Control: 2.1.4 Ensure Cloud Object Storage bucket access is restricted by using IAM and S3 access control

Description

Access controls on the Cloud Object Storage buckets are governed via IBM Identity and Access Management (IAM). However, some permissions can also be granted (or restricted) via S3 access controls.

Remediation

From Console

To create a new bucket-level policy:

1. Navigate to the Access IAM console from the Manage menu.
2. Select Users from the left navigation menu.
3. Select a user.
4. Select the Access Policies tab to view the user's existing policies, assign a new policy, or edit an existing policy.
5. Click Assign access to create a new policy.
6. Choose Assign access to resources.
7. First, select Cloud Object Storage from the services menu.
8. Then, select the appropriate service instance. Enter bucket in the Resource type field and the bucket name in the Resource ID field.
9. Select the wanted service access role. Selecting the lozenge with the number of actions show the actions available to the role.
10. Click Assign