OCI private keys are hard coded in the provider
Description
When accessing OCI programmatically, users can use a password protected certificate. Including that password in your files that are checked into a repository leaves you exposed to account hijacking. We recommend using a secrets store or security tokens for secure access.
Code Example
go
provider "oci" {
- private_key_password = "secretPassword"
}Remediation
Terraform
Rule Details
| Field | Value |
|---|---|
| ID | IAC-1228 |
| Severity | LOW |
| IaC Type | Terraform |
| Frameworks | Terraform, TerraformPlan |
| Checkov ID | CKV_OCI_1 |