Description

Ensure OVHcloud API credentials are granted only the HTTP methods and API paths their tool needs, for example GET /cloud/project/*, rather than full wildcard rules such as GET /*, POST /*, PUT /*, and DELETE /* that allow every action on every service.

Rationale

A credential with wildcard rights can read and change every service in the account, including billing, DNS, and IAM. If it leaks, the attacker gains the same full control. Limiting each credential to the paths and methods it needs means a leaked key can only affect a small part of the account.

Impact

  • Limits what a leaked credential can do

  • Enforces least privilege for automation

  • Tools may need new credentials with more specific rights

Default Value

When creating API keys, the Rights are chosen freely, and full wildcard rights can be granted.

Pre-Requisites

  • Access to the OVHcloud account

  • A list of the API paths each tool needs

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. Alternatively, use the OVHcloud API console at https://eu.api.ovh.com/console/ (or your region's console). Run GET /me/api/credential/{credentialId} for each credential and review its rules.

  5. Flag any credential whose rules include a full wildcard path such as /*.

  6. If any are found, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. Select Create API key and, under Rights, add only the methods and paths the tool needs, for example GET /cloud/project/*.

  5. Update the tool to use the new credential.

  6. Delete the wildcard credential.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. Create a new API key with the previous rights and update the tool if the new rights are not enough.

Reference