Description

Ensure each IAM local user and user group is granted, through IAM policies, only the actions and resources needed for their job. Users should not be placed in the ADMIN group or given broad policies unless they truly need full control of the account.

Rationale

Users with more access than they need increase the damage an attacker can do with a stolen login, and make mistakes more likely to affect production. Granting only the needed permissions limits the impact of a compromised account and supports separation of duties.

Impact

  • Limits damage from a compromised user

  • Reduces the risk of accidental changes

  • Users may need policy updates when their tasks change

Default Value

Each local user is placed in a group when created: UNPRIVILEGED (read-only), DEFAULT (Restricted Admin: write access except user management), or ADMIN (full access, including user management and billing details).

Pre-Requisites

  • Access to the OVHcloud account owner login or an IAM administrator

  • A list of the tasks each user performs

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities, then open the Local users tab.

  4. Review the group of each local user, and flag users in the ADMIN group who do not need full access.

  5. Then, under Identity and Access Management, select Policies. Review the policies that include each user or group.

  6. If users have more access than they need, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Identities, then open the Local users tab.

  4. Open the ⋯ menu for each user who does not need full access and edit the user to change its Group from ADMIN to UNPRIVILEGED or DEFAULT.

  5. Under Identity and Access Management, select Policies.

  6. Click Create a policy, add the user or group under Identities, select the product types and resources, choose only the actions they need, and create the policy.

  7. Remove or narrow any broader policies that apply to the user.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Open the ⋯ menu next to the policy, select Modify policy, restore the previous settings, and save. Restore the user's previous group from the Local users tab if it was changed.

Reference