Ensure OAuth API clients use least-privilege access policies and access-token TTLs of 60 minutes or less

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

From the CLI: ; Run the command pureapiclient list to display all configured API clients. ; Review the output to verify the Access Policy, Enabled status, and token TTL for each client. ; Verify no API clients are enabled that are no longer actively in use.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To align with the security recommendations, delete or disable inactive API clients, and ensure all active clients are bound to restrictive access policies with short-lived tokens. (Note: Modifying or deleting an active API client will immediately invalidate its issued tokens, so changes should be coordinated with the teams responsible for those integrations). From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the API Clients panel, select any unused clients and click the trash icon to delete them. ; For active clients, click the edit icon to reduce the assigned access policy or shorten the token TTL as appropriate.