TMA-OCI-3.3

Ensure In-transit Encryption is enabled on Compute Instance

高レベル 1自動oci

説明

The Block Volume service provides the option to enable in-transit encryption for paravirtualized volume attachments on virtual machine (VM) instances. All the data moving between the instance and the block volume is transferred over an internal and highly secure network. If you have specific compliance requirements related to the encryption of the data while it is ... Flags non-terminated instances whose launch-options.is-pv-encryption-in-transit-enabled is false. Covers every subscribed region and every accessible compartment. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

チェック方法

監査方法: シェルコマンド

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  for c in $comps; do
    out=$(oci compute instance list --compartment-id "$c" --region "$r" --all --query 'data[?"lifecycle-state"!=`"TERMINATED"` && "launch-options"."is-pv-encryption-in-transit-enabled"==`false`]."display-name"' --raw-output 2>/dev/null) || exit 1
    printf '%s\n' "$out" | grep -q '"' && { printf '%s\n' "$out" | grep '"' | sed "s|^|$r |"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Enable in-transit encryption for the boot/block volume attachments (Instance > Boot volume > Edit > Use in-transit encryption, or oci compute instance update --launch-options '{"isPvEncryptionInTransitEnabled": true}').

プロパティ

オペレーティングシステム: すべて
タグ: ocicompute
参照: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 3.3 Ensure In-transit Encryption is enabled on Compute Instance

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target oci