Checks
52 articles
- Ensure Cloud Guard is enabled in the root compartment of the tenancy
- Ensure user IAM database password was created within the last 90 days
- Ensure OCI IAM policy does not grant 'manage all-resources in tenancy' unless it is the Tenant Admin Policy
- Ensure user auth token age is 90 days or less
- Ensure IAM password policy requires passwords to be at least 14 characters long
- Ensure tenancy administrator user has no API keys
- Ensure IAM user has a valid email address
- Ensure OCI IAM storage service-level admin policies exclude delete permissions
- Ensure user active API key is rotated within 90 days or less
- Ensure Identity Domain password policy prevents password reuse by remembering at least 24 previous passwords
- Ensure all IAM policies granting manage/use on groups or users in the tenancy restrict access to the Administrators group
- Ensure no resources exist in the root compartment
- Ensure identity policy does not grant broad 'manage all-resources' permissions
- Ensure user with console password has MFA enabled for console access
- Ensure Identity Domain password policy expires passwords within 365 days
- Ensure tenancy has at least one active non-root compartment
- Ensure user customer secret key is rotated within 90 days or less
- Ensure instance principal authentication is configured for OCI instances, OCI Cloud Databases, and OCI Functions
- Ensure customer-managed KMS key has rotation enabled with interval of 365 days or less
- Ensure security list restricts ingress from 0.0.0.0/0 to port 22 (SSH)
- Ensure network security group restricts ingress from 0.0.0.0/0 to port 3389 (RDP)
- Ensure security list restricts ingress from 0.0.0.0/0 to port 3389 (RDP)
- Ensure subnet has VCN flow logging enabled
- Ensure default security list restricts all traffic except ICMP within VCN
- Ensure network security group restricts ingress from 0.0.0.0/0 to port 22 (SSH)
- Ensure tenancy audit log retention period is 365 days or greater
- Ensure compute instance legacy metadata service endpoint is disabled
- Ensure compute instance has in-transit encryption enabled
- Ensure compute instance has Secure Boot enabled
- Ensure Object Storage bucket has write-level logging enabled
- Ensure Object Storage bucket is not publicly accessible
- Ensure Object Storage bucket is encrypted with a Customer Managed Key (CMK)
- Ensure Object Storage bucket has versioning enabled
- Ensure File Storage file system is encrypted with a customer-managed KMS key
- Ensure boot volume is encrypted with Customer Managed Key
- Ensure block volume is encrypted with a Customer Managed Key (CMK)
- Ensure Oracle Analytics Cloud instance is deployed within a Virtual Cloud Network or restricts public access to allowed sources
- Ensure event rule monitoring security list changes has notification actions configured
- Ensure event rule monitoring IAM group changes has notification actions configured
- Ensure event rule monitoring local OCI user authentication has notification actions configured
- Ensure event rule monitoring VCN changes has notification actions configured
- Ensure event rule monitoring Cloud Guard problems has notification actions configured
- Ensure event rule for identity provider changes has notification actions configured
- Ensure event rule monitoring network security group changes has notification actions configured
- Ensure event rule monitoring network gateway changes has notification actions configured
- Ensure event rule monitoring IAM policy changes has notification actions configured
- Ensure event rule for route table changes has notification actions configured
- Ensure tenancy has at least one notification topic with active subscriptions
- Ensure event rule monitoring user changes has notification actions configured
- Ensure event rule for IdP group mapping changes has notification actions configured
- Ensure Integration Cloud instance uses a private endpoint or a public endpoint with IP or VCN allowlists
- Ensure Autonomous Shared Database (ADB) is deployed within a VCN or restricts public access with whitelisted IPs excluding 0.0.0.0/0