TMA-IBMCLOUD-1.4
Restrict user API key creation and service ID creation in the account via IAM roles
Açıklama
Use IAM settings to restrict user API key creation and service ID (and related API key) creation in the account. Enable both settings to restrict all users in the account from creating user API keys and service IDs except those with an IAM policy that explicitly allows it. API keys authenticate IBM Cloud identities. Once an API key has been created, an identity can use it to authenticate and perform any action the identity has access to in any account where that identity is valid and has access, even a different account from the one where the API key was created. Service IDs can be granted a subset of access that a user has, and then used to authenticate and perform actions in the account. Service IDs are intended to be used by applications and other programmatic entities, and so they persist in an account even after users who created them or had access to them have been deleted. Crea...
Nasıl denetlenir
Denetim yöntemi: Manuel inceleme
Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.
Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. Click Manage, Access (IAM). 3. Click Settings. 4. In the Account section of the Settings page, ensure that Restrict API key creation and Restrict service ID creation are enabled.
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Using Console: 1. Log in to IBM Cloud at https://cloud.ibm.com. 2. Click Manage, Access (IAM). 3. Click Settings. 4. In the Account section of the Settings page, ensure that Restrict API key creation and Restrict service ID creation are enabled. 5. Once enabled, only users with the correct IAM policies will be able to create user API keys and service IDs.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- cloudcryptoiamibmcloud
- Referans
- CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.4 Restrict user API key creation and service ID creation in the account via IAM roles