TMA-OCI-5.2.2

Ensure boot volumes are encrypted with Customer Managed Key (CMK).

AltaNivel 2Automatizadaoci

Descripción

When you launch a virtual machine (VM) or bare metal instance based on a platform image or custom image, a new boot volume for the instance is created in the same compartment. That boot volume is associated with that instance until you terminate the instance. Encryption of boot volumes provides an additional level of security for your data. Management of encryption keys is critical to protecting and accessing protected data. Uses resource search for boot volumes in every subscribed region; each must have a kms-key-id. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Cómo se verifica

Método de auditoría: Comando de shell

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  ids=$(oci search resource structured-search --region "$r" --query-text "query bootvolume resources where lifeCycleState != 'TERMINATED' && lifeCycleState != 'DELETED'" --query 'data.items[].identifier' --raw-output 2>/dev/null) || exit 1
  for i in $(printf '%s\n' "$ids" | grep -o 'ocid1\.[a-z]*\.[^"]*'); do
    k=$(oci bv boot-volume get --boot-volume-id "$i" --region "$r" --query 'data."kms-key-id"' --raw-output 2>/dev/null) || exit 1
    [ -n "$k" ] && [ "$k" != null ] || { echo "Oracle-managed key: $r $i"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

oci bv boot-volume-kms-key update --boot-volume-id <ocid> --kms-key-id <vault-key-ocid> for each listed boot volume.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: ocistorage
Referencia: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 5.2.2 Ensure boot volumes are encrypted with Customer Managed Key (CMK).

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target oci --level 2