File Storage file system uses a customer-managed key

Check ID: filestorage_file_system_encrypted_with_cmk
Provider: Oracle Cloud (OCI)
Service: filestorage
Severity: MEDIUM
Categories: encryption
Resource type: FileSystem

Risk

Using provider-managed keys limits control over key lifecycle and access, weakening confidentiality. You cannot enforce custom rotation, revoke use, or apply granular key permissions, increasing exposure to insider misuse, legal compulsion, or compromised services. It may hinder compliance and complicate incident response.

Recommendation

Encrypt file systems with Customer-Managed Keys in OCI KMS. Apply least privilege on key usage, enable periodic rotation, and require dual control for key administration. Monitor key activity with centralized logging. Use defense in depth by combining CMEK with network isolation and strong access governance.

Remediation

CLI
Terraform
Dashboard steps

oci fs file-system update —file-system-id <FILE_SYSTEM_OCID> —kms-key-id <KMS_KEY_OCID>

resource "oci_file_storage_file_system" "<example_resource_name>" {
  availability_domain = "<AVAILABILITY_DOMAIN>"
  compartment_id      = "<COMPARTMENT_OCID>"
  kms_key_id          = "<KMS_KEY_OCID>"  # Critical: associates a customer-managed KMS key to encrypt the file system
}

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = filestorage_file_system_encrypted_with_cmk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

File Storage file system uses a customer-managed key

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires