Description
Ensure each Public Cloud File Storage share allows access only from specific IP addresses or private network ranges through its access rules, rather than from any address.
Rationale
A file share open to broad ranges can be mounted by any system on those networks, which may expose or allow changes to shared files. Limiting access to the specific servers or subnets that need it protects the data from unauthorized systems.
Impact
Only approved systems can mount the share
Protects shared files from unauthorized access
New servers must be added to the access rules
Default Value
Access to a share is controlled by ACL rules that list the allowed client IP addresses or CIDR ranges. File Storage can only be used with OVHcloud IPs (Public Cloud and Managed Kubernetes Service).
Pre-Requisites
Permission to manage File Storage in the Public Cloud project
A list of IP addresses or ranges that need access
Test Plan
Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.
In the left-hand menu, select Public Cloud and choose your project.
In the left-hand menu, select File Storage and click the share to open its dashboard.
Open the Access Control List (ACL) tab and flag rules that allow broad ranges or clients that no longer need access.
If any are found, follow the implementation steps.
Implementation Steps
Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.
In the left-hand menu, select Public Cloud and choose your project.
Open the share's Access Control List (ACL) tab and click Add a new access.
Enter the private IP address or CIDR range of each client that needs access, select the permission (read/write or read-only), and confirm.
Delete rules that allow broad ranges or clients that no longer need access.
Backout Plan
Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.
In the left-hand menu, select Public Cloud and choose your project.
Open the share's Access Control List (ACL) tab and add back the removed rules with Add a new access.
Reference