Ensure Cloud Object Storage bucket access is restricted by using IAM and S3 access control

Trung bìnhCấp 1Xem xét thủ côngibmcloud

Mô tả

Access controls on the Cloud Object Storage buckets are governed via IBM Identity and Access Management (IAM). However, some permissions can also be granted (or restricted) via S3 access controls. Assign IAM access roles for users and Service IDs against buckets, by using either the UI or the CLI to create policies. The S3 Access Control is performed using ACLs granted against buckets and objects.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Using Console: Complete the following steps to review your assigned access in an account that you have been added to: 1. In the console, click Manage, Access (IAM), and select Users or Manage, Access (IAM), and select Service IDs, depending on which identity you want to review. 2. Select your name or the service ID. 3. Review the assigned access in the Access policies section. Using CLI: Reviewing S3 ACLs to buckets View the S3 ACLs via API or CLI. A typical API call is shown: curl -X "GET" "https://{endpoint}/{bucket-name}?acl" \ -H "Authorization: Bearer {token}" \

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Granting Access to a COS Bucket using IAM Using Console: To create a new bucket-level policy: 1. Navigate to the Access IAM console from the Manage menu. 2. Select Users from the left navigation menu. 3. Select a user. 4. Select the Access Policies tab to view the user's existing policies, assign a new policy, or edit an existing policy. 5. Click Assign access to create a new policy. 6. Choose Assign access to resources. 7. First, select Cloud Object Storage from the services menu. 8. Then, select the appropriate service instance. Enter bucket in the Resource type field and the bucket name in the Resource ID field. 9. Select the wanted service access role. Selecting the lozenge with the number of actions show the actions available to the role. 10. Click Assign Using CLI: From a terminal run the following command: ibmcloud iam user-policy-create <user-name> \ --roles <role> \ --service-name cloud-object-storage \ --service-instance <resource-instance-id> \ --resource-type bucket \ --resource <bucket-name> To list existing policies: ibmcloud iam user-policies <user-name> To edit an existing policy: ibmcloud iam user-policy-update <user-name> <policy-id> \ --roles <role> \ --servic...

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: access-controlcloudiamibmcloud
Tham chiếu: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.1.4 Ensure Cloud Object Storage bucket access is restricted by using IAM and S3 access control