Best practice rules for Oracle Cloud Infrastructure

Oracle Cloud Infrastructure best practice rules

Trend Vision One™ has over 1100+ cloud infrastructure configuration best practices for your Oracle Cloud Infrastructure, Alibaba Cloud, Amazon Web Services, Microsoft® Azure, and Google Cloud™ environments. Here is our growing list of OCI security, configuration and compliance rules with clear instructions on how to perform the updates – made either through the OCI console or via the OCI Command Line Interface (CLI).

Trend Vision One™ provides real-time monitoring and auto-remediation for the security, compliance and governance of your cloud infrastructure. Leaving you to grow and scale your business with confidence.

OCI Block Volume
- Block Volumes Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Block Volume data.
- Boot Volumes Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Boot Volume data.
- Check for Volume Performance Units (VPUs)
  Ensure that OCI Block Volume VPUs are configured appropriately for workload requirements.
- Enable Cross-Region Volume Replication
  Enable ongoing automatic asynchronous replication of Block Volumes across OCI regions.
- Enable Performance-Based Autotuning for Block Volumes
  Ensure that performance-based autotuning is enabled for OCI Block Volumes.
- Enable Performance-Based Autotuning for Boot Volumes
  Ensure that performance-based autotuning is enabled for OCI Boot Volumes.
- Enable Scheduled Backups for Block Volumes
  Use backup policies to schedule backups for Block Volumes in Oracle Cloud Infrastructure (OCI).
OCI Cloud Guard
- Enable Cloud Guard
  Ensure that Cloud Guard is enabled for your OCI compartments.
OCI Compute
- Check for Public IP Address Exposure
  Avoid using public IP addresses for OCI compute instances unless it's necessary for business operations.
- Enable Cloud Guard Workload Protection
  Ensure that Cloud Guard Workload Protection feature is enabled for OCI compute instances.
- Enable Compute Instance Monitoring
  Ensure that compute instance monitoring is enabled for your OCI compute instances.
- Enable Custom Logs Monitoring
  Ensure that custom logs monitoring is enabled for your OCI compute instances.
- Enable In-Transit Encryption
  Ensure that encryption of data in transit is enabled for OCI compute instances.
- Enable OS Management Service for Compute Instances
  Ensure that OS Management Service is enabled for OCI compute instances.
- Enable Secure Boot for Compute Instances
  Ensure that Secure Boot is enabled for shielded Oracle Cloud Infrastructure (OCI) compute instances.
- Enable Vulnerability Scanning
  Ensure that the Vulnerability Scanning feature is enabled for OCI compute instances.
- Require IMDSv2 for Compute Instances
  Ensure that IMDSv2 is enforced for all Oracle Cloud Infrastructure (OCI) compute instances.
OCI Events
- Enable Notification Alerts for IAM Group Changes
  Ensure that IAM group changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for IAM Policy Changes
  Ensure that IAM policy configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for IAM User Changes
  Ensure that IAM user changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for IdP Group Mapping Changes
  Ensure that Identity Provider changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Identity Provider Changes
  Ensure that Identity Provider changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Local User Authentication
  Ensure that OCI local user authentication is being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Network Gateway Changes
  Ensure that network gateway configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Network Security Group Changes
  Ensure that network security group configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Problems Detected with Cloud Guard
  Ensure that changes to Cloud Guard issues are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Route Table Changes
  Ensure that route table configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Security List Changes
  Ensure that security list configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for VCN Changes
  Ensure that VCN changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
OCI File Storage
- Check Lustre File Systems for Cost Allocation Tags
  Ensure that OCI Lustre file systems have cost allocation tags for accurate cost allocation and budget tracking.
- Check for Availability Domain Alignment
  Ensure that OCI File Storage file systems should be placed in same availability domain as compute resources.
- Check for Clone Hydration Status
  Ensure that OCI file system clones are fully hydrated for production use.
- Check for Cost Allocation Tags
  Ensure that OCI File Storage systems have cost allocation tags for accurate cost allocation and budget tracking.
- Clone Parent Management
  Ensure that clone parent file systems without attached child clones are removed.
- Configure Snapshot Policy for File Systems
  Ensure that snapshot policies are configured for your OCI File Storage file systems.
- Enable File System Active Replication
  Ensure that active replication is enabled for your OCI File Storage systems.
- Enable Quota Enforcement
  Ensure that OCI File Storage quota enforcement is enabled for cost control.
- File Storage Systems Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI File Storage systems.
- Lustre File Systems Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Lustre file systems.
- Use Network Security Groups to Control Traffic to Lustre File Systems
  Ensure that your Lustre file systems are using Network Security Groups (NSGs) for traffic control.
- Use Resource Locking for File Systems
  Ensure that resource locking is enabled for your production OCI File Storage systems.
OCI IAM
- Check Tenancy Administrator Users for API Keys
  Ensure that API keys are not created for tenancy administrator users.
- Check for Admin-Only Resource Access
  Ensure that permissions on all OCI resources are given only to the "Administrators" group.
- Check for Cloud Resources in the Root Compartment
  Ensure there are no cloud resources within the OCI root compartment.
- Check for Non-Root Compartments
  Ensure there is at least one non-root compartment in your OCI tenancy to store cloud resources.
- Enable Multi-Factor Authentication for User Accounts
  Ensure that the Multi-Factor Authentication (MFA) feature is enabled for all users with a console password.
- Ensure IAM password policy requires minimum length of 14 or greater
  Ensure that IAM password policy requires minimum 14 characters for passwords.
- IAM Password Policy Enforces Password Expiration
  Ensure that IAM password policy enforces password expiration within 365 days or less.
- Protect the Tenancy "Administrators" Group
  Ensure that service administrators cannot update the tenancy "Administrators" group.
- Rotate Customer Secret Keys
  Ensure that customer secret keys are rotated on a periodic basis to follow security best practices.
- Rotate IAM Database Passwords
  Ensure that IAM database passwords are rotated on a periodic basis to follow security best practices.
- Rotate User API Keys
  Ensure that IAM user API keys are rotated on a periodic basis to follow security best practices.
- Rotate User Auth Tokens
  Ensure that IAM user auth tokens are rotated on a periodic basis to follow security best practices.
- Unnecessary API Keys
  Ensure there is a maximum of one active API key pair available for any single OCI IAM user.
- Unused IAM Users
  Ensure that unused OCI IAM local users are disabled to follow cloud security best practices.
- Use Default Tags for Cloud Resources
  Ensure that your Oracle Cloud Infrastructure (OCI) resources are using default tags.
OCI KMS
- Check for Cost Allocation Tags
  Ensure that OCI KMS Vaults have cost allocation tags for accurate cost allocation and budget tracking.
- Check for Environment Tags
  Ensure that OCI KMS Vaults have environment tags for proper resource management and access control.
- Check for KMS Key Protection Mode
  Ensure that OCI KMS Vaults use SOFTWARE-protected keys for cost optimization when HSM security is not required.
- Rotate KMS Customer-Managed Keys (CMKs)
  Ensure that your OCI KMS Customer-Managed Keys (CMKs) are regularly rotated.
- Unused KMS Customer-Managed Keys (CMKs)
  Identify excessive unused Customer-Managed Keys (CMKs) and delete them to help lower the cost of your monthly OCI bill.
- Virtual Private Vaults
  Ensure that your OCI KMS Vaults reside on an isolated partition within a Hardware Security Module (HSM).
OCI Networking
- Check for Unrestricted RDP Access via Network Security Groups
  Ensure that no network security groups allow unrestricted ingress access on TCP port 3389 (RDP).
- Check for Unrestricted RDP Access via Security Lists
  Ensure that no security listS allow unrestricted ingress access on TCP port 3389 (RDP).
- Check for Unrestricted SSH Access via Network Security Groups
  Ensure that no network security groups allow unrestricted ingress access on TCP port 22 (SSH).
- Check for Unrestricted SSH Access via Security Lists
  Ensure that no security lists allow unrestricted ingress access on TCP port 22 (SSH).
- Enable Flow Logging for VCN Subnets
  Ensure that flow logs are enabled for Virtual Cloud Networks (VCN) subnets.
- Restrict Traffic for Default Security Lists
  Ensure that the default security lists restrict all traffic except ICMP.
OCI Kubernetes Engine
- Check for Kubelet Configuration File Ownership
  Ensure that the Kubelet configuration file ownership is set to "root:root".
- Check for Kubelet Configuration File Permissions
  Ensure that the kubelet configuration file has permissions set to 644.
- Check for Streaming Connection Idle Timeout
  Ensure that the "streamingConnectionIdleTimeout" parameter is not set to 0 (zero).
- Check for kubelet-config.json File Ownership
  Ensure that the kubelet-config.json file ownership is set to "root:root".
- Check for kubelet-config.json File Permissions
  Ensure that the kubelet-config.json file has permissions set to 644.
- Disable Anonymous Requests to Kubelet Server
  Ensure that anonymous requests to the Kubelet server are disabled.
- Disable Kubelet Read-Only Port
  Ensure that the Kubelet read-only port is disabled.
- Disable Kubernetes API Public Endpoint
  Ensure that public access to the Kubernetes API is disabled (allow access via private endpoints only).
- Enable Authentication Using SSL/TLS Certificates
  Ensure that Kubelet authentication using SSL/TLS certificates is enabled.
- Enable Capturing Security-Relevant Events Without Restriction
  Ensure that Kubernetes is configured to capture security-relevant events without restriction.
- Enable Explicit Authorization
  Ensure that the Kubelet server authorization mode is not set to "AlwaysAllow".
- Enable HTTPS for Kubelet Servers
  Ensure that Kubelet servers are configured to serve only HTTPS traffic.
- Enable Kubelet Client Certificate Rotation
  Ensure that Kubelet client certificates are automatically rotated by setting the "rotateCertificates" parameter to true.
- Enable Kubelet Server Certificate Rotation
  Ensure that Kubelet server certificates are automatically rotated.
- Enable Kubelet to Manage IPtables
  Ensure that Kubelet is allowed to manage iptables.
Oracle Notifications Service
- Check for OCI Notification Topics and Subscriptions
  Ensure that notification topics and subscriptions are configured to send monitoring alerts.
OCI Object Storage
- Check for Publicly Accessible Object Storage Buckets
  Ensure that Object Storage buckets are not configured to allow public access.
- Enable Versioning for Object Storage Buckets
  Ensure that object versioning is enabled for OCI Object Storage buckets.
- Enable Write Level Logging for Object Storage Buckets
  Ensure that write logs are enabled for OCI Object Storage buckets.
- Object Storage Buckets Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Object Storage bucket data.