Ensure Cloud Object Storage encryption is done with customer managed keys

Trung bìnhCấp 2Xem xét thủ côngibmcloud

Mô tả

Users can store objects in IBM Cloud Object Storage buckets by providing their own encryption keys which get applied at a per object level. Users can have added security and granular control over the encryption keys at a per object level.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Using API/CLI: Use of Server-Side Encryption with Customer-Provided Keys (SSE-C) can be validated by the following steps: Note: Ensure that you have completed the configuration setup to use the CLI by following the guidelines on the Using the AWS CLI page 1. Review the metadata of the object that is encrypted using the customer-provided key. The operation can be performed using an API call or via a command-line interface. Here is an example call to get the object metadata: aws --endpoint https://s3.private.au-syd.cloud-object-storage.appdomain.cloud s3api head-object --bucket <bucket-name> --key <object-name> --sse-customer- algorithm=AES256 --sse-customer-key=<customer-key-used-to encrypt-the-object> 1. The presence of the object headers SSECustomerKeyMD5 and SSECustomerAlgorithm from the API/CLI response should confirm that the object is encrypted using the key.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Using API/CLI: Objects can be uploaded with your own key by using a PUT object request with key specific headers. Please refer to Server-Side Encryption with Customer-Provided Keys for additional information.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: cloudcryptoencryptionibmcloud
Tham chiếu: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.1.1.1 Ensure Cloud Object Storage encryption is done with customer managed keys