Description

Ensure each person who needs access to the OVHcloud account has their own IAM local user (or a federated SSO identity), rather than sharing the main account owner login and password. The owner login should be reserved for tasks that only the owner can do.

Rationale

When several people share the owner login, there is no way to tell who did what, passwords are hard to change, and anyone who leaves the team still knows the credentials. Individual users give each person their own login, allow access to be removed one person at a time, and make every action traceable in the logs.

Impact

  • Every action is linked to a named person

  • Access can be removed for one person without affecting others

  • Each user needs their own permissions through IAM policies

Default Value

By default, an OVHcloud account has only the owner login (the root account, whose rights cannot be restricted) and no local users.

Pre-Requisites

  • Access to the OVHcloud account owner login

  • A list of people who need access

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities, then open the Local users tab.

  4. Review the local users and compare them with the people who use the account.

  5. If people are sharing the owner login, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities, then open the Local users tab.

  4. Click Add user, fill in ID, Email, Password, Group, and Description, and click Confirm.

  5. Grant the user only the permissions they need through IAM policies (see the least-privilege check).

  6. Change the owner password and stop sharing it.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities, then open the Local users tab.

  4. Disable or delete the local user from its ⋯ menu.

Reference