Control: 1.16 Ensure IAM does not allow public access to Cloud Object Storage

Description

IBM Cloud features the capability for users with specific access roles to create access policies that allow all users (authenticated and non-authenticated) to access resources in the account. This “all users” access in turn ends up in public (including non-authenticated) access to resources. Determine if this capability is required by your organization and disable if not required.

Remediation

From Console

To disable the Public Access Group:

1. Log in to IBM Cloud
2. From the Menu bar, click Manage > Access (IAM).
3. Click Settings > Public Access.
4. Disable Public Access to disable the Public Access Group.

To keep the Public Access Group enabled and verify that no access policies for COS exist:

1. Log in to IBM Cloud
2. From the Menu bar, click Manage > Access (IAM).
3. Click Settings.
4. In the public access section of IAM Settings, observe the Public access group setting.
5. If the Public access group setting is disabled, IAM is not providing public access to COS.
6. If the Public access group setting is enabled, proceed to the Access groups page by clicking Access Groups.
7. From the list of Access Groups, select Public Access by clicking on the Access Group name.
8. Ensure that there are no access policies present for COS in the list of access policies.
9. To delete an access policy, click on the action menu icon for the access policy and click Remove.