Ensure OCI IAM credentials unused for 45 days or more are disabled

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Perform the following to determine if unused credentials exist: From Console: For Passwords: 1. Login to OCI Console. 2. Select Identity & Security from the Services menu. 3. Select Domains from the Identity menu. 4. For each domain listed, click on the name 5. Click Reports 6. Under Dormant users report click View report 7. Enter a date 45 days from today's date in Last Successful Login Date 8. Check and ensure that Last Successful Login Date is greater than 45 days or empty For API Keys: 1. Login to OCI Console. 2. Select Observability & Management from the Services menu. 3.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

From Console: 1. Login to OCI Console. 2. Select Identity & Security from the Services menu. 3. Select Domains from the Identity menu. 4. For each domain listed, click on the name and select Users. 5. Click on an individual user under the Username heading. 6. Click More action 7. Select Deactivate From CLI: 1. Create a input.json: { "operations": [ { "op": "replace", "path": "active","value": false} ], "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "userId": "<user-ocid>" } 2. Execute the below: oci identity-domains user patch --from-json file://file.json --endpoint <identity-domain-endpoint>