Dell ObjectScale 1.3 Administration Guide

Privileged actions approval system (PAAS)

The privileged actions approval system (PAAS) prevents a management user from obtaining root-like privileges and circumventing security controls. To prevent that type of scenario, the PAAS workflow requires an approval from a second user before certain management or account actions can occur. The actions that require approval are ones that are high risk if they were performed by bad actors.

PAAS supports the following ObjectScale protection modes. These protection modes require PAAS to be enabled.

• Platform protection mode—Protects the ObjectScale platform from bad actor risks by requiring approval through PAAS for a set of predefined configuration actions and operating system access.
• Account protection mode—Protects S3 data from bad actor risks by requiring approval through PAAS for certain predefined data access and account configuration actions. Account protection mode is enabled separately on each account.

The approvers of actions are called Approver Users and they must be defined as such in the system. PAAS relies on a separation of duties between Management Users (who submit requests to perform actions) and Approver Users. In ObjectScale, they are separate entities.

Only Management Users can request actions. If IAM users need protected access, they must ask a Management User to submit the request on their behalf.

Here is a summary of the PAAS workflow:

1. A Management User with security_admin role creates two Approver Users.
2. The two Approver Users must log in at least one time and follow the prompts to change their password. When they do, their status changes to Registered Approver.
3. When there are two Registered Approver Users, a Management User with security_admin role can enable PAAS.
4. The Management User with security_admin role can now add additional Approver Users. These additions require approval.
5. Management Users with appropriate roles can enable Platform Protection Mode (gloabally) or Account Protection Mode (on individual accounts).
6. When an action requires approval, a Management User creates the request for the approval. If an IAM user needs an account action that requires approval, the IAM user must ask a Management User to create the request on their behalf. All requests for approval appear in the ObjectScale Portal under Administration > Requests.
7. An Approver User logs into the ObjectScale Portal and approves or rejects requests on the Administration > Requests page.
8. When a request is approved, the Management User can complete the approved action.

The ObjectScale API accommodates this workflow. There are APIs for Management Users to create or cancel requests. There are APIs for Approver Users to approve or reject requests. Management Users can use APIs to get generated request IDs and the PAATOKEN on an approved request .

The ObjectScale Portal user interface accommodates most steps in the workflow. In the following sections, the user interface procedures are described whenever they are available.

All CREATE, UPDATE and DELETE PAAS actions are captured by KAHM. You can view log messages on the Logs page in the ObjectScale Portal user interface.