Best practice rules for Oracle Cloud Infrastructure

Oracle Cloud Infrastructure best practice rules

TrendAI Vision One™ has over 1400+ cloud infrastructure configuration best practices for your Oracle Cloud Infrastructure, Alibaba Cloud, Amazon Web Services, Microsoft® Azure, and Google Cloud™ environments. Here is our growing list of OCI security, configuration and compliance rules with clear instructions on how to perform the updates – made either through the OCI console or via the OCI Command Line Interface (CLI).

TrendAI Vision One™ provides real-time monitoring and auto-remediation for the security, compliance and governance of your cloud infrastructure. Leaving you to grow and scale your business with confidence.

OCI Autonomous AI Database
- Autonomous AI Databases Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Autonomous AI Databases.
- Check for Database Version
  Ensure that your OCI Autonomous AI Databases are using the latest version of Oracle AI Database.
- Define Contacts for Operational Notifications and Announcements
  Define customer contacts to receive operational notifications and announcements for your OCI Autonomous AI Databases.
- Disable Public Network Access
  Ensure that public network access to OCI Autonomous AI Databases is disabled.
- Enable Auto Scaling for Autonomous AI Database Storage
  Enable storage auto-scaling for your Oracle Cloud Infrastructure (OCI) Autonomous AI Databases.
- Enable Compute Auto Scaling for Autonomous AI Databases
  Enable compute auto-scaling for your Oracle Cloud Infrastructure (OCI) Autonomous AI Databases.
- Enable Data Safe for Autonomous AI Databases
  Enable the Data Safe feature for your OCI Autonomous AI Databases.
- Enable Diagnostics and Management for Autonomous AI Databases
  Ensure that Database Management is enabled for your OCI Autonomous AI Databases.
- Enable Disaster Recovery for Autonomous AI Databases
  Enable cross-region disaster recovery for your Oracle Cloud Infrastructure (OCI) Autonomous AI Databases.
- Enable Immutable Backup Retention
  Enable immutable backup retention for Oracle Cloud Infrastructure (OCI) Autonomous AI Databases.
- Enable Zero Trust Packet Routing (ZPR)
  Enable Zero Trust Packet Routing (ZPR) for your Oracle Cloud Infrastructure (OCI) Autonomous AI Databases.
- Secure Connections to Autonomous AI Databases with Mutual TLS (mTLS)
  Secure connections to OCI Autonomous AI Databases using mutual TLS (mTLS).
- Use Private Endpoints for Autonomous AI Databases
  Ensure that network access to OCI Autonomous AI Databases is allowed via private endpoints only.
OCI Block Volume
- Block Volumes Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Block Volume data.
- Boot Volumes Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Boot Volume data.
- Check for Volume Performance Units (VPUs)
  Ensure that OCI Block Volume VPUs are configured appropriately for workload requirements.
- Enable Cross-Region Volume Replication
  Enable ongoing automatic asynchronous replication of Block Volumes across OCI regions.
- Enable Performance-Based Autotuning for Block Volumes
  Ensure that performance-based autotuning is enabled for OCI Block Volumes.
- Enable Performance-Based Autotuning for Boot Volumes
  Ensure that performance-based autotuning is enabled for OCI Boot Volumes.
- Enable Scheduled Backups for Block Volumes
  Use backup policies to schedule backups for Block Volumes in Oracle Cloud Infrastructure (OCI).
OCI Cloud Guard
- Enable Cloud Guard
  Ensure that Cloud Guard is enabled for your OCI compartments.
OCI Compute
- Approved Instance Shape Compliance
  Ensure that your OCI compute instances are of a given, approved shape (e.g., VM.Standard.E5.Flex).
- Check for Public IP Address Exposure
  Avoid using public IP addresses for OCI compute instances unless it's necessary for business operations.
- Enable Cloud Guard Workload Protection
  Ensure that Cloud Guard Workload Protection feature is enabled for OCI compute instances.
- Enable Compute Instance Monitoring
  Ensure that compute instance monitoring is enabled for your OCI compute instances.
- Enable Confidential Computing
  Ensure that the Confidential Computing feature is enabled for OCI compute instances.
- Enable Custom Logs Monitoring
  Ensure that custom logs monitoring is enabled for your OCI compute instances.
- Enable In-Transit Encryption
  Ensure that encryption of data in transit is enabled for OCI compute instances.
- Enable OS Management Service for Compute Instances
  Ensure that OS Management Service is enabled for OCI compute instances.
- Enable Secure Boot for Compute Instances
  Ensure that Secure Boot is enabled for shielded Oracle Cloud Infrastructure (OCI) compute instances.
- Enable Vulnerability Scanning
  Ensure that the Vulnerability Scanning feature is enabled for OCI compute instances.
- Require IMDSv2 for Compute Instances
  Ensure that IMDSv2 is enforced for all Oracle Cloud Infrastructure (OCI) compute instances.
- Use Network Security Groups to Control Traffic to Compute Instances
  Ensure that your OCI compute instances are using Network Security Groups (NSGs) for traffic control.
OCI Events
- Enable Notification Alerts for IAM Group Changes
  Ensure that IAM group changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for IAM Policy Changes
  Ensure that IAM policy configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for IAM User Changes
  Ensure that IAM user changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for IdP Group Mapping Changes
  Ensure that Identity Provider changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Identity Provider Changes
  Ensure that Identity Provider changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Local User Authentication
  Ensure that OCI local user authentication is being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Network Gateway Changes
  Ensure that network gateway configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Network Security Group Changes
  Ensure that network security group configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Problems Detected with Cloud Guard
  Ensure that changes to Cloud Guard issues are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Route Table Changes
  Ensure that route table configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for Security List Changes
  Ensure that security list configuration changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
- Enable Notification Alerts for VCN Changes
  Ensure that VCN changes are being monitored using Oracle Cloud Infrastructure (OCI) Events.
OCI File Storage
- Check Lustre File Systems for Cost Allocation Tags
  Ensure that OCI Lustre file systems have cost allocation tags for accurate cost allocation and budget tracking.
- Check for Availability Domain Alignment
  Ensure that OCI File Storage file systems should be placed in same availability domain as compute resources.
- Check for Clone Hydration Status
  Ensure that OCI file system clones are fully hydrated for production use.
- Check for Cost Allocation Tags
  Ensure that OCI File Storage systems have cost allocation tags for accurate cost allocation and budget tracking.
- Clone Parent Management
  Ensure that clone parent file systems without attached child clones are removed.
- Configure Snapshot Policy for File Systems
  Ensure that snapshot policies are configured for your OCI File Storage file systems.
- Enable File System Active Replication
  Ensure that active replication is enabled for your OCI File Storage systems.
- Enable Quota Enforcement
  Ensure that OCI File Storage quota enforcement is enabled for cost control.
- File Storage Systems Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI File Storage systems.
- Lustre File Systems Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Lustre file systems.
- Use Network Security Groups to Control Traffic to Lustre File Systems
  Ensure that your Lustre file systems are using Network Security Groups (NSGs) for traffic control.
- Use Resource Locking for File Systems
  Ensure that resource locking is enabled for your production OCI File Storage systems.
OCI Functions
- Attach Function Applications to Network Security Groups (NSGs)
  Ensure that Oracle Cloud Infrastructure (OCI) Functions applications are attached to Network Security Groups (NSGs) to implement granular ingress and egress network access controls.
- Check for Least Privilege IAM Policies for Function Invocation
  Ensure that IAM policies controlling access to OCI Functions follow the principle of least privilege by granting only the minimum permissions necessary.
- Check for Private Subnet Deployment for Function Applications
  Ensure that Oracle Cloud Infrastructure (OCI) Functions applications are deployed in private subnets to minimize exposure to the public internet.
- Check for Resource-Level Access Controls in Function IAM Policies
  Ensure that IAM policies implement resource-level access controls for OCI Functions using specific application or function OCIDs in policy conditions.
- Check for Separation of Function Management and Invocation Permissions
  Ensure that IAM policies separate function management permissions from function invocation permissions to enforce the principle of separation of duties.
- Check for Service Gateway Configuration for Private Function Access
  Ensure that Virtual Cloud Networks (VCNs) containing OCI Functions applications have a service gateway configured to enable private communication with Oracle Services Network.
- Restrict Function Access by Network Source
  Ensure that function invocation and management requests are restricted to specific IP addresses or network sources to prevent unauthorized access from untrusted networks.
OCI IAM
- Check Tenancy Administrator Users for API Keys
  Ensure that API keys are not created for tenancy administrator users.
- Check for Admin-Only Resource Access
  Ensure that permissions on all OCI resources are given only to the "Administrators" group.
- Check for Cloud Resources in the Root Compartment
  Ensure there are no cloud resources within the OCI root compartment.
- Check for Non-Root Compartments
  Ensure there is at least one non-root compartment in your OCI tenancy to store cloud resources.
- Check for Service-Level Administrators
  Ensure that service-level administrators are enforced to manage resources of particular OCI service.
- Check for Valid IAM User Email Address
  Ensure that all Oracle Cloud Infrastructure (OCI) IAM user accounts have a valid and current email address.
- Configure Account Lock Threshold
  Ensure that account lock threshold is configured in your OCI IAM password policy.
- Enable Identity Domain Diagnostics
  Set the diagnostics type to capture operational logs within your OCI Identity Domain.
- Enable Multi-Factor Authentication for User Accounts
  Ensure that the Multi-Factor Authentication (MFA) feature is enabled for all users with a console password.
- Ensure IAM password policy requires minimum length of 14 or greater
  Ensure that IAM password policy requires minimum 14 characters for passwords.
- IAM Password Policy Enforces Password Expiration
  Ensure that IAM password policy enforces password expiration within 365 days or less.
- Prevent Critical Storage Resource Deletion
  Ensure that storage service-level administrators can't delete the resources they manage.
- Prevent Password Reuse
  Ensure that OCI IAM password policy prevents password reuse.
- Protect the Tenancy "Administrators" Group
  Ensure that service administrators cannot update the tenancy "Administrators" group.
- Rotate Customer Secret Keys
  Ensure that customer secret keys are rotated on a periodic basis to follow security best practices.
- Rotate IAM Database Passwords
  Ensure that IAM database passwords are rotated on a periodic basis to follow security best practices.
- Rotate User API Keys
  Ensure that IAM user API keys are rotated on a periodic basis to follow security best practices.
- Rotate User Auth Tokens
  Ensure that IAM user auth tokens are rotated on a periodic basis to follow security best practices.
- Rotate User SMTP Credentials
  Ensure that IAM user SMTP credentials are rotated on a periodic basis to follow security best practices.
- Unnecessary API Keys
  Ensure there is a maximum of one active API key pair available for any single OCI IAM user.
- Unused IAM Users
  Ensure that unused OCI IAM local users are disabled to follow cloud security best practices.
- Use Default Tags for Cloud Resources
  Ensure that your Oracle Cloud Infrastructure (OCI) resources are using default tags.
- Use Network Perimeters
  Enable and configure network perimeters for Oracle Cloud Infrastructure (OCI) identity domains.
OCI KMS
- Check for Cost Allocation Tags
  Ensure that OCI KMS Vaults have cost allocation tags for accurate cost allocation and budget tracking.
- Check for Environment Tags
  Ensure that OCI KMS Vaults have environment tags for proper resource management and access control.
- Check for KMS Key Protection Mode
  Ensure that OCI KMS Vaults use SOFTWARE-protected keys for cost optimization when HSM security is not required.
- Rotate KMS Customer-Managed Keys (CMKs)
  Ensure that your OCI KMS Customer-Managed Keys (CMKs) are regularly rotated.
- Unused KMS Customer-Managed Keys (CMKs)
  Identify excessive unused Customer-Managed Keys (CMKs) and delete them to help lower the cost of your monthly OCI bill.
- Virtual Private Vaults
  Ensure that your OCI KMS Vaults reside on an isolated partition within a Hardware Security Module (HSM).
OCI Networking
- Check for Unrestricted RDP Access via Network Security Groups
  Ensure that no network security groups allow unrestricted ingress access on TCP port 3389 (RDP).
- Check for Unrestricted RDP Access via Security Lists
  Ensure that no security listS allow unrestricted ingress access on TCP port 3389 (RDP).
- Check for Unrestricted SSH Access via Network Security Groups
  Ensure that no network security groups allow unrestricted ingress access on TCP port 22 (SSH).
- Check for Unrestricted SSH Access via Security Lists
  Ensure that no security lists allow unrestricted ingress access on TCP port 22 (SSH).
- Enable Flow Logging for VCN Subnets
  Ensure that flow logs are enabled for Virtual Cloud Networks (VCN) subnets.
- Restrict Traffic for Default Security Lists
  Ensure that the default security lists restrict all traffic except ICMP.
OCI Oracle Analytics Cloud
- Disable Public Network Access
  Ensure that public network access to Oracle Analytics Cloud (OAC) instances is disabled.
OCI Oracle Integration Cloud
- Check for Unrestricted Network Access
  Ensure that network access to your Oracle Integration Cloud (OIC) instances is restricted.
OCI Kubernetes Engine
- Avoid Wildcard Use in Roles and ClusterRoles
  Ensure that wildcard use is avoided in Roles and ClusterRoles.
- Check for CNI Plugin Version
  Ensure the CNI plugin utilized by the OKE cluster supports network policies.
- Check for Kubelet Configuration File Ownership
  Ensure that the Kubelet configuration file ownership is set to "root:root".
- Check for Kubelet Configuration File Permissions
  Ensure that the kubelet configuration file has permissions set to 644.
- Check for Streaming Connection Idle Timeout
  Ensure that the "streamingConnectionIdleTimeout" parameter is not set to 0 (zero).
- Check for kubelet-config.json File Ownership
  Ensure that the kubelet-config.json file ownership is set to "root:root".
- Check for kubelet-config.json File Permissions
  Ensure that the kubelet-config.json file has permissions set to 644.
- Disable Anonymous Requests to Kubelet Server
  Ensure that anonymous requests to the Kubelet server are disabled.
- Disable Kubelet Read-Only Port
  Ensure that the Kubelet read-only port is disabled.
- Disable Kubernetes API Public Endpoint
  Ensure that public access to the Kubernetes API is disabled (allow access via private endpoints only).
- Enable Authentication Using SSL/TLS Certificates
  Ensure that Kubelet authentication using SSL/TLS certificates is enabled.
- Enable Capturing Security-Relevant Events Without Restriction
  Ensure that Kubernetes is configured to capture security-relevant events without restriction.
- Enable Explicit Authorization
  Ensure that the Kubelet server authorization mode is not set to "AlwaysAllow".
- Enable HTTPS for Kubelet Servers
  Ensure that Kubelet servers are configured to serve only HTTPS traffic.
- Enable Kubelet Client Certificate Rotation
  Ensure that Kubelet client certificates are automatically rotated by setting the "rotateCertificates" parameter to true.
- Enable Kubelet Server Certificate Rotation
  Ensure that Kubelet server certificates are automatically rotated.
- Enable Kubelet to Manage IPtables
  Ensure that Kubelet is allowed to manage iptables.
- Enable Support for Network Policy
  OKE clusters should be configured with network policy support to enforce proper segmentation and secure communications.
- Limit Default Service Account Usage
  Avoid using default service accounts for your OCI Kubernetes Engine (OKE) clusters.
- Minimize Admission of Containers Sharing the Host IPC Namespace
  Ensure that containers are not permitted to run with the "hostIPC" flag set to true.
- Minimize Admission of Containers Sharing the Host Network Namespace
  Ensure that containers are not permitted to run with the "hostNetwork" flag set to true.
- Minimize Admission of Containers Sharing the Host Process ID Namespace
  Ensure that containers are not permitted to run with the "hostPID" flag set to true.
- Minimize Admission of Privileged Containers
  Ensure that containers are not permitted to run with the "securityContext.privileged" flag set to true.
- Prevent Privilege Escalation
  Ensure that containers are not permitted to run with the "allowPrivilegeEscalation" flag set to true.
- Restrict "cluster-admin" Role Usage
  Ensure that the use of the "cluster-admin" role is restricted across your OKE clusters.
- Restrict Access to Secrets
  Ensure that access to secrets is restricted across your OKE clusters.
- Restrict Access to the Kubernetes Control Plane
  Ensure the access to the Kubernetes control plane endpoint is restricted.
- Restrict Service Account Token Mounting
  Ensure the service account tokens are only mounted where strictly necessary.
- Restrict the Ability to Create Pods
  Ensure that only authorized personnel can create pods.
- Use Dedicated Service Accounts
  Ensure that dedicated service accounts are used for OCI Kubernetes Engine (OKE) clusters.
- Use Network Policies
  Use network policies to control traffic within your OKE cluster network.
- Use Non-Default Namespaces
  Ensure the default Kubernetes namespace is not used.
- Use Private Nodes
  Enable private nodes for OCI Kubernetes Engine (OKE) clusters.
- Use Secrets as Files Instead of Environment Variables
  Ensure that secrets are mounted as files, not environment variables.
Oracle Notifications Service
- Check for OCI Notification Topics and Subscriptions
  Ensure that notification topics and subscriptions are configured to send monitoring alerts.
OCI Object Storage
- Check for Cost Allocation Tags
  Ensure that OCI Object Storage buckets have cost allocation tags for accurate cost allocation and budget tracking.
- Check for Publicly Accessible Object Storage Buckets
  Ensure that Object Storage buckets are not configured to allow public access.
- Enable Auto-Tiering for Object Storage Buckets
  Ensure that Auto-Tiering is enabled for Oracle Cloud Infrastructure (OCI) Object Storage buckets.
- Enable Object Storage Replication
  Ensure that replication is enabled for Oracle Cloud Infrastructure (OCI) Object Storage buckets.
- Enable Read-Level Logging for Object Storage Buckets
  Ensure that read logs are enabled for OCI Object Storage buckets.
- Enable Versioning for Object Storage Buckets
  Ensure that object versioning is enabled for OCI Object Storage buckets.
- Enable Write Level Logging for Object Storage Buckets
  Ensure that write logs are enabled for OCI Object Storage buckets.
- Object Storage Buckets Encrypted with Customer-Managed Keys
  Use Customer-Managed Keys (CMKs) to encrypt your OCI Object Storage bucket data.