TMA-ALIBABA-5.7
Ensure network access rule for storage bucket is not set to publicly accessible
Mô tả
Restricting default network access helps to provide a new layer of security, since OSS accept connections from clients on any network. To limit access to selected networks, the default action must be changed. Access can be granted to public internet IP address ranges, to enable connections from specific internet or on-premises clients. When network rules are configured, only applications from allowed networks can access OSS ... Reported as a manual review item: the benchmark audit needs console review or organisational judgement.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
Using the management console: 1. Logon to OSS console. 2. In the bucket-list pane, click on a target OSS bucket 3. Click on Files in top middle of the console 4. Click on Authorize 5. Ensure a policy is set to be granted to public internet IP address ranges
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Using the management console: 1. Logon to OSS console. 2. In the bucket-list pane, click on a target OSS bucket 3. Click on Files in top middle of the console 4. Click on Authorize 5. Click on Whole Bucket,*,None, Condition IP = specified IP address or IP address segment 6. Click on Save
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- alibabaoss
- Tham chiếu
- CIS Alibaba Cloud Foundation Benchmark v2.0.1 - 5.7 Ensure network access rule for storage bucket is not set to publicly accessible