TMA-IBMCLOUD-1.11

Ensure Trusted Profiles are used in place of ServiceIDs wherever feasible

СреднийУровень 1Ручная проверкаibmcloud

Описание

IBM Cloud trusted profiles are used to securely manage identity and access for applications running on IBM Cloud without relying on static credentials like API keys. One use of Trusted Profiles is to allow an application running on an IBM Cloud compute resource to assume the Trusted Profile and its access based on the identity of the compute resource where it is running, eliminating the need for the application to store and manage an API key. Trusted Profiles are preferred over ServiceIDs because they offer a more secure, scalable, and maintainable approach to identity and access management. Unlike ServiceIDs, which are static and tied to specific credentials, Trusted Profiles leverage the built-in identities of compute resources to assign least privilege access to applications running on those compute resources. They reduce the risk of credential sprawl and simplify auditing and comp...

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

To check if you have trusted profiles set up in your IBM Cloud account 1. Log in to the IBM Cloud Console 2. Navigate to IAM, Trusted Profiles. This section displays all existing profiles, including those assigned to users, federated identities, or compute resources like Kubernetes clusters.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To create new trusted profile, complete the following steps: 1. Log in to the IBM Cloud Console 2. Navigate to Manage, Access (IAM), Trusted profiles 3. Click Create and define the profile’s name, description, trusted entity type (such as federated users or compute resources), and access conditions.

Свойства

Операционные системы: Любая
Теги: cloudibmcloud
Источник: CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.11 Ensure Trusted Profiles are used in place of ServiceIDs wherever feasible