Skip to main content

Best Practices

Last updated: 22/05/2025

Recommendations for the Secure Use of Cloud Temple Services​

Cloud Temple services provide you with a highly secure cloud infrastructure by design. However, certain security best practices are your responsibility as a user of these services. This guide helps you strengthen the security of your cloud environment by leveraging the features offered in the Console.

You will find practical recommendations for:

  • Protecting access to the cloud Console;
  • Managing access and permissions in a controlled manner;
  • Securing resources deployed through our cloud services.

Console Access​

Access to the Console is the gateway to all your Cloud Temple services. It is therefore essential to protect it effectively.

Restrict Access to the Console via IP Filtering​

Access to the cloud management console is restricted to previously authorized IP addresses. This restriction allows access only to users from the specified IP ranges, thereby minimizing the risk of unauthorized access.

You can configure these IP restrictions in your organization's settings. To learn how to configure IP filtering, refer to the Access and Authentication Management | Cloud Temple Documentation.

To maximize the effectiveness of this mechanism, ensure that you:

  • Limit the number of authorized IP addresses to the strict minimum ;
  • Avoid overly broad or generic ranges ;
  • Add only IPs from controlled environments (e.g., outbound IP of your corporate network) ;
  • Prohibit, or strictly limit, individual IP addresses (e.g., public home IP of your IT staff) ;
  • Prohibit, or limit, third-party IP addresses (e.g., service providers) ;
  • Keep this list up to date in case of changes to your network infrastructure.

For remote access (remote work, contractors…), prefer routing through your corporate network via VPN rather than directly authorizing individual IP addresses. This reduces the Console's attack surface and centralizes access management within your organization.

Using Identity Federation​

Identity federation allows you to integrate the Cloud Temple Console with your identity provider (IdP) by enabling SSO. This approach centralizes authentication and offers several benefits:

  • Unified account management: creation, modification, and deletion via your directory;
  • Reduced attack surface: local accounts become unnecessary or limited;
  • Enhanced traceability: access is logged by your IdP;
  • Strengthened integration: MFA, alerting, contextual security policies…;
  • Simplified compliance: consistency with your internal practices.

For these reasons, identity federation is recommended, particularly for environments with a large user base or high security requirements.

Follow our step-by-step guides to integrate your identity provider:

Enable Multi-Factor Authentication (MFA)​

Multi-factor authentication (MFA) significantly strengthens access security to the Cloud Temple Console. It adds an authentication step by requesting a temporary code generated by a dedicated application, in addition to the password. This measure significantly reduces the risk of unauthorized access, even in the event of credential theft.

For accounts managed locally by the Console (without federation), MFA is enabled by default and cannot be disabled.

For federated accounts, it is highly recommended to enforce MFA on the identity provider side, particularly for administrators with access to the Console.

For more information:

Accessing the Console from Secure Equipment​

The workstation and environment from which you access the Console are important for securing the administration of your cloud services. If you operate in an environment with high security requirements, you can apply the following recommendations:

Raising Administrator Awareness of Phishing Risks​

Access to the Cloud Temple Console requires heightened vigilance, particularly against phishing attempts aimed at stealing credentials or MFA codes. It is crucial that authorized users are regularly made aware of these risks: systematic URL verification, caution regarding unexpected messages, and immediate reporting of any suspicious activity.

To mitigate these risks, we recommend never accessing the Console via a link received by email, but always by manually entering the standard URL.

These best practices fall under your responsibility as a client and are essential for preventing phishing attacks. If in doubt, Cloud Temple support remains available to you.

Cloud Service Management​

Your cloud resources are managed from the Console. This chapter provides essential recommendations for controlling the operation of cloud services.

Identify tenant owners​

The tenant owner holds all permissions associated with enabled products and receives official notifications. It is crucial to ensure that your tenant owners are the appropriate points of contact within your organization.

For secure and efficient management:

  • Identify a responsible owner, preferably someone directly involved in managing the environment.
  • Verify the owner's contact email address to ensure it is valid and regularly checked.
  • Ensure direct control by adding an owner who is a member of your organization, even if you outsource your cloud service management, so you can oversee important notifications and decisions.
  • Limit the number of owners to 3 to reduce the attack surface and facilitate auditing of critical actions.

For more information on managing tenant owners, see the Tenant Owner Guide | Cloud Temple Documentation.

Manage permissions on your cloud services​

The Cloud Temple Console allows granular access management by assigning one or more permission levels to each user, which precisely determine the authorized actions. Consult the permissions documentation (Permissions disponibles pour les utilisateurs de votre organisation | Documentation Cloud Temple) to understand the different permissions in detail and assign them appropriately.

For effective and secure permission management, we recommend following these best practices:

  • Apply the principle of least privilege: grant users only the permissions necessary for their tasks. This reduces risks by limiting access to unnecessary features.
  • Limit sensitive permissions: Assign sensitive permissions only to users responsible for these functions. Sensitive permissions notably include access management (console_public_access_write, *_console_access, object - storage_write), permission management (iam_write, iam_offline_access), and backup management (backup_iaas_opensource_write, backup_iaas_spp_write).**
  • Prefer read-only access: In case of doubt, grant read-only access (*_read) to minimize risks while still allowing access to necessary information.
  • Conduct regular access reviews: Regularly check user permissions to remove obsolete ones. Exporting permissions in CSV format facilitates this management.**

A controlled assignment of permissions limits the risk of errors or malicious actions, while strengthening your security posture.

Regularly update hypervisors​

Cloud Temple regularly provides builds for hypervisors to ensure the application of security patches. However, updating hypervisors remains your responsibility, as we do not have visibility into your business constraints.

Therefore, we recommend that you:

  • Regularly check the Console for the availability of new builds for your hypervisors;
  • Regularly deploy the new builds across all your hypervisors, especially if they fix security vulnerabilities;
  • Regularly deploy the latest versions of vmtools on your virtual machines.

A security alerts page is available to inform you of known vulnerabilities and associated recommendations: Alertes de sécurité | Cloud Temple.

Monitor cloud service activity​

To ensure effective monitoring of your cloud environment and react quickly to anomalies, it is essential to implement a proactive monitoring strategy. We particularly recommend that you:

Securing Hosted Resources​

In a Cloud model, the security of deployed resources is the user's responsibility. Cloud Temple provides a secure infrastructure, but it is up to you to protect your operating systems, data, and configurations.

Below are the essential best practices to strengthen the security of your VMs: configuring backup policies, encrypting critical resources, and hardening operating systems. These measures help mitigate the risk of compromise, ensure data integrity, and guarantee business continuity in the event of an incident.

Configure Backups​

To ensure the security and resilience of your data, it is essential to properly define and apply your backup policies. Assigning a backup policy to each virtual machine before startup is mandatory. The documentation is available in the "Backup" section of the Guide de démarrage | Documentation Cloud Temple.

Here are the recommendations for managing the backup policies for your Cloud Temple resources:

  • Define your backup policies: Request support to create backup policies tailored to your organization's security needs.
  • Avoid suspended policies: Do not leave any VM associated with a suspended backup policy to avoid compromising data security.
  • Perform restoration tests: Regularly test the restoration of your backups to verify the effectiveness of your recovery procedures.

Encrypt Sensitive VMs​

In addition to disk-level data encryption, which is native to all cloud resources, VM encryption can be enabled to protect your most sensitive resources. To do so, refer to Chiffrer une machine virtuelle VMware | Documentation Cloud Temple.

Here are some best practices when using VM encryption:

  • Enable encryption on sensitive VMs: Apply it upon machine creation or during a scheduled update. The operation requires a temporary VM shutdown;
  • Verify encryption status: Check from the console that the VM displays the "encrypted" status;
  • Back up before encryption: Ensure the VM is properly backed up before making any changes.

Restricting the Exposure of Your Resources​

To limit the attack surface of your virtual machines, it is strongly recommended to restrict exposed services to the strict minimum. In particular, ensure that your resources are configured to not publicly expose the administration interfaces and consoles of deployed systems and applications.

If you use Cloud Temple's Object Storage services, it is also advised to not configure your buckets for public access, except in cases where this is strictly necessary (see Limitation des accès à vos buckets S3 | Documentation Cloud Temple).

Harden Virtual Machines (IaaS Services)​

Hosting a virtual machine on a secure cloud does not, by itself, guarantee the security of the operating system, services, or applications it runs. Hardening VMs, whether deployed by you or sourced from the catalog, is your responsibility.

We recommend that you apply basic security measures

  • Keep systems up to date with security patches;
  • Limit exposed services;
  • Disable unnecessary components;
  • Restrict access rights to only what is strictly necessary;
  • Enable access logging;
  • Configure regular backups.

To guide you in these actions, refer to:

These best practices form the first line of defense for securing your systems in the cloud.

Harden containers (PaaS services)​

To ensure the security of your containers within the OpenShift PaaS service, we recommend implementing the following measures to strengthen their hardening:

  • Image sources : Ensure that all images come from trusted sources, such as internal registries or the Red Hat Container Catalog, and avoid using unverified community images, such as those available on the public Docker Hub.
  • Privilege restriction : Limit container privileges by using OpenShift features, particularly Security Context Constraints (SCC), to restrict permissions to the strict minimum.
  • SCC configuration : Create custom SCCs for each application or group of applications. This includes restricting allowed system calls (for example, via seccomp profiles), with specific configurations such as disabling ptrace or mount to reduce container escape risks.
  • Workload isolation : Use Namespaces and Network Policies to isolate applications and limit unnecessary interactions between containers.
  • Comprehensive logging : Enable logging via the OpenShift Logging operator to capture events related to containers and hosted systems, to better detect and analyze any suspicious activity.

Going Further​

If you wish to benefit from additional security services or enhanced support on security aspects (audit, durcissement, conformité, conseil, etc.), our Professional Services can be engaged. For more information, please contact your Cloud Temple representative.