Control: 1.18 Enable audit logging for IBM Cloud Identity and Access Management
Description
Use the IBM Cloud Activity Tracker with LogDNA service to monitor certain IAM events.
Remediation
You must create an instance of the IBM Cloud Activity Tracker with LogDNA service in the Frankfurt region to start tracking IAM events. Use a minimum of a 7-day event search.
From Console
- Log in to IBM Cloud
- Go to the Menu icon. Then, select Observability to access the Observability dashboard.
- Select Activity Tracker from the page navigation menu
- Click Create instance to create an instance of IBM Cloud Activity Tracker with LogDNA.
- In the Select a region drop down, choose Frankfurt
- Select a pricing plan, service name, resource group, and provide optional tags. Choose a plan that offers a minimum of 7-day event search.
- Click Create.
By default, audit logging with Activity Tracker with LogDNA is not enabled.
Usage
Run the control in your terminal:
powerpipe control run ibm_compliance.control.cis_v100_1_18Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run ibm_compliance.control.cis_v100_1_18 --shareSQL
This control uses a named query:
manual_control