Ensure static REST API tokens are used only when necessary and configured to expire periodically

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

From the CLI: ; Run the command pureadmin list --api-token to list all accounts and their API token status. ; Review the Created and Expires columns to identify tokens that lack an expiration date (indicated by a -) or have existed longer than the organization's rotation policy allows. ; Verify that each token-holding account is assigned the minimum required management access policy.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To align with the security recommendations, delete unauthorized or stale API tokens, and ensure that any newly issued tokens are configured with a strict validity period (timeout) so they expire automatically. From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the Users panel, click the Edit icon for the user you want to modify. ; To delete a token: Select Remove API Token... and click Remove to confirm. ; To rotate or create an expiring token: Select Create API Token... (or Recreate API Token... to overwrite an existing one). In the prompt, enter a validity period in the Expires In field so the token does not live indefinitely, then click Create. From the CLI: