Compute instance has in-transit encryption enabled

Check ID: compute_instance_in_transit_encryption_enabled
Provider: Oracle Cloud (OCI)
Service: compute
Severity: HIGH
Categories: encryption
Resource type: Instance

What this check verifies

OCI compute instances are evaluated for in-transit encryption on paravirtualized block or boot volume attachments, confirming that data exchanged between the instance and attached volumes is encrypted during transfer.

Risk

Without in-transit encryption, volume traffic can be inspected or altered on internal paths. A threat actor or compromised host could read sensitive data, inject corrupted blocks, or replay writes, undermining confidentiality and integrity, and risking availability through data corruption.

Recommendation

Enable in-transit encryption for all paravirtualized volume attachments and make it standard in golden images and IaC. Apply defense in depth with customer-managed keys and regular rotation. Periodically verify attachments and remediate drift so no instance communicates with volumes over unencrypted channels.

Remediation

CLI
Terraform
Dashboard steps

oci compute boot-volume-attachment update —boot-volume-attachment-id <boot-volume-attachment-ocid> —is-pv-encryption-in-transit-enabled true

resource "oci_core_instance" "<example_resource_name>" {
  # ... other required configuration ...
  launch_options {
    is_pv_encryption_in_transit_enabled = true  # Critical: enables in-transit encryption for paravirtualized attachments
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_in_transit_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Cloud Guard is enabled in the root compartment Compute instance legacy metadata endpoint is disabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires