TMA-FLASHARRAY-1.8
Ensure OAuth API clients use least-privilege access policies and access-token TTLs of 60 minutes or less
Mô tả
FlashArray supports configuring one or more identity providers for API Clients. These IDPs can then issue identity tokens to any user on the array that can be exchanged with the array for API access using the OAuth2 standard. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
From the CLI: ; Run the command pureapiclient list to display all configured API clients. ; Review the output to verify the Access Policy, Enabled status, and token TTL for each client. ; Verify no API clients are enabled that are no longer actively in use.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
To align with the security recommendations, delete or disable inactive API clients, and ensure all active clients are bound to restrictive access policies with short-lived tokens. (Note: Modifying or deleting an active API client will immediately invalidate its issued tokens, so changes should be coordinated with the teams responsible for those integrations). From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the API Clients panel, select any unused clients and click the trash icon to delete them. ; For active clients, click the edit icon to reduce the assigned access policy or shorten the token TTL as appropriate.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- flasharraystorageaccess-control
- Tham chiếu
- CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.8 Ensure OAuth API clients use least-privilege access policies and access-token TTLs of 60 minutes or less