1

In doing some testing of the IBM Cloud Security and Compliance items, specifically the CIS Benchmarks for Best Practices, one item I was non-compliant on was in Cloud Key protect for the Goal "Check whether Key Protect is accessible only by using private endpoints"

My Key-protect instance was indeed set to "Public and Private" so I changed it to Private. This change now requires me to manage my Key-Protect instance from the CLI.

When I try to even look at my Key-Protect instance policy from the CLI I receive the following error:

ibmcloud kp instance -i my_instance_id policies Retrieving policy details for instance: my_instance_id... Error while getting instance policy: kp.Error: correlation_id='cc54f61d-4424-4c72-91aa-d2f6bc20be68', msg='Unauthorized: The user does not have access to the specified resource' FAILED Unauthorized: The user does not have access to the specified resource Correlation-ID:cc54f61d-4424-4c72-91aa-d2f6bc20be68

I'm confused - I am running the CLI logged, in as the tenant admin with Access policy of All resources in account (including future IAM enabled services)

What am I doing wrong here?

Griffter
  • 33
  • 4

1 Answers1

2

Private endpoints are only accessible from within IBM Cloud. If you connect from the public internet, access should be blocked.

There are multiple ways, how to work with such a policy in place. One is to deploy (a VPC with) a virtual machine on a private network. Then, connect to it with a VPN or Direct Link. Thus, your resources are not accessible from the public internet, but only through private connectivity. You could continue to use the IBM Cloud CLI, but set it to use private endpoints.

data_henrik
  • 16,724
  • 2
  • 28
  • 49
  • Ok, I understand the premise of "accessible only from a private connection"; I guess I assumed that when using the CLI from within the IBM Cloud portal, that would constitute a "private" connection. I'll report back after trying the access from one of my VSIs in the VPC. Thanks! – Griffter Nov 08 '21 at 09:44
  • 2
    Thanks data_henrik - once I shifted from running the cloud CLI from within the portal and used the CLI from one of my VSIs, I was able to target the private address of Key-Protect and manage my instance. – Griffter Nov 08 '21 at 10:05