Protecting the Tagging service with context-based restrictions

Use context-based restrictions to control which networks can access the Tagging service, adding a layer of protection alongside your IAM policies.

Audit log events are generated by the context-based restrictions service, not the Tagging service. For more information, see Monitoring context-based restrictions.

Before you begin

Review the following access requirements:

  • A user must have the Administrator role on the Global Tagging service to create, update, or delete rules.
  • A user must have either the Editor or Administrator role on the context-based restrictions service to create, update, or delete network zones.
  • A user with the Viewer role on the context-based restrictions service can add only network zones to a rule.

To protect your resources with context-based restrictions, see the tutorial for Leveraging context-based restrictions to secure your resources.

How the Tagging service integrates with context-based restrictions

The Tagging service exposes two distinct protected surfaces:

ghost-tags (access tag create and delete)
Protects the creation and deletion of access tags in your account. Rules target the ghost-tags service using the default API type crn:v1:bluemix:public:context-based-restrictions::::api-type:.

global-search-tagging (tag attach and detach)
Protects attaching and detaching tags on resources. Rules target the global-search-tagging service using the resource-management platform API type crn:v1:bluemix:public:context-based-restrictions::::platform-api-type:resource-management. Resource search (global-search-tagging.resource.read) is not subject to context-based restrictions and always works regardless of the calling zone.

Limitations

Context-based restrictions protect only the actions associated with the access management tag create/delete API (ghost-tags) and the tag attach/detach platform API type (global-search-tagging). Resource search (global-search-tagging.resource.read) is not protected and works from any network context.

Creating network zones

A network zone represents an allowlist of IP addresses where an access request is created. It defines a set of one or more network locations specified by the following attributes:

  • IP addresses, which include individual addresses, ranges, or subnets
  • VPCs
  • Endpoint types (public or private)

Creating a network zone by using the console

To create a context-based restriction rule for the Tagging service, first create a network zone to define the allowed network locations:

  1. In the IBM Cloud console, click Manage > context-based restrictions, and select Network zones.
  2. Click Create.
  3. Enter a unique name and a description.
  4. Enter the allowed IP addresses, ranges, or subnets, or select a VPC to add to the zone.
  5. Click Next to review your network zone.
  6. Click Create.

Creating a network zone by using the CLI

To create a context-based restriction rule for the Tagging service, first create a network zone to define the allowed network locations.

Install the context-based restrictions CLI plug-in by running the following command:

ibmcloud plugin install cbr

To create a network zone with allowed IP addresses, use the cbr zone-create command:

ibmcloud cbr zone-create --name "tagging-allowed-zone" \
  --description "Allowed network for tagging operations" \
  --addresses "203.0.113.0/24"

To create a network zone scoped to a specific VPC, use the --vpc flag with the VPC CRN:

ibmcloud cbr zone-create --name "tagging-vpc-zone" \
  --description "Allowed VPC for tagging operations" \
  --vpc "<vpc-crn>"

Creating rules

Restrict access tag create and delete by IP address

To allow access tag create and delete operations only from specific IP addresses (for example, a VPN subnet), create a network zone and rule for those addresses. Requests from outside the zone are denied with an HTTP 401 error.

By using the console

Complete the following steps to restrict access tag create and delete operations by IP address by using the console:

  1. In the IBM Cloud console, click Manage > context-based restrictions, and select Rules.
  2. Click Create.
  3. Select Global Tagging as the service.
  4. Select the network zone you created and click Add.
  5. Click Continue, provide a description, select an enforcement mode, and click Create.

By using the CLI

Complete the following steps to restrict access tag create and delete operations by IP address by using the CLI:

ZONE_ID=$(ibmcloud cbr zones --output json | jq -r '.zones[] | select(.name=="tagging-allowed-zone") | .id')

ibmcloud cbr rule-create \
  --description "Access tagging from allowed zone only" \
  --service-name ghost-tags \
  --api-types "crn:v1:bluemix:public:context-based-restrictions::::api-type:" \
  --zone-id "$ZONE_ID" \
  --enforcement-mode report

Restrict access tag create and delete by endpoint type

To allow access tag create and delete operations only over the private endpoint, create a network zone and rule that restricts access to private endpoints. Public endpoint requests are denied.

By using the console

Complete the following steps to restrict access tag create and delete operations to the private endpoint by using the console:

  1. In the IBM Cloud console, click Manage > context-based restrictions, and select Rules.
  2. Click Create.
  3. Select Global Tagging as the service.
  4. Select Private as the endpoint type and click Add.
  5. Click Continue, provide a description, select an enforcement mode, and click Create.

By using the CLI

Complete the following steps to restrict access tag create and delete operations to the private endpoint by using the CLI:

ibmcloud cbr rule-create \
  --description "Access tagging on private endpoint only" \
  --service-name ghost-tags \
  --api-types "crn:v1:bluemix:public:context-based-restrictions::::api-type:" \
  --context-attributes endpointType=private \
  --enforcement-mode report

When the rule is enforced, use the GST_TAGS_ENDPOINT environment variable to target the private endpoint with the ibmcloud resource command:

GST_TAGS_ENDPOINT=https://tags.private.global-search-tagging.cloud.ibm.com \
  ibmcloud resource tag-create --tag-names "my-tag:value"

Restrict access tag create and delete by specific VPC and private endpoint

To allow access tag create and delete operations only from a specific VPC over the private endpoint, create a network zone and rule for that VPC. Requests from a different VPC or the public endpoint are denied.

By using the console

Complete the following steps to restrict access tag create and delete operations to a specific VPC and private endpoint by using the console:

  1. In the IBM Cloud console, click Manage > context-based restrictions, and select Rules.
  2. Click Create.
  3. Select Global Tagging as the service.
  4. Select Private as the endpoint type and click Add.
  5. Select the zone you created at Creating network zones and click Add.
  6. Click Continue, provide a description, select an enforcement mode, and click Create.

By using the CLI

Complete the following steps to restrict access tag create and delete operations to a specific VPC and private endpoint by using the CLI:

ZONE_ID=$(ibmcloud cbr zones --output json | jq -r '.zones[] | select(.name=="tagging-vpc-zone") | .id')

ibmcloud cbr rule-create \
  --description "Access tagging from allowed VPC on private endpoint" \
  --service-name ghost-tags \
  --api-types "crn:v1:bluemix:public:context-based-restrictions::::api-type:" \
  --context-attributes endpointType=private \
  --zone-id "$ZONE_ID" \
  --enforcement-mode report

Restrict tag attach and detach via a resource's service

Tag attach and detach operations on a resource are routed through the global-search-tagging service using the resource-management platform API type. To protect these operations, create a rule on the target resource's service (for example, Key Protect), not on global-search-tagging directly. Resource search (ibmcloud resource search) is not subject to these rules and continues to work from any zone.

By using the console

Complete the following steps to restrict tag attach and detach operations on a resource by using the console:

  1. In the IBM Cloud console, click Manage > context-based restrictions, and select Rules.
  2. Click Create.
  3. Select Key Protect as the service.
  4. Select APIs > Platform APIs > Resource Management.
  5. Select the zone you created at Creating network zones and click Add.
  6. Click Continue, provide a description, select an enforcement mode, and click Create.

By using the CLI

Complete the following steps to restrict tag attach and detach operations on a resource by using the CLI:

ZONE_ID=$(ibmcloud cbr zones --output json | jq -r '.zones[] | select(.name=="tagging-allowed-zone") | .id')

ibmcloud cbr rule-create \
  --description "Tag attach/detach on KMS from allowed zone only" \
  --service-name kms \
  --api-types "crn:v1:bluemix:public:context-based-restrictions::::platform-api-type:resource-management" \
  --zone-id "$ZONE_ID" \
  --enforcement-mode report

Observability

context-based restrictions enforcement events are visible in IBM Cloud Logs. Use the correlationId field from a tagging event to find the corresponding context-based-restrictions.policy.eval record:

  • Denied (enforced rule): action:context-based-restrictions.policy.eval responseData.isEnforced:==true responseData.decision:Deny
  • Monitored (report-only rule): action:context-based-restrictions.policy.eval responseData.isEnforced:==false responseData.decision:Deny

Start with --enforcement-mode report and monitor for 30 days before switching to enabled. For more information, see Monitoring context-based restrictions.