Inspection device, inspection method, and program

Abstract

Provides comprehensive assessment results for public cloud resources. [Solution] The inspection device acquires environmental information from a public cloud used by a user that provides a managed service having multiple resources, in which multiple resources in the public cloud and multiple parameters possessed by the multiple resources are listed as the status of the managed service, and determines whether one of the multiple resources violates one of the multiple policies by comparing the acquired environmental information with the contents of multiple policies that are conditions that must be satisfied by multiple parameters possessed by the multiple resources listed in the environmental information.When it is determined that one resource violates one policy, the inspection device notifies the user of the violation depending on the importance of the one policy that is violated.

Description

[Technical field]

[0001] The present disclosure relates to an inspection apparatus, an inspection method, and a program. [Background technology]

[0002] The cloud monitoring method etc. described in Patent Document 1 aims to prevent information security problems caused by negligent or intentional operations of cloud resources by public cloud users. To achieve the aim, the cloud monitoring method etc. judges whether or not the operations by the users to the cloud resources have the potential to increase security risks based on a log of the operations. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2021-121886 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, in the above-mentioned cloud monitoring method, as described above, the judgment regarding the user's operation is based on the log of the user's operation, so that the judgment is individual, i.e., a comprehensive judgment cannot be made.

[0005] An object of the present disclosure is to provide an inspection device, an inspection method, and a program that can provide comprehensive judgment results for public cloud resources. [Means for solving the problem]

[0006] In order to solve the above-mentioned problems, the inspection device of the present disclosure includes an acquisition unit that acquires, from a public cloud used by a user that provides a managed service having a plurality of resources, environmental information that lists the plurality of resources in the public cloud and the plurality of parameters possessed by the plurality of resources as the status of the managed service, a determination unit that determines whether or not one of the plurality of resources violates one of the plurality of policies by comparing the acquired environmental information with the contents of a plurality of policies that are conditions that must be satisfied by the plurality of parameters possessed by the plurality of resources listed in the environmental information, and a notification unit that, when it is determined that the one resource violates the one policy, notifies the user of the violation in accordance with the importance of the one policy that is violated. Effect of the Invention

[0007] According to the inspection device according to the present disclosure, comprehensive assessment results can be provided for public cloud resources. [Brief description of the drawings]

[0008] [Figure 1] 2 shows the configuration of a policy checking system PKS according to the first embodiment. [Diagram 2] 2 shows the configuration of an inspection device KS according to the first embodiment. [Diagram 3] 1 shows the configuration of a public cloud PK in the first embodiment. [Figure 4] 2 shows the configuration of a terminal TM according to the first embodiment. [Diagram 5] 1 shows the operation of the policy checking system PKS of the first embodiment. [Figure 6] 1 shows the compliance KO of embodiment 1. [Figure 7] 1 shows the operation of the policy checking system PKS of the second embodiment. [Figure 8] 4 shows the determination result HK of the second embodiment. [Figure 9]11 shows the determination result HK in the second embodiment (rewrite 1). [Figure 10] 11 shows the determination result HK in the second embodiment (rewrite 2). [Figure 11] A modified example of environmental information KJ is shown. [Figure 12] The compliance KO of the modified example is shown. [Figure 13] 1 shows a hardware configuration of a policy checking system PKS according to the first and second embodiments. [Figure 14] 1 shows a hardware configuration based on software realization of the policy checking system PKS of the first and second embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] An embodiment of a policy checking system according to the present disclosure will be described.

[0010] First Embodiment The policy checking system PKS of the first embodiment will be described.

[0011] Configuration of First Embodiment FIG. 1 shows the configuration of a policy checking system PKS according to the first embodiment.

[0012] The policy inspection system PKS of the first embodiment includes an inspection device KS, a public cloud PK, and a terminal TM, as shown in Fig. 1. The inspection device KS, the public cloud PK, and the terminal TM are connected to each other via a network NW (e.g., the Internet) as shown in Fig. 1.

[0013] In the policy inspection system PKS, as shown in FIG. 1, the inspection device KS scans the public cloud PK SC to obtain environmental information KJ indicating the status of the managed service MS from the public cloud PK, thereby monitoring the status of the managed service MS, and, if necessary, notifies the terminal TM of the user US using the public cloud PK of a violation IH (details will be described later) of the managed service MS.

[0014] As shown in Fig. 1, the public cloud PK has a managed service MS for use by the user US, and the managed service MS includes a number of resources REa, REb, REc, etc. Here, the resource RE should be interpreted broadly and may mean, for example, the user US (particularly, matters related to the user US, and the behavior of the user US). For example, the identification number ID and password PW that the user US should input when using the public cloud PK, as well as changing the password PW, are also included in the resource RE.

[0015] In the following, for ease of explanation and understanding, a plurality of names may be collectively referred to as one name, for example, resources REa, REb, REc, . . . may be collectively referred to as resource RE.

[0016] <Configuration of inspection device KS> FIG. 2 shows the configuration of the inspection device KS of the first embodiment.

[0017] As shown in FIG. 2, the inspection device KS of the first embodiment has an input / output unit NY(KS), a processing unit SY(KS), a storage unit KI(KS), and a communication unit TU(KS).

[0018] The input / output unit NY (KS) is used, for example, by an administrator (not shown) of the inspection device KS to perform input / output for monitoring and controlling the operation of the inspection device KS. The input / output unit NY (KS) is, for example, a keyboard, a mouse, a liquid crystal monitor, and a printer.

[0019] The processing unit SY (KS) performs, for example, processing related to monitoring the status of the managed service MS of the public cloud PK, such as a scan SC (shown in FIG. 1).

[0020] The storage unit KI (KS) stores, for example, data necessary for processing by the processing unit SY (KS).

[0021] The communication unit TU (KS) performs communication via the network NW. For example, the communication unit TU (KS) receives environmental information KJ (shown in FIG. 1) indicating the status of the managed service MS of the public cloud PK from the public cloud PK, and also notifies the terminal TM of the user US, as necessary, that the resource RE violates the policy PO (shown in FIG. 6, for example), i.e., a violation IH (shown in FIG. 1).

[0022] <Public Cloud PK Configuration> FIG. 3 shows the configuration of the public cloud PK in the first embodiment.

[0023] As shown in FIG. 3, the public cloud PK of the first embodiment includes an input / output unit NY (PK), a processing unit SY (PK), a storage unit KI (PK), and a communication unit TU (PK).

[0024] The input / output unit NY (PK) is used by an administrator (not shown) of the public cloud PK to monitor and control the operation of the public cloud PK. The input / output unit NY (PK) is, for example, a keyboard, a mouse, an LCD monitor, and a printer.

[0025] The processing unit SY (PK), for example, performs processing to provide a managed service MS (shown in Figure 1) to a user US, and also replies with environmental information KJ (shown in Figure 1) indicating the status of the managed service MS in response to a scan SC (shown in Figure 1) from the inspection device KS.

[0026] The storage unit KI (PK) stores, for example, data necessary for the processing of the processing unit SY (PK).

[0027] The communication unit TU (PK) performs communication via the network NW. For example, the communication unit TU (PK) receives a scan SC from the inspection device KS, and returns environmental information KJ to the inspection device KS.

[0028] <Configuration of Terminal TM> FIG. 4 shows the configuration of the terminal TM of the first embodiment.

[0029] As shown in FIG. 3, the public cloud PK of the first embodiment includes an input / output unit NY(TM), a processing unit SY(TM), a storage unit KI(TM), and a communication unit TU(TM).

[0030] The input / output unit NY(TM) is used by the user US to use the terminal TM. The input / output unit NY(TM) is, for example, a keyboard, a mouse, a liquid crystal monitor, and a printer.

[0031] The processing unit SY(TM) performs, for example, processing related to the use of the managed service MS of the public cloud PK.

[0032] The storage unit KI (TM) stores, for example, data necessary for processing by the processing unit SY (PK).

[0033] The communication unit TU(TM) performs communication via the network NW. For example, the communication unit TU(TM) receives a notification of a violation IH (shown in FIG. 1) from the inspection device KS, and transmits to the inspection device KS a notice that the violation IH will be resolved or that the violation IH will not be resolved (including the reason).

[0034] Correspondence The processing unit SY(KS) of the inspection device KS corresponds to the "acquisition unit," "determination unit," "notification unit," and "rewriting unit," and the memory unit (KI) of the inspection device KS corresponds to the "memory unit."

[0035] Operation of the First Embodiment FIG. 5 shows the operation of the policy checking system PKS of the first embodiment.

[0036] FIG. 6 shows the compliance KO of embodiment 1.

[0037] The operation of the policy checking system PKS of the first embodiment will be described with reference to FIGS.

[0038] For ease of explanation and understanding, it is assumed that a user US (shown in FIG. 1) is to change his / her password PW (corresponding to the resource REc shown in FIG. 1) periodically, i.e., every predetermined period (e.g., one month), and that the password PW has passed the predetermined period (e.g., one and a half months).

[0039] Step ST1: In the inspection device KS (shown in FIG. 1), the processing unit SY (KS) scans the public cloud PK (shown in FIG. 1) through an API (Application Programming Interface) via the network NW (shown in FIG. 1) to obtain environmental information KJ on the status of the managed service MS, more specifically, the status of multiple resources RE, from the public cloud PK. Here, the environmental information KJ includes the status of the password PW that the user US should enter when using the public cloud PK (for example, the date and time when the password PW was changed).

[0040] In the inspection device KS, a processing unit SY(KS) (shown in FIG. 2) stores the environmental information KJ acquired from the public cloud PK in a storage unit KI(KS) (shown in FIG. 2).

[0041] Step ST2: In the inspection device KS, the processing unit SY (KS) compares the above-mentioned environmental information KJ with multiple policies PO (shown in Figure 6) defined in the compliance KO (shown in Figure 6) to determine whether the status of the resource RE indicated by the environmental information KJ violates the contents of any of the policies PO specified in the compliance KO.

[0042] Here, policies PO (e.g., policies PO1, PO2, PO3) in compliance KO define how resources RE (e.g., resources REa, REb, REc (shown in FIG. 1)) should be. More specifically, as shown in FIG. 6, policy PO02 defines the content of "authentication", specifically, stipulates that "password PW should be changed within 'one month'", defines the importance as "high", and the threshold as "TH(P02)".

[0043] In the inspection device KS, the processing unit SY(KS) determines that the resource REc (corresponding to the password PW of the user US) indicated by the environment information KJ has not been changed for "one and a half months," and therefore violates the policy PO2.

[0044] Step ST3: In the inspection device KS, when the processing unit SY(KS) determines in step ST2 that there is a violation, it notifies the terminal TM of the user US that the resource REc, i.e., the password PW of the user US, violates the policy PO2 (violation IH) according to the importance of the policy PO2 "high" (shown in FIG. 6) and the threshold "TH(PO2)". Here, the threshold "TH(PO2)" is, for example, information in which the importance of "high" is quantified.

[0045] In contrast to the above, if the importance of the policy PO2 is "low", the processing unit SY(KS) does not notify the terminal TM of the user US of the above-mentioned violation (violation IH).

[0046] Effects of the First Embodiment As described above, in the policy inspection system PKS of the first embodiment, when the inspection device KS determines that a resource REc, which is one of the resources RE, i.e., a password PW of a user US, violates a policy PO2, which is one of a plurality of policies PO included in a compliance KO, the inspection device KS notifies the terminal TM of the user US of the violation (violation IH). This enables the user US to know the presence or absence of a violation IH as a comprehensive determination result of whether or not the resource RE of the managed service MS of the public cloud PK violates the policy PO of the compliance KO.

[0047] Instead of the authentication using the password PW described above, as is conventionally known, authentication may be used in which, for example, the user US issues authentication information NJ (not shown) for the public cloud PK and passes the authentication information NJ to the inspection device KS.

[0048] Second Embodiment The policy checking system PKS of the second embodiment will be described.

[0049] Configuration of the Second Embodiment The configuration of the policy checking system PKS of the second embodiment is similar to the configuration of the policy checking system PKS of the first embodiment (shown in FIGS. 1 to 4).

[0050] Operation of the Second Embodiment The operation of the policy checking system PKS of the second embodiment is subsequent to the operation of the policy checking system PKS of the first embodiment (shown in FIG. 5).

[0051] FIG. 7 shows the operation of the policy checking system PKS of the second embodiment.

[0052] FIG. 8 shows the determination result HK in the second embodiment.

[0053] FIG. 9 shows the determination result HK in the second embodiment (rewrite 1).

[0054] FIG. 10 shows the determination result HK in the second embodiment (rewrite 2).

[0055] The operation of the policy checking system PKS of the second embodiment will be described with reference to FIGS.

[0056] For ease of explanation and understanding, when a resource RE (shown in FIG. 1) violates a policy PO (shown in FIG. 6) (when there is a violation IH), it is assumed that (1) a user US resolves the violation IH, and (2) a user US does not resolve the violation IH.

[0057] <When user US resolves violation IH> Step ST4: In the inspection device KS, the processing unit SY (KS) notifies the terminal TM of the user US of the violation IH (that the password PW of the user US violates the policy PO2) in step ST3, and then stores the result of the judgment (step ST2 in Figure 5) (hereinafter referred to as the "judgment result HK"; shown in Figure 8) in the memory unit KI (KS).

[0058] Step ST5A: When the user US of the terminal TM receives the violation IH from the inspection device KS in step ST3, the user US resolves the violation IH. More specifically, the user US promptly changes the password PW.

[0059] Step ST6A: The terminal TM of the user US transmits a message to the inspection device KS indicating that the violation IH has been resolved. In other words, the inspection device KS receives a message from the terminal TM of the user US indicating that the violation IH has been resolved.

[0060] Step ST7A: In the inspection device KS, the processing unit SY (KS) adds “resource REc, which violated policy PO2, was resolved at 07:15:24” to the judgment result HK stored in the memory unit KI (KS), as shown by the dotted line in Figure 9, i.e., rewrites the judgment result HK.

[0061] <If User US does not resolve the violation IH> Step ST4: In the inspection device KS, the processing unit SY (KS) stores the judgment result HK (shown in Figure 8) in the memory unit KI (KS), similar to step ST4 when the user US resolves the violation IH (that the user US's password PW violates the policy PO2).

[0062] Step ST5B: Even if the user US of the terminal TM receives the violation IH from the inspection device KS in step ST3, the user US does not resolve the violation IH. More specifically, the user US does not change the password PW at all.

[0063] Step ST6B: The terminal TM of the user US transmits to the inspection device KS a message indicating that the violation IH will not be resolved and a reason for not resolving the violation, i.e., a message indicating that the violation IH will not be resolved and a reason for not resolving the violation. In other words, the inspection device KS receives a message indicating that the violation IH will not be resolved and a reason for not resolving the violation from the terminal TM of the user US.

[0064] Step ST7B: In the inspection device KS, the processing unit SY (KS) adds “resource REc, which violated policy PO2, was not resolved at 07:15:24” (unresolved) to the judgment result HK stored in the memory unit KI (KS), as shown by the dotted line in FIG. 10, and also adds “the reason for not being resolved” (reason for being unresolved), i.e., rewrites the judgment result HK.

[0065] Effects of the Second Embodiment As described above, in the policy inspection system PKS of the second embodiment, the user US of the terminal TM resolves or leaves unresolved the resource REc that violates the policy PO2, and in the inspection device KS, the processing unit SY (KS) adds resolved or unresolved (including the reason for unresolved) to the judgment result HK stored in the storage unit KI (KS), that is, rewrites the judgment result HK. This allows the user US to grasp, in a list, the history of how the user US responded after the resource RE violated the policy PO.

[0066] <Modification> A modification of the embodiment will be described.

[0067] FIG. 11 shows a modified example of the environment information KJ.

[0068] FIG. 12 shows the compliance KO of the modified example.

[0069] In a modified policy inspection system PKS (shown in FIG. 1), a processing unit SY(KS) (shown in FIG. 2) of an inspection device KS determines whether a parameter P of a resource RE included in environmental information KJ (shown in FIG. 11) satisfies a condition JO of a policy content PO(CON) which is a resource type RT2 in a compliance KO (shown in FIG. 12) corresponding to a resource type RT1 which is a type of the resource RE.

[0070] The processing unit SY(KS) of the inspection device KS determines, for example, whether the parameter P “MFA status = disabled” of the resource RE “IAM user ID or name” in the environmental information KJ violates the condition JO “MFA is enabled for all IAM users who can access the console” of the policy content PO(CON) “IAM user without MFA enabled” of the resource type RT2 “IAM user” in the compliance KO, which corresponds to the resource type RT1 “IAM user” of the resource RE “IAM user ID or name”.

[0071] The processing unit SY(KS) of the inspection device KS also detects that the parameter P "Inbound rule with source "0.0.0.0 / 0" and port range from 20 to 25" of the resource RE "Security Group ID or name" in the environment information KJ corresponds to the resource type RT1 "Security Group" of the resource RE "Security Group ID or name". Determine whether the policy content of the "Security Group" PO(CON) "Security group allows unrestricted access to high-risk ports" and the condition JO "There are no security groups with inbound rules with the source as "0.0.0.0 / 0" or ":: / 0" and the port ranges as 20·21, 22, 23, 25, 110, 135, 143, 445, 1433·1434, 3000, 3306, 3389, 4333, 5000, 5432, 5500, 5601, 8080·8088·8888, 9200·9300" are violated.

[0072] Hardware Configuration of the Embodiment FIG. 13 shows a hardware configuration of the policy checking system PKS of the first and second embodiments.

[0073] To perform the above-mentioned functions, the policy checking system PKS of the first and second embodiments includes a processing circuit SYO as shown in FIG. 13, and further includes an input circuit NYU and an output circuit SYU as necessary.

[0074] The processing circuit SYO is a dedicated hardware. The processing circuit SYO realizes the functions of the inspection device KS, the public cloud PK, and the processing unit SY(KS), the processing unit SY(PK), and the processing unit SY(TM) of the terminal TM (shown in FIGS. 2 to 4).

[0075] The processing circuit SYO is, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination of these.

[0076] The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processing circuit SYO with, for example, the inspection device KS, the public cloud PK, and the outside of the terminal TM.

[0077] Hardware configuration based on software implementation of the embodiment FIG. 14 shows a hardware configuration based on the software realization of the policy checking system PKS of the first and second embodiments.

[0078] As shown in FIG. 14, the policy checking system PKS of the first and second embodiments includes a processor PRO and a memory circuit KIO, and further includes an input circuit NYU and an output circuit SYU as necessary.

[0079] The processor PRO is a CPU (also called a Central Processing Unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, or a DSP (Digital Signal Processing)) that executes a program. The processor PRO realizes the functions of the inspection device KS, the public cloud PK, and the processing unit SY(KS), the processing unit SY(PK), and the processing unit SY(TM) of the terminal TM (shown in FIGS. 2 to 4).

[0080] The processor PRO realizes the above-mentioned functions by software, firmware, or a combination of software and firmware. The software and firmware are written as programs and stored in the memory circuit KIO.

[0081] The processor PRO realizes the above-mentioned functions by reading and executing the above-mentioned programs from the memory circuit KIO. The above-mentioned programs can also be said to cause a computer to execute the procedures and methods of the inspection device KS, the public cloud PK, and the processing unit SY(KS), the processing unit SY(PK), and the processing unit SY(TM) of the terminal TM.

[0082] Here, the memory circuit KIO is, for example, a non-volatile or volatile semiconductor memory such as a RAM (Random Access Memory), a ROM (Read Only Memory), a flash memory, an EPROM (Erasable Programmable Read Only Memory), an EEPROM (Electrically Erasable Programmable Read-Only Memory), etc., as well as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, a DVD (Digital Versatile Disc), etc.

[0083] Of the functions of the inspection device KS, the public cloud PK, the processing unit SY(KS), the processing unit SY(PK), and the processing unit SY(TM) of the terminal TM, some of the functions may be realized by a processing circuit SYO (shown in FIG. 13), while some other functions may be realized by a processor PRO (shown in FIG. 14).

[0084] As described above, the functions of the inspection device KS, the public cloud PK, the processing unit SY(KS), the processing unit SY(PK), and the processing unit SY(TM) of the terminal TM can be realized by hardware, software, firmware, or a combination of these.

[0085] The input circuit NYU and the output circuit SYU exchange inputs and outputs related to the operation of the processor PRO with, for example, the inspection device KS, the public cloud PK, and the outside of the terminal TM.

[0086] <Example of composition> The inspection apparatus, the inspection method, and the program according to the present disclosure have, for example, the following configuration.

[0087] [Item 1] an acquisition unit that acquires, from a public cloud used by a user and providing a managed service having a plurality of resources, environmental information in which the plurality of resources in the public cloud and a plurality of parameters possessed by the plurality of resources are listed as a status of the managed service; a determination unit that determines whether or not one of the plurality of resources violates one of the plurality of policies by comparing the acquired environment information with contents of a plurality of policies that are conditions that the plurality of parameters of the plurality of resources listed in the environment information should satisfy; and a notification unit that, when it is determined that the one resource violates the one policy, notifies the user of the violation in accordance with the importance of the one policy that is violated; The inspection device includes:

[0088] [Item 2] 2. The inspection device according to item 1, wherein the importance of each of the contents of the plurality of policies is further defined for each of the plurality of policies.

[0089] [Item 3] 2. The inspection device according to item 1, further comprising a storage unit that stores a result of the determination by the determination unit.

[0090] [Item 4] a rewriting unit that rewrites the violation to a resolution in the storage unit when the violation of the one resource against the one policy is resolved by the user and notification of the resolution is received from a terminal used by the user; 4. The inspection device according to item 3, further comprising:

[0091] [Item 5] a rewriting unit that rewrites the violation to an unresolved state in the storage unit when the violation of the one resource against the one policy is not resolved by the user and the notification of the unresolved state is received from a terminal used by the user; 4. The inspection device according to item 3, further comprising:

[0092] [Item 6] When the rewriting unit receives the reason for the unresolved issue from the terminal used by the user, the rewriting unit rewrites the information in the storage unit to indicate that the issue is unresolved, and also adds the reason for the unresolved issue. Item 5. The inspection device according to item 5.

[0093] [Item 7] The computer an acquisition step of acquiring, from a public cloud used by a user and providing a managed service having a plurality of resources, environmental information in which the plurality of resources in the public cloud and a plurality of parameters possessed by the plurality of resources are listed as a status of the managed service, and storing the acquired information in a storage unit; a determination step of determining whether or not one of the plurality of resources violates one of the plurality of policies by comparing the environment information stored in the storage unit with the contents of a plurality of policies that are conditions to be satisfied by the plurality of parameters of the plurality of resources listed in the environment information; a notification step of notifying the user of the violation when it is determined that the one resource violates the one policy, in accordance with the importance of the one policy violated; The inspection method to be performed.

[0094] [Item 8] On the computer, an acquisition step of acquiring, from a public cloud used by a user and providing a managed service having a plurality of resources, environmental information in which the plurality of resources in the public cloud and a plurality of parameters of the plurality of resources are listed as a status of the managed service; a determination step of determining whether or not one of the plurality of resources violates one of the plurality of policies by comparing the acquired environment information with the contents of a plurality of policies that are conditions to be satisfied by the plurality of parameters of the plurality of resources listed in the environment information; a notification step of notifying the user of the violation when it is determined that the one resource violates the one policy, in accordance with the importance of the one policy violated; The program to be executed. [Explanation of symbols]

[0095] PKS policy inspection system, KS inspection device, PK public cloud, MS managed service, RE resource, TM terminal TM, US user.

Claims

1. an acquisition unit that acquires, from a public cloud used by a user and providing a managed service having a plurality of resources, environmental information in which the plurality of resources in the public cloud and a plurality of parameters possessed by the plurality of resources are listed as a status of the managed service; a determination unit that determines whether or not one of the plurality of resources violates one of the plurality of policies by comparing the acquired environment information with contents of a plurality of policies that are conditions that the plurality of parameters of the plurality of resources listed in the environment information should satisfy; and a notification unit that, when it is determined that the one resource violates the one policy, notifies the user of the violation in accordance with the importance of the one policy that is violated; The inspection device includes:

2. 2. The inspection device according to claim 1, wherein the importance of each of the contents of the plurality of policies is further defined.

3. The inspection device according to claim 1 , further comprising a storage unit that stores a result of the determination made by the determination unit.

4. a rewriting unit that rewrites the violation to a resolution in the storage unit when the violation of the one resource against the one policy is resolved by the user and notification of the resolution is received from a terminal used by the user; The inspection apparatus of claim 3 further comprising:

5. a rewriting unit that rewrites the violation to an unresolved state in the storage unit when the violation of the one resource against the one policy is not resolved by the user and a notification of the unresolved state is received from a terminal used by the user; The inspection apparatus of claim 3 further comprising:

6. When the rewriting unit receives the reason for the unresolved issue from the terminal used by the user, the rewriting unit rewrites the information in the storage unit to indicate that the issue is unresolved, and also adds the reason for the unresolved issue.

6. The inspection apparatus according to claim 5.

7. The computer an acquisition step of acquiring, from a public cloud used by a user and providing a managed service having a plurality of resources, environmental information in which the plurality of resources in the public cloud and a plurality of parameters possessed by the plurality of resources are listed as a status of the managed service, and storing the acquired information in a storage unit; a determination step of determining whether or not one of the plurality of resources violates one of the plurality of policies by comparing the environment information stored in the storage unit with the contents of a plurality of policies that are conditions to be satisfied by the plurality of parameters of the plurality of resources listed in the environment information; a notification step of notifying the user of the violation when it is determined that the one resource violates the one policy, in accordance with the importance of the one policy that is violated; The inspection method to be performed.

8. On the computer, an acquisition step of acquiring, from a public cloud used by a user and providing a managed service having a plurality of resources, environmental information in which the plurality of resources in the public cloud and a plurality of parameters possessed by the plurality of resources are listed as a status of the managed service; a determination step of determining whether or not one of the plurality of resources violates one of the plurality of policies by comparing the acquired environment information with the contents of a plurality of policies that are conditions to be satisfied by the plurality of parameters of the plurality of resources listed in the environment information; a notification step of notifying the user of the violation when it is determined that the one resource violates the one policy, in accordance with the importance of the one policy that is violated; The program to be executed.

Images