Ensure a snapshot offload target using HTTPS is configured when no array connection is available

低级别 2人工审核flasharray

说明

FlashArray allows for connections to be created between a FlashArray and a generic offload target. Offload targets allow snapshots to be stored externally to the array, with storage and transmission of proprietary-format snapshots via standardized 3rd party protocols. Offload targets can either utilize the S3 data format, such as Amazon AWS, or the Azure blob format. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

From the CLI: ; Run the command pureoffload list to display all connected offload targets and their general statuses. ; Run pureoffload s3 list or pureoffload azure list to display detailed connection settings. ; Review the output to ensure the connection exists and that any defined URI uses the https:// protocol rather than http://.

修复方式

修复方法: 操作指南或基础设施补丁

To align with the security recommendations, establish an offload target to act as a secondary backup repository and ensure secure transmission by enforcing HTTPS for any custom endpoints. From the GUI: ; Navigate to Protection > Array. ; In the Offload Targets panel, click the + (connect) icon. ; In the Connect Offload Target window, select the Protocol (s3 or azure). ; For Azure Blob: Type a target Name, the Microsoft Azure Account name, the Container name, and the Secret Access Key. ; For S3: Type a target Name, the AWS Access Key ID, the Bucket name, and the Secret Access Key. ; If a custom endpoint/URI is required, ensure it begins with https://.

属性

操作系统: 任意
标签: flasharraystoragedata-protection
参考: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 4.6 Ensure a snapshot offload target using HTTPS is configured when no array connection is available