Remediating Inherited IAM, Public Buckets, and BYOK Gaps
Meridian Insurance runs a claims portal on IBM Cloud with 14 VPCs across three resource groups and two accounts inherited from acquisitions. An external audit found 38 service IDs with account-level administrator roles, 11 API keys older than two years, three Object Storage buckets containing claims documents with public access, and no central evidence that key custody meets the regulator's BYOK requirement. The regulator requires that claims data be encrypted with customer-managed keys, that key use be logged, and that audit logs be retained for seven years and be tamper-evident. Developers deploy with a shared API key stored in a CI variable. The company has 60 developers and 8 production services. Security wants a 90-day remediation plan but cannot disrupt the December claims freeze. The CISO has asked for a target operating model, not a point fix.
1. Design the target IAM and account/resource-group model. How do you move from 38 account-level administrator service IDs and a shared CI key to least privilege without blocking delivery?
Read the worked answer
Use a target account and resource-group model rather than patching 38 admin service IDs. Keep production in a dedicated account, or at least a dedicated resource group with tightly scoped access, separate from dev/test and from the acquired estates. Create IAM access groups by job function and environment, assign policies at the resource-group or service-instance scope, and require MFA for human access. Replace account-level administrator service IDs with per-application and per-pipeline service IDs that have only the roles they need; delete unused IDs and rotate keys on a schedule. Revoke the shared CI API key and replace it with a pipeline identity whose credential is short-lived or brokered. Keep one break-glass group with account-level admin, protected by MFA, approval, and alerting on use. For 60 developers and 8 production services, this is manageable: 8 production service IDs, a small number of pipeline identities, and groups for developers, SREs, and auditors. Segregation of duties means the deployer cannot also approve its own production change.
2. What key-management architecture would satisfy the BYOK, key-use logging, and seven-year tamper-evident audit requirements? Address the public buckets separately.
Read the worked answer
Meet BYOK with Hyper Protect Crypto Services if the regulator requires dedicated customer-controlled key material and a strong tamper-resistant boundary; Key Protect is acceptable only if its multi-tenant HSM model satisfies the specific control. Use envelope encryption: the customer root key stays in the key service, and data keys protect COS buckets, VPC block volumes, and database instances. Import or generate customer key material under dual control, document custody, and define rotation and revocation. Enable key-use auditing to Activity Tracker Event Routing and forward it to the tamper-evident log archive. The public buckets are an immediate containment issue: remove public access, audit object-level exposure, and rotate any credentials that could have read them. Do not let the BYOK project delay that containment. For seven-year retention, write audit events to a dedicated COS bucket with immutability/retention and restricted delete rights, and test restore. The evidence package should show key policy, custody records, use logs, and a sample decrypt event tied to a claims object.
3. Sequence the remediation around the December claims freeze. What comes first, what can wait, and how do you present a target operating model to the CISO?
Read the worked answer
Sequence by risk and reversibility, not by audit finding number. Week 1: contain the public buckets, revoke the shared CI key, rotate exposed credentials, and preserve evidence. Weeks 1-3: inventory and disable unused service IDs, then introduce access groups and scoped policies in dev/test. Weeks 4-8: migrate production services to scoped identities and pipeline approvals, with a canary service first. Weeks 6-12: BYOK and audit-log retention, because key migration touches data services and needs change windows. Respect the December freeze by completing production identity changes before the freeze or scheduling them for January; do not force a key rotation during peak claims. Use a temporary exception register for anything deferred, with owner, risk, and date. Give the CISO a target operating model: account structure, IAM groups, key custody, logging pipeline, and a quarterly access review. That is more durable than a one-time cleanup and gives the regulator evidence of a controlled system.