Object Storage bucket uses a customer-managed key

Check ID: objectstorage_bucket_encrypted_with_cmk
Provider: Oracle Cloud (OCI)
Service: objectstorage
Severity: MEDIUM
Categories: encryption
Resource type: Bucket

What this check verifies

OCI Object Storage buckets use customer-managed encryption keys (CMEK) for server-side encryption, with an associated KMS key configured on the bucket.

Risk

Without CMEK, encryption relies on provider-managed keys, reducing control over confidentiality and key lifecycle. You cannot strictly limit key usage, enforce custom rotation, or revoke keys for crypto-erasure, increasing exposure to unauthorized decryption, data exfiltration, and auditability gaps.

Recommendation

Encrypt buckets with CMEK. Apply least privilege to key usage, enforce separation of duties between key and storage admins, mandate regular rotation, and monitor key access. Use defense in depth so encryption complements strict IAM and network controls rather than replacing them.

Remediation

CLI
Terraform
Dashboard steps

oci os bucket update —namespace-name <NAMESPACE> —bucket-name <BUCKET_NAME> —kms-key-id <KEY_OCID>

resource "oci_objectstorage_bucket" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  name           = "<example_resource_name>"
  namespace      = "<example_resource_name>"

  kms_key_id = "<example_resource_id>" # Critical: sets the Customer Managed Key to encrypt the bucket
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = objectstorage_bucket_encrypted_with_cmk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Subnet has VCN flow logging enabled Object Storage bucket has write-level logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires