TMA-OCI-5.2.1

Ensure Block Volumes are encrypted with Customer Managed Keys (CMK).

VisokaNivo 2Automatskaoci

Opis

Oracle Cloud Infrastructure Block Volume service lets you dynamically provision and manage block storage volumes. By default, the Oracle service manages the keys that encrypt block volumes. Block Volumes can also be encrypted using a customer managed key. Encryption of block volumes provides an additional level of security for your data. Management of encryption keys is critical to protecting and accessing protected data. Flags block volumes without a kms-key-id. Covers every subscribed region and every accessible compartment. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Kako se proverava

Metod provere: Komanda ljuske

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  for c in $comps; do
    out=$(oci bv volume list --compartment-id "$c" --region "$r" --all --query 'data[?"lifecycle-state"!=`"TERMINATED"` && "kms-key-id"==`null`]."display-name"' --raw-output 2>/dev/null) || exit 1
    printf '%s\n' "$out" | grep -q '"' && { printf '%s\n' "$out" | grep '"' | sed "s|^|$r |"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

oci bv volume-kms-key update --volume-id <ocid> --kms-key-id <vault-key-ocid> for each listed block volume.

Svojstva

Operativni sistemi: Bilo koji
Oznake: ocistorage
Referenca: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 5.2.1 Ensure Block Volumes are encrypted with Customer Managed Keys (CMK).

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target oci --level 2