mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 13:01:56 +00:00
chore(oraclecloud): enhance metadata for blockstorage service (#9222)
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com>
This commit is contained in:
Rubén De la Torre Vico
committed by
GitHub
GitHub
parent
8ee9454dbc
commit
eab6c23333
@@ -47,6 +47,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
|
||||
- Update AWS CodeArtifact service metadata to new format [(#8850)](https://github.com/prowler-cloud/prowler/pull/8850)
|
||||
- Rename OCI provider to oraclecloud with oci alias [(#9126)](https://github.com/prowler-cloud/prowler/pull/9126)
|
||||
- Remove unnecessary tests for M365_PowerShell module [(#9204)](https://github.com/prowler-cloud/prowler/pull/9204)
|
||||
- Update oraclecloud blockstorage service metadata to new format [(#9222)](https://github.com/prowler-cloud/prowler/pull/9222)
|
||||
- Update oraclecloud audit service metadata to new format [(#9221)](https://github.com/prowler-cloud/prowler/pull/9221)
|
||||
|
||||
|
||||
|
||||
+16
-18
@@ -1,35 +1,33 @@
|
||||
{
|
||||
"Provider": "oraclecloud",
|
||||
"CheckID": "blockstorage_block_volume_encrypted_with_cmk",
|
||||
"CheckTitle": "Ensure Block Volumes are encrypted with Customer Managed Keys",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS OCI Foundations Benchmark"
|
||||
],
|
||||
"CheckTitle": "Block volume is encrypted with a Customer Managed Key (CMK)",
|
||||
"CheckType": [],
|
||||
"ServiceName": "blockstorage",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "oci:blockstorage:volume",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "OciBlockVolume",
|
||||
"Description": "Block volumes should be encrypted with Customer Managed Keys (CMK) for enhanced security and control over encryption keys.",
|
||||
"Risk": "Using Oracle-managed encryption keys instead of Customer Managed Keys reduces control over encryption key lifecycle and access policies.",
|
||||
"RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Block/Concepts/overview.htm",
|
||||
"ResourceType": "Volume",
|
||||
"Description": "**OCI block volumes** use **Customer-Managed Keys** (`CMK`) from Vault for at-rest encryption instead of Oracle-managed keys.\n\nIdentifies whether a block volume has a customer-managed key associated for its encryption.",
|
||||
"Risk": "Without **CMK**, encryption key control is limited, impacting confidentiality and auditability:\n- No rapid key disable/rotation to contain breaches\n- Weaker restrictions and visibility on decrypt operations\nThis can prolong unauthorized data access and hinder incident response and compliance.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://docs.oracle.com/en-us/iaas/Content/Block/Concepts/overview.htm"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "oci bv volume create --compartment-id <compartment-ocid> --availability-domain <ad> --kms-key-id <kms-key-ocid>",
|
||||
"CLI": "oci bv volume update --volume-id <VOLUME_OCID> --kms-key-id <KMS_KEY_OCID>",
|
||||
"NativeIaC": "",
|
||||
"Other": "1. Navigate to Block Storage > Block Volumes\n2. Create a new volume or update existing\n3. Under 'Encryption', select 'Encrypt using customer-managed keys'\n4. Select the KMS vault and key\n5. Click 'Create' or 'Save Changes'",
|
||||
"Terraform": "resource \"oci_core_volume\" \"example\" {\n compartment_id = var.compartment_id\n availability_domain = var.availability_domain\n kms_key_id = var.kms_key_id\n}"
|
||||
"Other": "1. In the OCI Console, go to Block Storage > Block Volumes\n2. Open the failing volume\n3. Click Edit\n4. Under Encryption, select \"Encrypt using customer-managed keys\" and choose the vault key\n5. Click Save changes",
|
||||
"Terraform": "```hcl\nresource \"oci_core_volume\" \"<example_resource_name>\" {\n compartment_id = \"<example_resource_id>\"\n availability_domain = \"<example_resource_name>\"\n size_in_gbs = 50\n\n kms_key_id = \"<example_resource_id>\" # Critical: uses a Customer Managed Key to encrypt the volume\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Encrypt all block volumes with Customer Managed Keys for better security control.",
|
||||
"Url": "https://hub.prowler.com/check/oci/blockstorage_block_volume_encrypted_with_cmk"
|
||||
"Text": "Use **Customer-Managed Keys** in Vault for all block volumes.\n- Enforce least privilege and separation of duties on key usage\n- Rotate keys regularly and monitor KMS events\n- Validate that key disable/deny revokes data access\nApply the same controls to snapshots and backups.",
|
||||
"Url": "https://hub.prowler.com/check/blockstorage_block_volume_encrypted_with_cmk"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"encryption",
|
||||
"storage"
|
||||
"encryption"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
+17
-17
@@ -1,34 +1,34 @@
|
||||
{
|
||||
"Provider": "oraclecloud",
|
||||
"CheckID": "blockstorage_boot_volume_encrypted_with_cmk",
|
||||
"CheckTitle": "Ensure Boot Volumes are encrypted with Customer Managed Key",
|
||||
"CheckType": [
|
||||
"Software and Configuration Checks",
|
||||
"Industry and Regulatory Standards",
|
||||
"CIS OCI Foundations Benchmark"
|
||||
],
|
||||
"CheckTitle": "Boot volume is encrypted with Customer Managed Key",
|
||||
"CheckType": [],
|
||||
"ServiceName": "blockstorage",
|
||||
"SubServiceName": "",
|
||||
"ResourceIdTemplate": "oci:blockstorage:resource",
|
||||
"ResourceIdTemplate": "",
|
||||
"Severity": "medium",
|
||||
"ResourceType": "OciBlockstorageResource",
|
||||
"Description": "Boot volumes should be encrypted with Customer Managed Keys (CMK) for enhanced security and control over encryption keys.",
|
||||
"Risk": "Not meeting this requirement increases security risk.",
|
||||
"RelatedUrl": "https://docs.oracle.com/en-us/iaas/",
|
||||
"ResourceType": "BootVolume",
|
||||
"Description": "Boot volumes use **customer-managed keys (CMEK)** when a Vault key is assigned (`kms_key_id` present), rather than default Oracle-managed encryption.",
|
||||
"Risk": "Without **CMEK**, control over encryption is limited: you cannot rapidly disable or rotate keys to contain compromise, weakening **confidentiality** of boot data and backups. Provider-managed keys reduce **separation of duties** and **auditability**, hindering incident response and compliance for sensitive systems.",
|
||||
"RelatedUrl": "",
|
||||
"AdditionalURLs": [
|
||||
"https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-BlockVolume/block-volumes-encrypted-with-cmks.html",
|
||||
"https://docs.public.content.oci.oraclecloud.com/en-us/iaas/Content/Block/Concepts/managingblockencryptionkeys.htm"
|
||||
],
|
||||
"Remediation": {
|
||||
"Code": {
|
||||
"CLI": "",
|
||||
"CLI": "oci bv boot-volume update --boot-volume-id <example_resource_id> --kms-key-id <example_resource_id>",
|
||||
"NativeIaC": "",
|
||||
"Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-BlockVolume/block-volumes-encrypted-with-cmks.html",
|
||||
"Terraform": ""
|
||||
"Other": "1. In the OCI Console, go to Storage > Block Storage > Boot Volumes\n2. Click the boot volume name\n3. Click Edit (or Assign master encryption key)\n4. Select a Customer-managed key from Vault\n5. Click Save",
|
||||
"Terraform": "```hcl\nresource \"oci_core_boot_volume_kms_key\" \"<example_resource_name>\" {\n boot_volume_id = \"<example_resource_id>\" # Critical: target boot volume to update\n kms_key_id = \"<example_resource_id>\" # Critical: assigns a Customer Managed Key (CMK) to the boot volume\n}\n```"
|
||||
},
|
||||
"Recommendation": {
|
||||
"Text": "Ensure Boot Volumes are encrypted with Customer Managed Key",
|
||||
"Url": "https://hub.prowler.com/check/oci/blockstorage_boot_volume_encrypted_with_cmk"
|
||||
"Text": "Encrypt boot volumes with **customer-managed keys** and enforce **least privilege** on key usage. Define a key lifecycle (new keys for rotation), monitor and audit key access, and restrict key scope to required compartments and services to achieve **defense in depth** and rapid revocation when needed.",
|
||||
"Url": "https://hub.prowler.com/check/blockstorage_boot_volume_encrypted_with_cmk"
|
||||
}
|
||||
},
|
||||
"Categories": [
|
||||
"security-configuration"
|
||||
"encryption"
|
||||
],
|
||||
"DependsOn": [],
|
||||
"RelatedTo": [],
|
||||
|
||||
Reference in New Issue
Block a user