Back to Checks
oraclecloud

Block volume is encrypted with a Customer Managed Key (CMK)

blockstorage_block_volume_encrypted_with_cmk
Service: blockstorageSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Volume

OCI block volumes use Customer-Managed Keys (CMK) from Vault for at-rest encryption instead of Oracle-managed keys.

Identifies whether a block volume has a customer-managed key associated for its encryption.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without CMK, encryption key control is limited, impacting confidentiality and auditability:

  • No rapid key disable/rotation to contain breaches
  • Weaker restrictions and visibility on decrypt operations This can prolong unauthorized data access and hinder incident response and compliance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks blockstorage_block_volume_encrypted_with_cmk

Recommendation

Use Customer-Managed Keys in Vault for all block volumes.

  • Enforce least privilege and separation of duties on key usage
  • Rotate keys regularly and monitor KMS events
  • Validate that key disable/deny revokes data access Apply the same controls to snapshots and backups.

Remediation

CLI

oci bv volume update --volume-id <VOLUME_OCID> --kms-key-id <KMS_KEY_OCID>

Terraform

resource "oci_core_volume" "<example_resource_name>" {
  compartment_id      = "<example_resource_id>"
  availability_domain = "<example_resource_name>"
  size_in_gbs         = 50

  kms_key_id = "<example_resource_id>" # Critical: uses a Customer Managed Key to encrypt the volume
}

Other

1In the OCI Console, go to Block Storage > Block Volumes
2Open the failing volume
3Click Edit
4Under Encryption, select "Encrypt using customer-managed keys" and choose the vault key
5Click Save changes

Check Code

"""Check if Block Volumes are encrypted with Customer Managed Keys."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.blockstorage.blockstorage_client import (
    blockstorage_client,
)


class blockstorage_block_volume_encrypted_with_cmk(Check):
    """Check if Block Volumes are encrypted with Customer Managed Keys."""

    def execute(self) -> Check_Report_OCI:
        """Execute the blockstorage_block_volume_encrypted_with_cmk check.

        Returns:
            List of Check_Report_OCI objects with findings
        """
        findings = []

        for volume in blockstorage_client.volumes:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=volume,
                region=volume.region,
                resource_name=volume.name,
                resource_id=volume.id,
                compartment_id=volume.compartment_id,
            )

            if volume.kms_key_id is not None:
                report.status = "PASS"
                report.status_extended = f"Block volume {volume.name} is encrypted with a Customer Managed Key (CMK)."
            else:
                report.status = "FAIL"
                report.status_extended = f"Block volume {volume.name} is not encrypted with a Customer Managed Key (uses Oracle-managed encryption)."

            findings.append(report)

        return findings

References