TMA-OCI-5.2.2

Ensure boot volumes are encrypted with Customer Managed Key (CMK).

ВысокийУровень 2Автоматическаяoci

Описание

When you launch a virtual machine (VM) or bare metal instance based on a platform image or custom image, a new boot volume for the instance is created in the same compartment. That boot volume is associated with that instance until you terminate the instance. Encryption of boot volumes provides an additional level of security for your data. Management of encryption keys is critical to protecting and accessing protected data. Uses resource search for boot volumes in every subscribed region; each must have a kms-key-id. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Как проверяется

Метод проверки: Команда оболочки

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  ids=$(oci search resource structured-search --region "$r" --query-text "query bootvolume resources where lifeCycleState != 'TERMINATED' && lifeCycleState != 'DELETED'" --query 'data.items[].identifier' --raw-output 2>/dev/null) || exit 1
  for i in $(printf '%s\n' "$ids" | grep -o 'ocid1\.[a-z]*\.[^"]*'); do
    k=$(oci bv boot-volume get --boot-volume-id "$i" --region "$r" --query 'data."kms-key-id"' --raw-output 2>/dev/null) || exit 1
    [ -n "$k" ] && [ "$k" != null ] || { echo "Oracle-managed key: $r $i"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

oci bv boot-volume-kms-key update --boot-volume-id <ocid> --kms-key-id <vault-key-ocid> for each listed boot volume.

Свойства

Операционные системы: Любая
Теги: ocistorage
Источник: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 5.2.2 Ensure boot volumes are encrypted with Customer Managed Key (CMK).

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target oci --level 2