Ensure Key Protect root keys have a rotation policy

中等級 1自動化ibmcloud

說明

Rotation policies regularly re-wrap data encryption keys with new root key material. Every root (non-extractable) key in every Key Protect instance must have a rotation policy with interval_month (requires the kp plugin; keys are queried in the targeted region). Read-only ibmcloud CLI calls using the current CLI session and targeted region (ibmcloud login, or IBMCLOUD_API_KEY); JSON output is parsed with grep/sed/awk. A missing CLI, plugin or session fails the check.

檢查方式

稽核方法: Shell 指令

shell

inst=$(ibmcloud resource service-instances --service-name kms --output json 2>/dev/null) || exit 1
bad=0
for g in $(printf '%s\n' "$inst" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 1 && /"guid"[[:space:]]*:/ { s = $0; sub(/^[^:]*:[[:space:]]*"/, "", s); sub(/".*/, "", s); print s } { d += o - c }'); do
  ks=$(ibmcloud kp keys -i "$g" --output json 2>/dev/null) || exit 1
  ids=$(printf '%s\n' "$ks" | awk '{ o = gsub(/\{/, "{"); c = gsub(/\}/, "}") } d == 0 && o > 0 { id = ""; ex = "" } d == 1 && /"id"[[:space:]]*:/ { id = $0; sub(/^[^:]*:[[:space:]]*"/, "", id); sub(/".*/, "", id) } d == 1 && /"extractable"[[:space:]]*:/ { ex = $0 } { d += o - c } d == 0 && c > 0 && ex ~ /false/ { print id }')
  for k in $ids; do
    p=$(ibmcloud kp key policies "$k" -i "$g" --output json 2>/dev/null) || exit 1
    printf '%s\n' "$p" | grep -q '"interval_month"' || { echo "no rotation policy: $g $k"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

ibmcloud kp key policy-update rotation <key-id> -i <instance-id> --monthly-interval 12 (or shorter); alternatively set an instance-level rotation policy (ibmcloud kp instance policy-update rotation).

屬性

作業系統: 不限
標籤: ibmcloudkms
參考資料: CIS IBM Cloud Foundations Benchmark v2.0.0 - Storage - Key Protect root key rotation (verify section number for your release)

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target ibmcloud