Managing security and compliance with IBM Cloud Object Storage

Monitoring security and compliance posture with Object Storage

As a security or compliance focal, you can use the Object Storage goals to help ensure that your organization is adhering to the external and internal standards for your industry. By using the Security and Compliance Center to validate the resource configurations in your account against a profileA specification of a resource's capacities and capabilities. Different profiles are optimized for different workloads and use cases. A resource's pricing model might depend on its profile., you can identify potential issues as they arise or even prevent actions that would create a violation of your security policy.

All of the goals for Object Storage are added to the IBM Cloud Control Library but can also be mapped to other profiles.

To start monitoring your resources, check out Getting started for Security and Compliance Center.

Governing Object Storage resource configuration

As a security or compliance focal, you can use the Security and Compliance Center to define configuration rules for the instances of Object Storage that you create.

Create rules to ensure that Cloud Object Storage buckets:

• are only created in designated locations
• are only created in a certain storage class
• are created with a designated managed encryption root key CRN
• are prevented from setting public ACLs
• are accessible by using private or direct endpoints only
• are only accessible from designated IP addresses
• can not be accessed from designated IP addresses
• use a designated instance of Activity Tracker
• send object read and/or write events to Activity Tracker
• don't grow past a defined maximum size

Configuration rulesA JSON document that defines the configuration of resources and validates the compliance based on security requirements when a resource is created or modified. are used to monitor configuration standards that you want to implement across your accounts. For more information about configuration rules, see What makes up a rule.

Although the operator types may indicate the values are numeric or boolean, all of the values in the rule are entered as strings or lists of strings, such as 'true' or '324342'. Additionally, even though an operator type might indicate a string, it is still possible to set an array of possible strings that comply with the rule. For more information, see What are the supported operators?

To learn more about configuration rules and how they are evaluated, check out What is a configuration rule?.

After rules are created and added to scopes, you can view the evaluation results in the Security and Compliance Center. Each rule is shown to be compliant or noncompliant - if a rule shows as being noncompliant then you can view the specific bucket that is in violation of the rule.

The evaluation results are only available for a limited period. It is recommended that reports are downloaded and organized to maintain a history of compliance for audit purposes. For more information on reporting results, see Viewing evaluation results.

For example, let's assume you want to evaluate a set of requirements on new buckets:

1. Only buckets in the us-south region are subject to the rule (other locations aren't subject to the rule).
2. Buckets must use the Smart Tier storage class.
3. Buckets must use Key Protect for managing encryption.
4. Public ACLs will be ignored (not blocked).
5. A firewall must be in place to only allow requests from inside the IBM Cloud.
6. Only the IP addresses in the range fe80:021b::0/64 will be allowed to make requests.
7. Activity tracking must be enabled for both read and write requests.
8. IBM Cloud Monitoring must be enabled for both usage and requests.
9. The bucket cannot be allowed to grow past 10 TiB (10995116277760 bytes).

For step-by-step instructions using the UI and API, see Working with config rules.

The rule would look like the following:

{
 "target": {
   "service_name": "cloud-object-storage",
   "resource_kind": "bucket",
   "additional_target_attributes": [
     {
       "name": "location",
       "operator": "string_equals",
       "value": "us-south"
     }
   ]
 },
 "required_config": {
   "description": "us south restrictions",
   "and": [
     {
       "property": "storage_class",
       "operator": "string_equals",
       "value": [
         "smart"
       ]
     },
     {
       "property": "ibm_sse_kms_customer_root_key_crn",
       "operator": "string_equals",
       "value": [
         "crn:v1:bluemix:public:kms:us-south:a/3bf0d9003abfb5d29761c4e97696b71c:xxxxxxx-07ba-4eb4-877b-e5b0c4966051:key:7f5f825a-0463-4cf4-9042-44366a7298f6"    
       ]
     },
     {
       "property": "firewall.allowed_network_type",
       "operator": "strings_in_list",
       "value": [
         "private"
       ]
     },
     {
       "property": "firewall.allowed_ip",
       "operator": "ips_in_range",
       "value": [
         "fe80:021b::0/64"
       ]
     },
      {
        "property": "activity_tracking.activity_tracker_crn",
        "operator": "string_equals",
        "value": "crn:v1:bluemix:public:logdnaat:us-south:a/91631433ee674cd9ab0ef150b8e7030f:xxxxxxx-830b-43f1-b517-0be1bc50108f::"
      },
      {
        "property": "activity_tracking.write_data_events",
        "operator": "is_true"
      },
      {
        "property": "activity_tracking.read_data_events",
        "operator": "is_true"
      },
      {
        "property": "metrics_monitoring.metrics_monitoring_crn",
        "operator": "string_equals",
        "value": "crn:v1:bluemix:public:sysdig-monitor:us-south:a/9xxxxxxxxxb1xxxc7fdxxxxxxxxxx5:7xxxxxxxx0-xx7x-xdx8-9fxx-123456789012::"
      },
      {
        "property": "metrics_monitoring.usage_metrics_enabled",
        "operator": "is_true"
      },
      {
        "property": "metrics_monitoring.request_metrics_enabled",
        "operator": "is_true"
      },
     {
       "property": "hard_quota",
       "operator": "num_equals",
       "value": "10995116277760"
     }
   ]
 }
}