TMA-IBMCLOUD-1.16
Ensure Minimal Number of Users are Granted Administrative Privileges
Mô tả
Comply with the principle of granting least privilege by using Access Groups or Trusted Profiles to manage admin privileges and by avoiding the use of broadly scoped access policies. The principle of granting least privilege mandates that a user must only be given access to the resources that are required to complete their task. This task can be hard to maintain when managing large numbers of users. Instead of assigning administrative privileges to individual users, create Access Groups with administrative privileges and add or remove users from these Access Groups as needed. Additionally, instead of using the Platform Administrator role for all Platform Services or all IAM-enabled services, IBM Cloud users can grant access to specific resources and account management services to better comply with the principle of granting least privilege.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access(IAM). 3. Click Users and select a User by clicking on the User name. 4. Click on the Access Policies tab. View the access policies assigned to the User to verify if that User has Administrator Role assigned. 5. Review Access Groups and Trusted Profiles to determine which grant Administrator privileges. 6. For Access Groups and Trusted Profiles that grant Administrator. privileges, review which users are members of the Access Groups or allowed to assume the Trusted Profiles. 7. Verify that all users who have Administrator privileges have a legitimate need for those privileges.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Using Console: To remove excessive number of Users with Administrative privileges, follow the following steps. 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. From the Menu bar, click Manage, Access(IAM). 3. Click Users and select an User by clicking on the User name. 4. Click on the Access Policies tab. 5. View the access policies assigned to the User to verify if that User has Administrator Role. assigned on all Platform Services or all IAM-enabled services. 6. Review Access Groups and Trusted Profiles to determine which grant Administrator privileges. 7. For Access Groups and Trusted Profiles that grant Administrator privileges, review which users are members of the Access Groups or allowed to assume the Trusted Profiles. 8. If there are users who have Administrator privileges but do not have a legitimate need for them, remove the user’s access policy or remove the user from the Access Group or Trusted. Profile. Alternatively you may remove the user from the account.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- cloudibmcloud
- Tham chiếu
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.16 Ensure Minimal Number of Users are Granted Administrative Privileges