Ensure user customer secret keys rotate every 90 days

CaoCấp 1Tự độngoci

Mô tả

Object Storage provides an API to enable interoperability with Amazon S3. To use this Amazon S3 Compatibility API, you need to generate the signing key required to authenticate with Amazon S3. This special signing key is an Access Key/Secret Key pair. It is important to rotate customer secret keys at least every 90 days, as they provide the same level of object storage access that the user they are associated with has. No ACTIVE user may hold a customer secret key created more than 90 days ago (users of the Default identity domain, as listed by oci iam user list). Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cutoff=$(date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%S 2>/dev/null || date -u -v-90d +%Y-%m-%dT%H:%M:%S 2>/dev/null) || exit 1
us=$(oci iam user list --compartment-id "$t" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
for u in $(printf '%s\n' "$us" | grep -o 'ocid1\.user\.[^"]*'); do
  ks=$(oci iam customer-secret-key list --user-id "$u" --query 'data[?"lifecycle-state"==`"ACTIVE"`]."time-created"' --raw-output 2>/dev/null) || exit 1
  old=$(printf '%s\n' "$ks" | grep -o '"[0-9][^"]*"' | tr -d '"' | awk -v c="$cutoff" '$1 < c')
  [ -z "$old" ] || { echo "customer secret key older than 90 days: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Create a new customer secret key (oci iam customer-secret-key create), update S3-compatible clients, then delete the old key.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: ociiam
Tham chiếu: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.9 Ensure user customer secret keys rotate every 90 days

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target oci