Description

Ensure Public Cloud project users (OpenStack users) are given only the roles they need, such as Compute Operator or ObjectStore operator, and that the Administrator role is limited to users who truly need full control of the project.

Rationale

A Public Cloud user with the Administrator role can create, change, or delete every resource in the project through the API or Horizon. These credentials are often used in scripts and tools, so a leak gives an attacker full control of the project. Narrow roles limit the damage.

Impact

  • Limits damage from leaked OpenStack credentials

  • Enforces least privilege in the project

  • Tools may need users with different roles

Default Value

When creating a Public Cloud user, you choose its roles, and the Administrator role can be selected.

Pre-Requisites

  • Permission to manage the Public Cloud project

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the left-hand menu, under Settings, select Users & Roles.

  4. Review the roles of each user and flag users with the Administrator role.

  5. If a user has the Administrator role without a documented need, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In Users & Roles, click the ⋯ button next to the user and select Edit roles.

  4. Untick Administrator, tick only the roles the user needs (for example Compute Operator or ObjectStore operator), and click Confirm.

  5. Confirm that the tools using this user still work.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In Users & Roles, click the ⋯ button next to the user, select Edit roles, tick Administrator again, and click Confirm.

Reference