Protecting Security and Compliance Center resources with context-based restrictions

Creating network zones in the console

To create network zones in the UI, complete the following steps.

1. Determine the resources that you want add to your allowlist.
2. Follow the steps to create network zones in the console. Add the Security and Compliance Center service to your network zones to allow Security and Compliance Center to access services and resources that are in your account.

Creating network zones by using the API

You can create network zones by using the create-zone command. For more information, see the API docs. You can add Security and Compliance Center to network zones as a service reference to allow Security and Compliance Center to access resources and services in your account that are the subject of a rule.

The serviceRef attribute for Security and Compliance Center is compliance.

Example payload to add Security and Compliance Center to a network zone.

{
  "name": "Example zone 1",
  "description": "",
  "addresses": [
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "compliance",
        "account_id": "ACCOUNT-ID"
      }
  ]
}

Example payload to add multiple services, IP addresses, and VPCs to a network zone.

{
  {
  "name": "zone",
  "description": "",
  "addresses": [
    {
      "type": "ipAddress",
      "value": "192.168.0.0"
    },
    {
      "type": "vpc",
      "value": "crn:v1:bluemix:public:is:us-east:a/CRN"
    },
    {
      "type": "vpc",
      "value": "crn:v1:bluemix:public:is:us-south:a/CRN"
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "cloud-object-storage",
        "account_id": "ACCOUNT-ID"
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "codeengine",
        "account_id": "ACCOUNT-ID"
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "containers-kubernetes",
        "account_id": "ACCOUNT-ID"
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_type": "platform_service",
        "account_id": "ACCOUNT-ID"
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "iam-groups",
        "account_id": "ACCOUNT-ID"
      }
    ],
    "excluded": []
  }
}

Creating network zones by using the CLI

You can use the cbr-zone-create command to add network locations, VPCs, and service references to network zones. For more information, see the CBR CLI reference. Add Security and Compliance Center to network zones as a service reference to allow Security and Compliance Center to access resources and services in your account that are the subject of a rule.

To find a list of available service refs, run the ibmcloud cbr service-ref-targets command. The service_name for SCC is compliance.

Example command to add the compliance service to a network zone.

ibmcloud cbr zone-create --name example-zone-1 --description "Example zone 1" --service-ref service_name=compliance

Example command to add a single IP address to a network zone.

ibmcloud cbr zone-create --addresses 129.41.86.7 --description "Allow only client IP" --name allow-client-ip

Creating rules in the console

Complete the following steps to create rules for Security and Compliance Center.

1. Review the network zones that you created for your account.
2. Follow the steps to create rules in the console.

Creating rules by using the API

Review the following example to learn how to create rules for Security and Compliance Center by using the API. For more information, see the API docs.

This payload creates a rule that targets the Security and Compliance Center service and allows only private endpoints from the specified network zone to access the service.

{
  "description": "Example rule 1",
  "resources": [
    {
      "attributes": [
        {
          "name": "accountId",
          "value": "ACCOUNT-ID"
        },
        {
          "name": "serviceName",
          "value": "compliance"
        }
      ]
    }
  ],
  "contexts": [
    {
      "attributes": [
        {
          "name": "networkZoneId",
          "value": "NETWORK-ZONE-ID"
        },
        {
          "name": "endpointType",
          "value": "private"
        }
      ]
    }
  ]
}

Creating rules by using the CLI

Review the following example to learn how to create rules for Security and Compliance Center by using the CLI. For more information, see the CBR CLI reference.

This command creates a rule that targets the Security and Compliance Center service and allows only private endpoints from the specified network zone to access the service.

ibmcloud cbr rule-create --description 'Example Rule Description' --service-name compliance --context-attributes endpointType=private --zone-id ZONE_ID --enforcement-mode report

For the enforcement-mode option, the CLI accepts the values enabled, disabled, and report. If no enforcement is specified, the rule is enabled by default.