IBM Cloud Service ID creation is not restricted in account settings in Terraform misconfiguration de

Rule Details

Cortex AppSec Rule ID	APPSEC2_IBM_5
Category - Subcategory	IAM - Overly Permissive
Provider	IBM
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule detects whether Service ID creation is unrestricted in account settings. Service IDs are used to identify and authenticate services or applications, allowing them to interact with other services or resources. Unrestricted creation can increase the risk of unauthorized access and mismanagement of service identities. By restricting creation, you can enhance account security and mitigate potential breaches or misconfigurations.

How to Fix

Resource: ibm_iam_account_settings

• Arguments: restrict_create_service_id

Ensure that only authorized users or services can create new service IDs by setting the restrict_create_service_id attribute to RESTRICTED in the IBM IAM account settings.

In this example, the restrict_create_service_id attribute is set to RESTRICTED in the ibm_iam_account_settings resource to restrict the creation of service IDs. [source,go]

resource "ibm_iam_account_settings" "example" { ...

• restrict_create_service_id = "RESTRICTED" }

---