Loading controls...

Control: 1.16 Ensure IAM does not allow public access to Cloud Object Storage


IBM Cloud features the capability for users with specific access roles to create access policies that allow all users (authenticated and non-authenticated) to access resources in the account. This “all users” access in turn ends up in public (including non-authenticated) access to resources. Determine if this capability is required by your organization and disable if not required.


From Console

To disable the Public Access Group:

  1. Log in to IBM Cloud
  2. From the Menu bar, click Manage > Access (IAM).
  3. Click Settings > Public Access.
  4. Disable Public Access to disable the Public Access Group.

To keep the Public Access Group enabled and verify that no access policies for COS exist:

  1. Log in to IBM Cloud
  2. From the Menu bar, click Manage > Access (IAM).
  3. Click Settings.
  4. In the public access section of IAM Settings, observe the Public access group setting.
  5. If the Public access group setting is disabled, IAM is not providing public access to COS.
  6. If the Public access group setting is enabled, proceed to the Access groups page by clicking Access Groups.
  7. From the list of Access Groups, select Public Access by clicking on the Access Group name.
  8. Ensure that there are no access policies present for COS in the list of access policies.
  9. To delete an access policy, click on the action menu icon for the access policy and click Remove.


Run the control in your terminal:

steampipe check ibm_compliance.control.cis_v100_1_16

Snapshot and share results via Steampipe Cloud:

steampipe login
steampipe check --share ibm_compliance.control.cis_v100_1_16


This control uses a named query: