Setting and editing network access policies

Understanding network access policies

Two options control network access to Key Protect instances:

• Public and private network access - this is the default
• Private network access only

$ ibmcloud resource service-instance-delete (NAME | ID)

Enabling network access to your Key Protect instance with the console

If you prefer to enable a dual authorization policy on your instance by using a graphical interface, you can use the IBM Cloud console.

After the network access policy is set to private-only the UI cannot be used for any Key Protect actions.

Keys in a private-only instance will not be shown in the UI and any Key Protect actions in the UI will return an unauthorized error (HTTP status code 401).

After creating a Key Protect instance, complete the following steps to create a network access policy:

1. Log in to the IBM Cloud console.

2. Go to Menu > Resource List to view a list of your resources.

3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.

4. Click the Instance policies link on the left side of the page.

   • Find the Network access allowed panel (on the top-right side of the page).

   • Change the policy by selecting either Public and private (default) or Private only from the dropdown.

   • Click Save or Cancel (whichever is appropriate).

Enabling network access to your Key Protect instance with the API

As an admin, enable a network access policy for a Key Protect instance by making a PUT call to the following endpoint. See these API references to set and list instance policies.

https://<region>.kms.cloud.ibm.com/api/v2/instance/policies?policy=allowedNetwork

1. Retrieve your authentication credentials to work with the API.

   To change a network access policy, you must be assigned a Manager access policy for your Key Protect instance. To learn how IAM (identity and access management) roles map to Key Protect service actions, check out Service access roles.

2. Enable a network access policy for your Key Protect instance by running the following curl command.

   $ curl -X PUT \
       "https://<region>.kms.cloud.ibm.com/api/v2/instance/policies?policy=allowedNetwork" \
       -H "accept: application/vnd.ibm.kms.policy+json" \
       -H "authorization: Bearer <IAM_token>" \
       -H "bluemix-instance: <instance_ID>" \
       -H "content-type: application/vnd.ibm.kms.policy+json" \
       -d '{
               "metadata": {
                   "collectionType": "application/vnd.ibm.kms.policy+json",
                   "collectionTotal": 1
               },
               "resources": [
                   {
                       "policy_type": "allowedNetwork",
                       "policy_data": {
                           "enabled": <enabled>,
                           "attributes": {
                               "allowed_network": "<access_type>"
                           }
                       }
                   }
               ]
           }'
   

Replace the variables in the example request according to the following table.

A successful request returns an HTTP 204 No Content response, which indicates that your Key Protect instance now enforces a network access policy. API requests to the service are restricted to the policy you set.

This policy applies to Key Protect instances only. The network access policy does not apply to specific keys.

Optional: Verify that the network access policy was created by browsing the policies that are available for your Key Protect instance.

$ curl -X GET \
    "https://<region>.kms.cloud.ibm.com/api/v2/instance/policies?policy=allowedNetwork" \
    -H "accept: application/vnd.ibm.kms.policy+json" \
    -H "authorization: Bearer <IAM_token>" \
    -H "bluemix-instance: <instance_ID>"

Disabling network access to your Key Protect instance with the console

If you prefer to disable a network access policy on your instance by using a graphical interface, you can use the IBM Cloud console.

After creating a network access policy, complete the following steps to disable a network access policy:

1. Log in to the IBM Cloud console.

2. Go to Menu > Resource List to view a list of your resources.

3. From your IBM Cloud resource list, select your provisioned instance of Key Protect.

4. On the Instance policies page, use the Policies table to browse the policies in your Key Protect instance.

5. Click the ⋯ icon to open a list of options for the policy that you want to disable.

6. From the options menu, click Disable policy and confirm the policy was disabled in the updated Policies table.