Ensure no resources are created in the root compartment

高レベル 1自動oci

説明

When you create a cloud resource such as an instance, block volume, or cloud network, you must specify to which compartment you want the resource to belong. Placing resources in the root compartment makes it difficult to organize and isolate those resources. Placing resources into a compartment will allow you to organize and have more granular access controls to your cloud resources. Resource search in every subscribed region must find no VCN, instance, volume, boot volume, file system, bucket or database resources in the root compartment. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

チェック方法

監査方法: シェルコマンド

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  n=$(oci search resource structured-search --region "$r" --query-text "query VCN, instance, volume, bootvolume, filesystem, bucket, autonomousdatabase, database, dbsystem resources where compartmentId = '$t'" --query 'length(data.items[?"lifecycle-state"!=`"TERMINATED"` && "lifecycle-state"!=`"DELETED"`])' --raw-output 2>/dev/null) || exit 1
  [ "${n:-0}" -eq 0 ] || { echo "$n resources in the root compartment: $r"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Move the listed resources to child compartments (oci <service> <resource> change-compartment --compartment-id <child-ocid>).

プロパティ

オペレーティングシステム: すべて
タグ: ociasset-management
参照: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 6.2 Ensure no resources are created in the root compartment

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target oci