Ensure user customer secret keys rotate every 90 days

HighLevel 1Automatedoci

Description

Object Storage provides an API to enable interoperability with Amazon S3. To use this Amazon S3 Compatibility API, you need to generate the signing key required to authenticate with Amazon S3. This special signing key is an Access Key/Secret Key pair. It is important to rotate customer secret keys at least every 90 days, as they provide the same level of object storage access that the user they are associated with has. No ACTIVE user may hold a customer secret key created more than 90 days ago (users of the Default identity domain, as listed by oci iam user list). Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

How it is checked

Audit method: Shell command

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cutoff=$(date -u -d '90 days ago' +%Y-%m-%dT%H:%M:%S 2>/dev/null || date -u -v-90d +%Y-%m-%dT%H:%M:%S 2>/dev/null) || exit 1
us=$(oci iam user list --compartment-id "$t" --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
for u in $(printf '%s\n' "$us" | grep -o 'ocid1\.user\.[^"]*'); do
  ks=$(oci iam customer-secret-key list --user-id "$u" --query 'data[?"lifecycle-state"==`"ACTIVE"`]."time-created"' --raw-output 2>/dev/null) || exit 1
  old=$(printf '%s\n' "$ks" | grep -o '"[0-9][^"]*"' | tr -d '"' | awk -v c="$cutoff" '$1 < c')
  [ -z "$old" ] || { echo "customer secret key older than 90 days: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Create a new customer secret key (oci iam customer-secret-key create), update S3-compatible clients, then delete the old key.

Properties

Operating systems: Any
Tags: ociiam
Reference: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.9 Ensure user customer secret keys rotate every 90 days

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target oci