Check ID: compute_instance_secure_boot_enabled
Provider: Oracle Cloud (OCI)
Service: compute
Severity: MEDIUM
Categories: node-security
Resource type: Instance

​
What this check verifies

OCI compute instances have UEFI Secure Boot enabled so the platform firmware loads only trusted, signed bootloaders, kernels, and drivers at startup.

​
Risk

Without Secure Boot, unsigned or tampered boot code can run before the OS, enabling bootkits/rootkits to gain kernel-level persistence, bypass monitoring, alter logs, and exfiltrate secrets, eroding integrity and confidentiality, and risking availability through destructive changes or ransom staging.

​
Recommendation

Enable Secure Boot across instances and prefer shielded instances. Pair with TPM and Measured Boot where supported for defense in depth. Permit only trusted, signed kernels and drivers, and manage updates via hardened golden images and code signing. On Windows VMs, use Secure Boot with TPM and Measured Boot.

​
Remediation

resource "oci_core_instance" "example" {
  # ... other required configuration ...

  platform_config {
    type                   = "AMD_VM"
    is_secure_boot_enabled = true # Critical: enable Secure Boot to pass the check
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_instance_secure_boot_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks