TMA-OCI-1.17

Ensure there is only one active API Key for any single OCI IAM user

YüksekDüzey 1Otomatikoci

Açıklama

API Keys are long-term credentials for an OCI IAM user. They can be used to make programmatic requests to the OCI APIs directly or via, OCI SDKs or the OCI CLI. Having a single API Key for an OCI IAM reduces attack surface area and makes it easier to manage. No ACTIVE user may have more than one ACTIVE API key. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
us=$(oci iam user list --compartment-id "$t" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
for u in $(printf '%s\n' "$us" | grep -o 'ocid1\.user\.[^"]*'); do
  n=$(oci iam user api-key list --user-id "$u" --query 'length(data[?"lifecycle-state"==`"ACTIVE"`])' --raw-output 2>/dev/null) || exit 1
  [ "${n:-0}" -le 1 ] || { echo "$n active API keys: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Delete all but one API key for each listed user (oci iam user api-key delete --user-id <ocid> --fingerprint <fp>).

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: ociiam
Referans: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.17 Ensure there is only one active API Key for any single OCI IAM user

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target oci