OCI Object Storage Bucket is not encrypted with a Customer Managed Key (CMK)
Description
This policy identifies the OCI Object Storage buckets that are not encrypted with a Customer Managed Key (CMK). It is recommended that Object Storage buckets should be encrypted with a Customer Managed Key (CMK), using Customer Managed Key (CMK), provides an additional level of security on your data by allowing you to manage your own encryption key lifecycle management for the bucket.
Code Example
resource "oci_objectstorage_bucket" "pass" {
...
kms_key_id = var.oci_kms_key.id
...
}Remediation
- OCI Console*
. Login to the OCI Console
. Type the resource reported in the alert into the Search box at the top of the Console.
. Click the resource reported in the alert from the Resources submenu
. Click Assign next to Encryption Key: Oracle managed key.
. Select a Vault from the appropriate compartment
. Select a Master Encryption Key
. Click Assign === Fix - Buildtime
Terraform
- Resource: oci_objectstorage_bucket
- Arguments: kms_key_id
Rule Details
| Field | Value |
|---|---|
| ID | IAC-1236 |
| Severity | INFO |
| IaC Type | Terraform |
| Frameworks | Terraform, TerraformPlan |
| Checkov ID | CKV_OCI_9 |