Description

Ensure IAM policies do not grant wildcard actions, such as all actions on a product type or all actions on all resources, unless this is clearly required. Policies should list the specific actions, or the OVHcloud-managed permission groups, that each identity needs.

Rationale

A wildcard action gives every current and future permission for the resources in the policy, including destructive and administrative actions. If an identity covered by that policy is compromised, the attacker gains the same broad control. Listing specific actions keeps permissions predictable and limited.

Impact

  • Permissions stay limited to what is needed

  • New actions added by OVHcloud are not granted automatically

  • Policies may need updates when new tasks are required

Default Value

By default, no IAM policies exist. When you create one, you choose the actions, and you can select all actions.

Pre-Requisites

  • Access to the OVHcloud account owner login or an IAM administrator

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Open each policy and review its actions.

  5. Flag any policy that allows all actions (for example, an action ending with *) on its resources.

  6. If any are found, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Open the ⋯ menu next to the flagged policy and select Modify policy.

  5. Replace the wildcard with the specific actions, or the OVHcloud-managed permission groups, that the identities need.

  6. Click Modify policy to apply the changes, and confirm the users can still do their work.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Under Identity and Access Management, select Policies.

  4. Open the ⋯ menu next to the policy, select Modify policy, restore the previous actions, and save.

Reference