diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index fe76020cdb..58c6bcef24 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -47,6 +47,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS CodeArtifact service metadata to new format [(#8850)](https://github.com/prowler-cloud/prowler/pull/8850) - Rename OCI provider to oraclecloud with oci alias [(#9126)](https://github.com/prowler-cloud/prowler/pull/9126) - Remove unnecessary tests for M365_PowerShell module [(#9204)](https://github.com/prowler-cloud/prowler/pull/9204) +- Update oraclecloud blockstorage service metadata to new format [(#9222)](https://github.com/prowler-cloud/prowler/pull/9222) - Update oraclecloud audit service metadata to new format [(#9221)](https://github.com/prowler-cloud/prowler/pull/9221) diff --git a/prowler/providers/oraclecloud/services/blockstorage/blockstorage_block_volume_encrypted_with_cmk/blockstorage_block_volume_encrypted_with_cmk.metadata.json b/prowler/providers/oraclecloud/services/blockstorage/blockstorage_block_volume_encrypted_with_cmk/blockstorage_block_volume_encrypted_with_cmk.metadata.json index 741f9f731c..9b0639a49e 100644 --- a/prowler/providers/oraclecloud/services/blockstorage/blockstorage_block_volume_encrypted_with_cmk/blockstorage_block_volume_encrypted_with_cmk.metadata.json +++ b/prowler/providers/oraclecloud/services/blockstorage/blockstorage_block_volume_encrypted_with_cmk/blockstorage_block_volume_encrypted_with_cmk.metadata.json @@ -1,35 +1,33 @@ { "Provider": "oraclecloud", "CheckID": "blockstorage_block_volume_encrypted_with_cmk", - "CheckTitle": "Ensure Block Volumes are encrypted with Customer Managed Keys", - "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS OCI Foundations Benchmark" - ], + "CheckTitle": "Block volume is encrypted with a Customer Managed Key (CMK)", + "CheckType": [], "ServiceName": "blockstorage", "SubServiceName": "", - "ResourceIdTemplate": "oci:blockstorage:volume", + "ResourceIdTemplate": "", "Severity": "medium", - "ResourceType": "OciBlockVolume", - "Description": "Block volumes should be encrypted with Customer Managed Keys (CMK) for enhanced security and control over encryption keys.", - "Risk": "Using Oracle-managed encryption keys instead of Customer Managed Keys reduces control over encryption key lifecycle and access policies.", - "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Block/Concepts/overview.htm", + "ResourceType": "Volume", + "Description": "**OCI block volumes** use **Customer-Managed Keys** (`CMK`) from Vault for at-rest encryption instead of Oracle-managed keys.\n\nIdentifies whether a block volume has a customer-managed key associated for its encryption.", + "Risk": "Without **CMK**, encryption key control is limited, impacting confidentiality and auditability:\n- No rapid key disable/rotation to contain breaches\n- Weaker restrictions and visibility on decrypt operations\nThis can prolong unauthorized data access and hinder incident response and compliance.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.oracle.com/en-us/iaas/Content/Block/Concepts/overview.htm" + ], "Remediation": { "Code": { - "CLI": "oci bv volume create --compartment-id --availability-domain --kms-key-id ", + "CLI": "oci bv volume update --volume-id --kms-key-id ", "NativeIaC": "", - "Other": "1. Navigate to Block Storage > Block Volumes\n2. Create a new volume or update existing\n3. Under 'Encryption', select 'Encrypt using customer-managed keys'\n4. Select the KMS vault and key\n5. Click 'Create' or 'Save Changes'", - "Terraform": "resource \"oci_core_volume\" \"example\" {\n compartment_id = var.compartment_id\n availability_domain = var.availability_domain\n kms_key_id = var.kms_key_id\n}" + "Other": "1. In the OCI Console, go to Block Storage > Block Volumes\n2. Open the failing volume\n3. Click Edit\n4. Under Encryption, select \"Encrypt using customer-managed keys\" and choose the vault key\n5. Click Save changes", + "Terraform": "```hcl\nresource \"oci_core_volume\" \"\" {\n compartment_id = \"\"\n availability_domain = \"\"\n size_in_gbs = 50\n\n kms_key_id = \"\" # Critical: uses a Customer Managed Key to encrypt the volume\n}\n```" }, "Recommendation": { - "Text": "Encrypt all block volumes with Customer Managed Keys for better security control.", - "Url": "https://hub.prowler.com/check/oci/blockstorage_block_volume_encrypted_with_cmk" + "Text": "Use **Customer-Managed Keys** in Vault for all block volumes.\n- Enforce least privilege and separation of duties on key usage\n- Rotate keys regularly and monitor KMS events\n- Validate that key disable/deny revokes data access\nApply the same controls to snapshots and backups.", + "Url": "https://hub.prowler.com/check/blockstorage_block_volume_encrypted_with_cmk" } }, "Categories": [ - "encryption", - "storage" + "encryption" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/oraclecloud/services/blockstorage/blockstorage_boot_volume_encrypted_with_cmk/blockstorage_boot_volume_encrypted_with_cmk.metadata.json b/prowler/providers/oraclecloud/services/blockstorage/blockstorage_boot_volume_encrypted_with_cmk/blockstorage_boot_volume_encrypted_with_cmk.metadata.json index 638ce51d01..0a804abb87 100644 --- a/prowler/providers/oraclecloud/services/blockstorage/blockstorage_boot_volume_encrypted_with_cmk/blockstorage_boot_volume_encrypted_with_cmk.metadata.json +++ b/prowler/providers/oraclecloud/services/blockstorage/blockstorage_boot_volume_encrypted_with_cmk/blockstorage_boot_volume_encrypted_with_cmk.metadata.json @@ -1,34 +1,34 @@ { "Provider": "oraclecloud", "CheckID": "blockstorage_boot_volume_encrypted_with_cmk", - "CheckTitle": "Ensure Boot Volumes are encrypted with Customer Managed Key", - "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS OCI Foundations Benchmark" - ], + "CheckTitle": "Boot volume is encrypted with Customer Managed Key", + "CheckType": [], "ServiceName": "blockstorage", "SubServiceName": "", - "ResourceIdTemplate": "oci:blockstorage:resource", + "ResourceIdTemplate": "", "Severity": "medium", - "ResourceType": "OciBlockstorageResource", - "Description": "Boot volumes should be encrypted with Customer Managed Keys (CMK) for enhanced security and control over encryption keys.", - "Risk": "Not meeting this requirement increases security risk.", - "RelatedUrl": "https://docs.oracle.com/en-us/iaas/", + "ResourceType": "BootVolume", + "Description": "Boot volumes use **customer-managed keys (CMEK)** when a Vault key is assigned (`kms_key_id` present), rather than default Oracle-managed encryption.", + "Risk": "Without **CMEK**, control over encryption is limited: you cannot rapidly disable or rotate keys to contain compromise, weakening **confidentiality** of boot data and backups. Provider-managed keys reduce **separation of duties** and **auditability**, hindering incident response and compliance for sensitive systems.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-BlockVolume/block-volumes-encrypted-with-cmks.html", + "https://docs.public.content.oci.oraclecloud.com/en-us/iaas/Content/Block/Concepts/managingblockencryptionkeys.htm" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "oci bv boot-volume update --boot-volume-id --kms-key-id ", "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-BlockVolume/block-volumes-encrypted-with-cmks.html", - "Terraform": "" + "Other": "1. In the OCI Console, go to Storage > Block Storage > Boot Volumes\n2. Click the boot volume name\n3. Click Edit (or Assign master encryption key)\n4. Select a Customer-managed key from Vault\n5. Click Save", + "Terraform": "```hcl\nresource \"oci_core_boot_volume_kms_key\" \"\" {\n boot_volume_id = \"\" # Critical: target boot volume to update\n kms_key_id = \"\" # Critical: assigns a Customer Managed Key (CMK) to the boot volume\n}\n```" }, "Recommendation": { - "Text": "Ensure Boot Volumes are encrypted with Customer Managed Key", - "Url": "https://hub.prowler.com/check/oci/blockstorage_boot_volume_encrypted_with_cmk" + "Text": "Encrypt boot volumes with **customer-managed keys** and enforce **least privilege** on key usage. Define a key lifecycle (new keys for rotation), monitor and audit key access, and restrict key scope to required compartments and services to achieve **defense in depth** and rapid revocation when needed.", + "Url": "https://hub.prowler.com/check/blockstorage_boot_volume_encrypted_with_cmk" } }, "Categories": [ - "security-configuration" + "encryption" ], "DependsOn": [], "RelatedTo": [],