Ensure OAuth API clients use least-privilege access policies and access-token TTLs of 60 minutes or less

中等級 1人工審核flasharray

說明

FlashArray supports configuring one or more identity providers for API Clients. These IDPs can then issue identity tokens to any user on the array that can be exchanged with the array for API access using the OAuth2 standard. Manual review in the Purity//FA GUI or CLI (organization-specific or per-object evidence).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

From the CLI: ; Run the command pureapiclient list to display all configured API clients. ; Review the output to verify the Access Policy, Enabled status, and token TTL for each client. ; Verify no API clients are enabled that are no longer actively in use.

修補方式

修補方法: 操作指南或基礎設施修補檔

To align with the security recommendations, delete or disable inactive API clients, and ensure all active clients are bound to restrictive access policies with short-lived tokens. (Note: Modifying or deleting an active API client will immediately invalidate its issued tokens, so changes should be coordinated with the teams responsible for those integrations). From the GUI: ; Navigate to Settings > Access > Users and Policies. ; In the API Clients panel, select any unused clients and click the trash icon to delete them. ; For active clients, click the edit icon to reduce the assigned access policy or shorten the token TTL as appropriate.

屬性

作業系統: 不限
標籤: flasharraystorageaccess-control
參考資料: CIS Everpure FlashArray Purity 6.9.x Benchmark v1.0.0 - 1.8 Ensure OAuth API clients use least-privilege access policies and access-token TTLs of 60 minutes or less