TMA-OCI-1.17

Ensure there is only one active API Key for any single OCI IAM user

VisokaNivo 1Automatskaoci

Opis

API Keys are long-term credentials for an OCI IAM user. They can be used to make programmatic requests to the OCI APIs directly or via, OCI SDKs or the OCI CLI. Having a single API Key for an OCI IAM reduces attack surface area and makes it easier to manage. No ACTIVE user may have more than one ACTIVE API key. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Kako se proverava

Metod provere: Komanda ljuske

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
us=$(oci iam user list --compartment-id "$t" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
for u in $(printf '%s\n' "$us" | grep -o 'ocid1\.user\.[^"]*'); do
  n=$(oci iam user api-key list --user-id "$u" --query 'length(data[?"lifecycle-state"==`"ACTIVE"`])' --raw-output 2>/dev/null) || exit 1
  [ "${n:-0}" -le 1 ] || { echo "$n active API keys: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Delete all but one API key for each listed user (oci iam user api-key delete --user-id <ocid> --fingerprint <fp>).

Svojstva

Operativni sistemi: Bilo koji
Oznake: ociiam
Referenca: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.17 Ensure there is only one active API Key for any single OCI IAM user

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target oci