Services in this catalog
- analytics - 1 checks
- audit - 1 checks
- blockstorage - 2 checks
- cloudguard - 1 checks
- compute - 3 checks
- database - 1 checks
- events - 13 checks
- filestorage - 1 checks
- identity - 16 checks
- integration - 1 checks
- kms - 1 checks
- network - 6 checks
- objectstorage - 4 checks
analytics
1 checks.| Check ID | Title | Severity |
|---|---|---|
analytics_instance_access_restricted | Oracle Analytics Cloud instance is deployed within a Virtual Cloud Network or restricts public access to allow… | HIGH |
audit
1 checks.| Check ID | Title | Severity |
|---|---|---|
audit_log_retention_period_365_days | Tenancy audit log retention period is 365 days or greater | MEDIUM |
blockstorage
2 checks.| Check ID | Title | Severity |
|---|---|---|
blockstorage_block_volume_encrypted_with_cmk | Block volume is encrypted with a Customer Managed Key (CMK) | MEDIUM |
blockstorage_boot_volume_encrypted_with_cmk | Boot volume is encrypted with Customer Managed Key | MEDIUM |
cloudguard
1 checks.| Check ID | Title | Severity |
|---|---|---|
cloudguard_enabled | Cloud Guard is enabled in the root compartment of the tenancy | HIGH |
compute
3 checks.| Check ID | Title | Severity |
|---|---|---|
compute_instance_in_transit_encryption_enabled | Compute instance has in-transit encryption enabled | HIGH |
compute_instance_legacy_metadata_endpoint_disabled | Compute instance legacy metadata service endpoint is disabled | HIGH |
compute_instance_secure_boot_enabled | Compute instance has Secure Boot enabled | MEDIUM |
database
1 checks.| Check ID | Title | Severity |
|---|---|---|
database_autonomous_database_access_restricted | Autonomous Shared Database (ADB) is deployed within a VCN or restricts public access with whitelisted IPs excl… | HIGH |
events
13 checks.| Check ID | Title | Severity |
|---|---|---|
events_notification_topic_and_subscription_exists | Tenancy has at least one notification topic with active subscriptions | HIGH |
events_rule_cloudguard_problems | Event rule monitoring Cloud Guard problems has notification actions configured | HIGH |
events_rule_iam_group_changes | Event rule monitoring IAM group changes has notification actions configured | HIGH |
events_rule_iam_policy_changes | Event rule monitoring IAM policy changes has notification actions configured | HIGH |
events_rule_identity_provider_changes | Event rule for identity provider changes has notification actions configured | HIGH |
events_rule_idp_group_mapping_changes | Event rule for IdP group mapping changes has notification actions configured | HIGH |
events_rule_local_user_authentication | Event rule monitoring local OCI user authentication has notification actions configured | MEDIUM |
events_rule_network_gateway_changes | Event rule monitoring network gateway changes has notification actions configured | HIGH |
events_rule_network_security_group_changes | Event rule monitoring network security group changes has notification actions configured | MEDIUM |
events_rule_route_table_changes | Event rule for route table changes has notification actions configured | HIGH |
events_rule_security_list_changes | Event rule monitoring security list changes has notification actions configured | HIGH |
events_rule_user_changes | Event rule monitoring user changes has notification actions configured | HIGH |
events_rule_vcn_changes | Event rule monitoring VCN changes has notification actions configured | MEDIUM |
filestorage
1 checks.| Check ID | Title | Severity |
|---|---|---|
filestorage_file_system_encrypted_with_cmk | File Storage file system is encrypted with a customer-managed KMS key | MEDIUM |
identity
16 checks.| Check ID | Title | Severity |
|---|---|---|
identity_iam_admins_cannot_update_tenancy_admins | All IAM policies granting manage/use on groups or users in the tenancy restrict access to the Administrators g… | CRITICAL |
identity_instance_principal_used | Instance principal authentication is configured for OCI instances, OCI Cloud Databases, and OCI Functions | MEDIUM |
identity_no_resources_in_root_compartment | No resources exist in the root compartment | HIGH |
identity_non_root_compartment_exists | Tenancy has at least one active non-root compartment | HIGH |
identity_password_policy_expires_within_365_days | Identity Domain password policy expires passwords within 365 days | MEDIUM |
identity_password_policy_minimum_length_14 | IAM password policy requires passwords to be at least 14 characters long | HIGH |
identity_password_policy_prevents_reuse | Identity Domain password policy prevents password reuse by remembering at least 24 previous passwords | MEDIUM |
identity_service_level_admins_exist | Identity policy does not grant broad ‘manage all-resources’ permissions | HIGH |
identity_tenancy_admin_permissions_limited | OCI IAM policy does not grant ‘manage all-resources in tenancy’ unless it is the Tenant Admin Policy | CRITICAL |
identity_tenancy_admin_users_no_api_keys | Tenancy administrator user has no API keys | HIGH |
identity_user_api_keys_rotated_90_days | User active API key is rotated within 90 days or less | MEDIUM |
identity_user_auth_tokens_rotated_90_days | User auth token age is 90 days or less | MEDIUM |
identity_user_customer_secret_keys_rotated_90_days | User customer secret key is rotated within 90 days or less | MEDIUM |
identity_user_db_passwords_rotated_90_days | User IAM database password was created within the last 90 days | MEDIUM |
identity_user_mfa_enabled_console_access | User with console password has MFA enabled for console access | HIGH |
identity_user_valid_email_address | IAM user has a valid email address | LOW |
integration
1 checks.| Check ID | Title | Severity |
|---|---|---|
integration_instance_access_restricted | Integration Cloud instance uses a private endpoint or a public endpoint with IP or VCN allowlists | HIGH |
kms
1 checks.| Check ID | Title | Severity |
|---|---|---|
kms_key_rotation_enabled | Customer-managed KMS key has rotation enabled with interval of 365 days or less | HIGH |
network
6 checks.| Check ID | Title | Severity |
|---|---|---|
network_default_security_list_restricts_traffic | Default security list restricts all traffic except ICMP within VCN | HIGH |
network_security_group_ingress_from_internet_to_rdp_port | Network security group restricts ingress from 0.0.0.0/0 to port 3389 (RDP) | HIGH |
network_security_group_ingress_from_internet_to_ssh_port | Network security group restricts ingress from 0.0.0.0/0 to port 22 (SSH) | HIGH |
network_security_list_ingress_from_internet_to_rdp_port | Security list restricts ingress from 0.0.0.0/0 to port 3389 (RDP) | HIGH |
network_security_list_ingress_from_internet_to_ssh_port | Security list restricts ingress from 0.0.0.0/0 to port 22 (SSH) | HIGH |
network_vcn_subnet_flow_logs_enabled | Subnet has VCN flow logging enabled | MEDIUM |
objectstorage
4 checks.| Check ID | Title | Severity |
|---|---|---|
objectstorage_bucket_encrypted_with_cmk | Object Storage bucket is encrypted with a Customer Managed Key (CMK) | MEDIUM |
objectstorage_bucket_logging_enabled | Object Storage bucket has write-level logging enabled | MEDIUM |
objectstorage_bucket_not_publicly_accessible | Object Storage bucket is not publicly accessible | CRITICAL |
objectstorage_bucket_versioning_enabled | Object Storage bucket has versioning enabled | MEDIUM |
What’s next
Cloud Security overview
Connect a provider, see findings end-to-end.
All checks
Index across every provider.
Compliance frameworks
How check IDs map to SOC 2 / PCI / HIPAA / ISO controls.
Reports
Per-framework PDF scorecards.