Control: 6.1.3 Ensure DDoS protection is Active on IBM Cloud Internet Services
Description
VPC access control lists filter all incoming and outgoing traffic in IBM Cloud VPC. An ACL is a built-in, virtual firewall where ACL rules control traffic to and from the subnets, rather than to and from the virtual servers. It is recommended that no ACL allows unrestricted ingress access to port 22.
Remediation
From Console
- Login to the IBM Cloud Portal.
- At the Menu icon, select VPC Infrastructure-->Access Control Lists.
- For each security group, perform the following: a. Select the access control list name. b. Identify the Inbound rule to be removed. c. Using the Options icon, select Delete.
Usage
Run the control in your terminal:
powerpipe control run ibm_compliance.control.cis_v100_6_1_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run ibm_compliance.control.cis_v100_6_1_3 --shareSQL
This control uses a named query:
with proxy_enabled as( select rule ->> 'proxied' as proxy, name, id from ibm_cis_domain, jsonb_array_elements(global_load_balancer) as rule where rule ->> 'proxied' = 'true')select p.id as resource, case when p.id is null then 'alarm' else 'ok' end as status, case when p.id is null then p.name || ' DDoS protection is inactive on Cloud Internet Services.' else p.name || ' DDoS protection is active on Cloud Internet Services.' end as reason, acc.guid as account_idfrom proxy_enabled as p, ibm_account as acc;