---
title: 'Getting Started with Oracle Cloud Infrastructure (OCI)'
---

Prowler supports security scanning of Oracle Cloud Infrastructure (OCI) environments. This guide will help you get started with using Prowler to audit your OCI tenancy.

## Prowler Cloud

The following steps apply to Prowler Cloud and the self-hosted Prowler App.

### Step 1: Collect OCI Identifiers
1. Sign in to the [OCI Console](https://cloud.oracle.com/) and open **Tenancy Details** to copy the Tenancy OCID.
2. Go to **Identity & Security** → **Users**, select the principal that owns the API key, and copy the **User OCID**.
3. Generate or locate the API key fingerprint and private key for that user. Follow the [Config File Authentication steps](/user-guide/providers/oci/authentication#config-file-authentication-manual-api-key-setup) to create or rotate the key pair and copy the fingerprint.
4. Note the **Region** identifier to scan (for example, `us-ashburn-1`).

### Step 2: Access Prowler Cloud or Prowler App
1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app).
2. Go to **Configuration** → **Cloud Providers** and click **Add Cloud Provider**.
![Add OCI Cloud Provider](./images/oci-add-cloud-provider.png)
3. Select **Oracle Cloud** and enter the **Tenancy OCID** and an optional alias, then choose **Next**.
![Add OCI Cloud Tenancy](./images/oci-add-tenancy.png)

### Step 3: Add OCI API Key Credentials
Prowler App connects to OCI with API key credentials. Provide:

- **User OCID** for the API key owner
- **Fingerprint** of the API key
- **Region** (for example, `us-ashburn-1`)
- **Private Key Content** (paste the full PEM value)
- **Passphrase (Optional)** if the private key is encrypted

Select **Next**, then **Launch Scan** to validate the connection and start the first OCI scan. The private key content is encoded for secure transmission.

![Add OCI API Key Credentials](./images/oci-add-api-key-credentials.png)

---

## Prowler CLI

### Prerequisites

Before you begin, ensure you have:

1. **Prowler installed** with OCI dependencies:
   ```bash
   pip install prowler
   # or for development:
   poetry install
   ```

2. **OCI Python SDK** (automatically installed with Prowler):
   ```bash
   pip install oci==2.152.1
   ```

3. **OCI Account Access** with appropriate permissions to read resources in your tenancy.

### Authentication

Prowler supports multiple authentication methods for OCI. For detailed authentication setup, see the [OCI Authentication Guide](./authentication.mdx).

**Note:** OCI Session Authentication and Config File Authentication both use the same `~/.oci/config` file. The difference is how the config file is generated - automatically via browser (session auth) or manually with API keys.

#### Quick Start: OCI Session Authentication (Recommended)

The easiest and most secure method is using OCI session authentication, which automatically generates your config file via browser login.

**Prerequisites:** You need to have the **OCI CLI installed**. See the [OCI CLI Installation Guide](https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm) for installation instructions.

1. Authenticate using the OCI CLI:
   ```bash
   oci session authenticate
   ```
   This will open your browser for OCI Console login and automatically generate the config file.

2. Add your user OCID to `~/.oci/config`:

   **Get your user OCID from the OCI Console:**

   Navigate to: **Identity & Security** → **Users** → Click on your username → Copy the OCID

   ![Get User OCID from OCI Console](./images/oci-user-ocid.png)

   Direct link: [OCI Console - Users](https://cloud.oracle.com/identity/domains/my-profile)

   Or use the OCI CLI:
   ```bash
   oci iam user list --all
   ```

   Edit `~/.oci/config` and add the `user` parameter:
   ```ini
   [DEFAULT]
   region=us-ashburn-1
   tenancy=ocid1.tenancy.oc1..example
   fingerprint=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
   key_file=/Users/yourusername/.oci/sessions/DEFAULT/oci_api_key.pem
   security_token_file=/Users/yourusername/.oci/sessions/DEFAULT/token
   user=ocid1.user.oc1..example  # Add this line
   ```

3. Run Prowler:
   ```bash
   prowler oci
   ```

#### Alternative: Manual API Key Setup

If you prefer to manually generate API keys instead of using browser-based session authentication, see the detailed instructions in the [Authentication Guide](./authentication.mdx#config-file-authentication-manual-api-key-setup).

**Note:** Both methods use the same `~/.oci/config` file - the difference is that manual setup uses static API keys while session authentication uses temporary session tokens.

##### Using a Specific Profile

If you have multiple profiles in your OCI config:

```bash
prowler oci --profile production
```

##### Using a Custom Config File

```bash
prowler oci --config-file /path/to/custom/config
```

#### Instance Principal Authentication

**IMPORTANT:** This authentication method **only works when Prowler is running inside an OCI compute instance**. If you're running Prowler from your local machine, use [OCI Session Authentication](#quick-start-oci-session-authentication-recommended) instead.

When running Prowler on an OCI Compute instance, you can use Instance Principal authentication:

```bash
prowler oci --use-instance-principal
```

**Requirements:**
- **Prowler must be running on an OCI compute instance**
- The compute instance must have a dynamic group and policy allowing access to OCI resources
- Example policy:
  ```
  Allow dynamic-group prowler-instances to inspect all-resources in tenancy
  Allow dynamic-group prowler-instances to read all-resources in tenancy
  ```

### Basic Usage

#### Scan Entire Tenancy

```bash
prowler oci
```

#### Scan Specific Region

```bash
prowler oci --region us-phoenix-1
```

#### Scan Specific Compartments

```bash
prowler oci --compartment-id ocid1.compartment.oc1..example1 ocid1.compartment.oc1..example2
```

#### Run Specific Checks

```bash
prowler oci --check identity_password_policy_minimum_length_14
```

#### Run Specific Services

```bash
prowler oci --service identity network
```

#### Compliance Frameworks

Run CIS OCI Foundations Benchmark v3.0:

```bash
prowler oci --compliance cis_3.0_oci
```

### Required Permissions

Prowler requires **read-only** permissions to audit your OCI tenancy. Below are the minimum required permissions:

#### Tenancy-Level Policy

Create a group `prowler-users` and add your user to it, then create this policy:

```
Allow group prowler-users to inspect all-resources in tenancy
Allow group prowler-users to read all-resources in tenancy
Allow group prowler-users to read audit-events in tenancy
Allow group prowler-users to read cloud-guard-config in tenancy
Allow group prowler-users to read cloud-guard-problems in tenancy
Allow group prowler-users to read cloud-guard-targets in tenancy
```

#### Service-Specific Permissions

For more granular control, you can grant specific permissions:

```
# Identity
Allow group prowler-users to inspect users in tenancy
Allow group prowler-users to inspect groups in tenancy
Allow group prowler-users to inspect policies in tenancy
Allow group prowler-users to inspect authentication-policies in tenancy
Allow group prowler-users to inspect dynamic-groups in tenancy

# Networking
Allow group prowler-users to inspect vcns in tenancy
Allow group prowler-users to inspect subnets in tenancy
Allow group prowler-users to inspect security-lists in tenancy
Allow group prowler-users to inspect network-security-groups in tenancy
Allow group prowler-users to inspect route-tables in tenancy
Allow group prowler-users to inspect dhcp-options in tenancy
Allow group prowler-users to inspect internet-gateways in tenancy
Allow group prowler-users to inspect nat-gateways in tenancy
Allow group prowler-users to inspect service-gateways in tenancy

# Compute
Allow group prowler-users to inspect instances in tenancy
Allow group prowler-users to inspect instance-configurations in tenancy
Allow group prowler-users to inspect boot-volumes in tenancy
Allow group prowler-users to inspect volume-attachments in tenancy

# Storage
Allow group prowler-users to inspect buckets in tenancy
Allow group prowler-users to inspect volumes in tenancy
Allow group prowler-users to inspect file-systems in tenancy

# Database
Allow group prowler-users to inspect autonomous-databases in tenancy
Allow group prowler-users to inspect db-systems in tenancy

# Keys Management
Allow group prowler-users to inspect vaults in tenancy
Allow group prowler-users to inspect keys in tenancy

# Monitoring & Events
Allow group prowler-users to read metrics in tenancy
Allow group prowler-users to inspect alarms in tenancy
Allow group prowler-users to inspect ons-topics in tenancy
Allow group prowler-users to inspect ons-subscriptions in tenancy
Allow group prowler-users to inspect rules in tenancy
```

### Output Formats

Prowler supports multiple output formats for OCI:

#### JSON
```bash
prowler oci --output-formats json
```

#### CSV
```bash
prowler oci --output-formats csv
```

#### HTML
```bash
prowler oci --output-formats html
```

#### Multiple Formats
```bash
prowler oci --output-formats json csv html
```

### Common Scenarios

#### Security Assessment

Full security assessment with CIS compliance:

```bash
prowler oci \
  --compliance cis_3.0_oci \
  --output-formats json html \
  --output-directory ./oci-assessment-$(date +%Y%m%d)
```

#### Continuous Monitoring

Run specific security-critical checks:

```bash
prowler oci \
  --check identity_user_mfa_enabled_console_access \
         network_security_list_ingress_from_internet_to_ssh_port \
         objectstorage_bucket_not_publicly_accessible \
  --output-formats json
```

#### Compartment-Specific Audit

Audit a specific project compartment:

```bash
prowler oci \
  --compartment-id ocid1.compartment.oc1..projecta \
  --profile production \
  --region us-ashburn-1
```

### Troubleshooting

#### Authentication Issues

**Error: "Could not find a valid config file"**
- Ensure `~/.oci/config` exists and is properly formatted
- Verify the path to your API key is correct
- Check file permissions: `chmod 600 ~/.oci/config ~/.oci/oci_api_key.pem`

**Error: "Invalid key or signature"**
- Verify the API key fingerprint matches the one in OCI Console
- Ensure the public key is uploaded to your OCI user account
- Check that the private key file is accessible

#### Permission Issues

**Error: "Authorization failed or requested resource not found"**
- Verify your user has the required policies (see [Required Permissions](#required-permissions))
- Check that policies apply to the correct compartments
- Ensure policies are not restricted by conditions that exclude your user

#### Region Issues

**Error: "Invalid region"**
- Check available regions: `prowler oci --list-regions`
- Verify your tenancy is subscribed to the region
- Use the region identifier (e.g., `us-ashburn-1`), not the display name

### Advanced Usage

#### Using Mutelist

Create a mutelist file to suppress specific findings:

```yaml
# oci-mutelist.yaml
Tenancies:
  - "ocid1.tenancy.oc1..example":
      Checks:
        "identity_password_policy_*":
          Regions:
            - "us-ashburn-1"
          Resources:
            - "ocid1.user.oc1..example"
```

Run with mutelist:

```bash
prowler oci --mutelist-file oci-mutelist.yaml
```

#### Custom Checks Metadata

Override check metadata:

```yaml
# custom-metadata.yaml
identity_user_mfa_enabled_console_access:
  Severity: critical
  CheckTitle: "Custom: Ensure MFA is enabled for all console users"
```

Run with custom metadata:

```bash
prowler oci --custom-checks-metadata-file custom-metadata.yaml
```

#### Filtering by Status

Only show failed checks:

```bash
prowler oci --status FAIL
```

#### Filtering by Severity

Only show critical and high severity findings:

```bash
prowler oci --severity critical high
```

### Next Steps

- Learn about [Compliance Frameworks](/user-guide/cli/tutorials/compliance) in Prowler
- Review [Prowler Output Formats](/user-guide/cli/tutorials/reporting)
- Explore [Integrations](/user-guide/cli/tutorials/integrations) with SIEM and ticketing systems

### Additional Resources

- [OCI Documentation](https://docs.oracle.com/en-us/iaas/Content/home.htm)
- [CIS OCI Foundations Benchmark](https://www.cisecurity.org/benchmark/oracle_cloud)
- [Prowler Documentation](https://docs.prowler.com)
- [Prowler GitHub](https://github.com/prowler-cloud/prowler)
