TMA-OCI-5.1.2

Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK).

HochStufe 2Automatisiertoci

Beschreibung

Oracle Object Storage buckets support encryption with a Customer Managed Key (CMK). By default, Object Storage buckets are encrypted with an Oracle managed key. Encryption of Object Storage buckets with a Customer Managed Key (CMK) provides an additional level of security on your data by allowing you to manage your own encryption key lifecycle management for the bucket. Every bucket must have a kms-key-id (customer managed key). Covers every subscribed region and every accessible compartment. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  for c in $comps; do
    bs=$(oci os bucket list --compartment-id "$c" --region "$r" --all --query 'data[].name' --raw-output 2>/dev/null) || exit 1
    for b in $(printf '%s\n' "$bs" | sed -n 's/^[[:space:]]*"\([^"]*\)",\{0,1\}[[:space:]]*$/\1/p'); do
      k=$(oci os bucket get --bucket-name "$b" --region "$r" --query 'data."kms-key-id"' --raw-output 2>/dev/null) || exit 1
      [ -n "$k" ] && [ "$k" != null ] || { echo "Oracle-managed key: $r $b"; bad=1; }
    done
  done
done
[ "$bad" -eq 0 ] && echo compliant

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

oci os bucket update --bucket-name <bucket> --kms-key-id <vault-key-ocid> (Bucket details > Encryption key > Assign) after granting Object Storage use of the key.

Eigenschaften

Betriebssysteme: Beliebig
Tags: ocistorage
Referenz: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 5.1.2 Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK).

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target oci --level 2