Description

Ensure Oracle Cloud Guard is enabled with the root compartment of the tenancy as its target, so that every compartment below it is monitored. Cloud Guard continuously checks resources against detector recipes, finds misconfigurations and suspicious activity, and reports them as problems that can be investigated or fixed automatically.

Rationale

Without Cloud Guard, misconfigurations such as public buckets, open security lists, or risky IAM changes can go unnoticed for a long time. Enabling it at the root compartment makes sure all current and future compartments are covered, instead of relying on each team to turn monitoring on. This gives the security team one central view of risk across the whole tenancy.

Impact

  • All compartments in the tenancy are monitored for security issues

  • Misconfigurations and threats are reported as Cloud Guard problems

  • Requires a Cloud Guard policy and a reporting region

Default Value

By default, Cloud Guard is not enabled for a new tenancy.

Pre-Requisites

  • Tenancy administrator access (member of the Administrators group)

  • A chosen reporting region for Cloud Guard

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and select Cloud Guard.

  3. If a Get started or Enable Cloud Guard page is shown, Cloud Guard is not enabled.

  4. If the Overview dashboard is shown, open Configuration > Targets and verify that a target exists for the root compartment.

  5. Alternatively, run: oci cloud-guard configuration get --compartment-id <tenancy-ocid> and confirm the status is ENABLED.

  6. If Cloud Guard is not enabled or the root compartment is not a target, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and select Cloud Guard.

  3. Select Enable Cloud Guard.

  4. Review the Cloud Guard access policy and select Create policy.

  5. Select the reporting region and the root compartment as the target, keep the Oracle-managed detector recipes, and select Enable.

  6. Confirm that the Overview dashboard loads and that the root compartment appears under Targets.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and select Cloud Guard.

  3. Open Settings, select Disable Cloud Guard, and confirm.

Reference