Ensure Access to KMS Configuration Interfaces Is Restricted

高等級 1人工審核tdsql

說明

The KMS configuration interfaces (TDSQL.GetKmsConfig, TDSQL.CreateKmsConfig) involve master key (CMK) management; abuse can defeat the entire cluster's encryption. OSS should: Include the KMS interfaces in interface_mask so only privileged users can invoke them. Mask the keyring_kms_config field in return values in the audit log (see property_mask in oss.json:230-237).

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

# 1. Confirm the KMS interfaces are included in the mask grep 'TDSQL.GetKmsConfig\|TDSQL.CreateKmsConfig' /path/to/tdsql/conf/oss.json # 2. Confirm the KMS configuration field is included in response masking grep 'keyring_kms_config' /path/to/tdsql/conf/oss.json # 3. Verify KMS service health (via the OSS KMS status query interface)

修補方式

修補方法: 操作指南或基礎設施修補檔

{ "name": "interface_mask", "value": "...,TDSQL.GetKmsConfig,TDSQL.CreateKmsConfig" }, { "name": "property_mask", "value": "pwd,password,secretid,secretkey,token,secret_id,secret_key,ca_cert,server_cert,se rver_key,client_cert,client_key,keyring_kms_config" }

屬性

作業系統: 不限
標籤: tdsqlencryptionoss
參考資料: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 12.9 Ensure Access to KMS Configuration Interfaces Is Restricted