TMA-OCI-5.2.2

Ensure boot volumes are encrypted with Customer Managed Key (CMK).

YüksekDüzey 2Otomatikoci

Açıklama

When you launch a virtual machine (VM) or bare metal instance based on a platform image or custom image, a new boot volume for the instance is created in the same compartment. That boot volume is associated with that instance until you terminate the instance. Encryption of boot volumes provides an additional level of security for your data. Management of encryption keys is critical to protecting and accessing protected data. Uses resource search for boot volumes in every subscribed region; each must have a kms-key-id. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
rs=$(oci iam region-subscription list --tenancy-id "$t" --query 'data[?status==`"READY"`]."region-name"' --raw-output 2>/dev/null) || exit 1
regions=$(printf '%s\n' "$rs" | grep -o '"[a-z0-9-]*"' | tr -d '"')
[ -n "$regions" ] || exit 1
for r in $regions; do
  ids=$(oci search resource structured-search --region "$r" --query-text "query bootvolume resources where lifeCycleState != 'TERMINATED' && lifeCycleState != 'DELETED'" --query 'data.items[].identifier' --raw-output 2>/dev/null) || exit 1
  for i in $(printf '%s\n' "$ids" | grep -o 'ocid1\.[a-z]*\.[^"]*'); do
    k=$(oci bv boot-volume get --boot-volume-id "$i" --region "$r" --query 'data."kms-key-id"' --raw-output 2>/dev/null) || exit 1
    [ -n "$k" ] && [ "$k" != null ] || { echo "Oracle-managed key: $r $i"; bad=1; }
  done
done
[ "$bad" -eq 0 ] && echo compliant

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

oci bv boot-volume-kms-key update --boot-volume-id <ocid> --kms-key-id <vault-key-ocid> for each listed boot volume.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: ocistorage
Referans: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 5.2.2 Ensure boot volumes are encrypted with Customer Managed Key (CMK).

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target oci --level 2