Check ID:
Provider: Oracle Cloud (OCI)
Service:
Severity: MEDIUM
Categories:
Resource type:
blockstorage_boot_volume_encrypted_with_cmkProvider: Oracle Cloud (OCI)
Service:
blockstorageSeverity: MEDIUM
Categories:
encryptionResource type:
BootVolumeWhat this check verifies
Boot volumes use customer-managed keys (CMEK) when a Vault key is assigned (kms_key_id present), rather than default Oracle-managed encryption.
Risk
Without CMEK, control over encryption is limited: you cannot rapidly disable or rotate keys to contain compromise, weakening confidentiality of boot data and backups. Provider-managed keys reduce separation of duties and auditability, hindering incident response and compliance for sensitive systems.Recommendation
Encrypt boot volumes with customer-managed keys and enforce least privilege on key usage. Define a key lifecycle (new keys for rotation), monitor and audit key access, and restrict key scope to required compartments and services to achieve defense in depth and rapid revocation when needed.Remediation
- CLI
- Terraform
- Dashboard steps
oci bv boot-volume update —boot-volume-id <example_resource_id> —kms-key-id <example_resource_id>
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-BlockVolume/block-volumes-encrypted-with-cmks.html
- https://docs.public.content.oci.oraclecloud.com/en-us/iaas/Content/Block/Concepts/managingblockencryptionkeys.htm
Where this check fires
This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable byCheck ID = blockstorage_boot_volume_encrypted_with_cmk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks