Ensure network access for Cloud Object Storage is set to be exposed only on Private end-points

中等級 1人工審核ibmcloud

說明

IBM Cloud Object Storage bucket context-based restrictions allows administrators to restricts all access to data unless the request originates from a list of allowed IP addresses that are part of the private subnets only. Restrict access to data stored in Cloud Object Storage buckets and enhance security controls by creating a context-based restriction rule that will only allow data access to the list of IP addresses that are part of your private subnet.

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

To check or confirm that an IBM Cloud Object Storage bucket is accessible only from a list of authorized IP addresses from private subnets, you can navigate to Access policies section available under your bucket information and check Authorized IPs list. Using Console: 1. Go to IBM Cloud Console: https://cloud.ibm.com/resources 2. Under Storage click on the Cloud Object Storage instance you want to check. (you will be directed to a default bucket listing page) 3. Click on the Cloud Object Storage bucket for which you want to review the bucket policy/context-based restriction information 4. At the bucket information screen, click on the Permissions section on the right navigation in the bucket description. 5. Within Bucket access policies one can view the tab Context-based restrictions 6. Review the list of rules to ensure one includes the IPs/subnets you want authorized, for example, 10.0.0.0/8 would authorize all the private IP addresses that are part of the IBM Cloud Infrastructure to access the bucket.

修補方式

修補方法: 操作指南或基礎設施修補檔

Follow the steps outlined to add an IP/subnet to the list of Authorized IPs in bucket context-based restriction policies. Using Console: From the IBM Cloud console dashboard, you can restrict access to your content by setting a Context-based Restriction. Set a list of authorized IP addresses 1. Start by selecting Storage to view your resource list. 2. Next, select the service instance with the target bucket from within the Storage menu. The Object Storage Console will be displayed. 3. Select the bucket to navigate to the bucket details interface. 4. Select Permissions from the navigation menu. 5. Select the Context-based restrictions tab. 6. Click on Create rule and follow the instructions here: https://cloud.ibm.com/docs/account?topic=account-context-restrictions- create&interface=ui Note that all objects in this bucket are only accessible from those IP addresses.

屬性

作業系統: 不限
標籤: access-controlcloudibmcloudnetwork
參考資料: CIS IBM Cloud Foundations Benchmark v2.0.0 - 2.1.3 Ensure network access for Cloud Object Storage is set to be exposed only on Private end-points