TMA-OCI-1.8
Ensure user API keys rotate within 90 days
Mô tả
API keys are used by administrators, developers, services and scripts for accessing OCI APIs directly or via SDKs/OCI CLI to search, create, update or delete OCI resources. The API key is an RSA key pair. It is important to secure and rotate an API key every 90 days or less as it provides the same level of access that a user it is associated with has. No ACTIVE user may hold a API key created more than 90 days ago (users of the Default identity domain, as listed by oci iam user list). Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cutoff=$(date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%S 2>/dev/null || date -u -v-90d +%Y-%m-%dT%H:%M:%S 2>/dev/null) || exit 1
us=$(oci iam user list --compartment-id "$t" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
for u in $(printf '%s\n' "$us" | grep -o 'ocid1\.user\.[^"]*'); do
ks=$(oci iam user api-key list --user-id "$u" --query 'data[?"lifecycle-state"==`"ACTIVE"`]."time-created"' --raw-output 2>/dev/null) || exit 1
old=$(printf '%s\n' "$ks" | grep -o '"[0-9][^"]*"' | tr -d '"' | awk -v c="$cutoff" '$1 < c')
[ -z "$old" ] || { echo "API key older than 90 days: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Upload a new API key for each listed user (oci iam user api-key upload), move clients to it, then oci iam user api-key delete --user-id <ocid> --fingerprint <old>.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- ociiam
- Tham chiếu
- CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.8 Ensure user API keys rotate within 90 days
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target oci