Ensure network access for Cloud Object Storage is set to be exposed only on Private end-points

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

To check or confirm that an IBM Cloud Object Storage bucket is accessible only from a list of authorized IP addresses from private subnets, you can navigate to Access policies section available under your bucket information and check Authorized IPs list. Using Console: 1. Go to IBM Cloud Console: https://cloud.ibm.com/resources 2. Under Storage click on the Cloud Object Storage instance you want to check. (you will be directed to a default bucket listing page) 3. Click on the Cloud Object Storage bucket for which you want to review the bucket policy/context-based restriction information 4. At the bucket information screen, click on the Permissions section on the right navigation in the bucket description. 5. Within Bucket access policies one can view the tab Context-based restrictions 6. Review the list of rules to ensure one includes the IPs/subnets you want authorized, for example, 10.0.0.0/8 would authorize all the private IP addresses that are part of the IBM Cloud Infrastructure to access the bucket.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Follow the steps outlined to add an IP/subnet to the list of Authorized IPs in bucket context-based restriction policies. Using Console: From the IBM Cloud console dashboard, you can restrict access to your content by setting a Context-based Restriction. Set a list of authorized IP addresses 1. Start by selecting Storage to view your resource list. 2. Next, select the service instance with the target bucket from within the Storage menu. The Object Storage Console will be displayed. 3. Select the bucket to navigate to the bucket details interface. 4. Select Permissions from the navigation menu. 5. Select the Context-based restrictions tab. 6. Click on Create rule and follow the instructions here: https://cloud.ibm.com/docs/account?topic=account-context-restrictions- create&interface=ui Note that all objects in this bucket are only accessible from those IP addresses.