefinitely, then click Create. From the CLI: