Back to Checks
oraclecloud

Boot volume is encrypted with Customer Managed Key

blockstorage_boot_volume_encrypted_with_cmk
Service: blockstorageSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:BootVolume

Boot volumes use customer-managed keys (CMEK) when a Vault key is assigned (kms_key_id present), rather than default Oracle-managed encryption.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without CMEK, control over encryption is limited: you cannot rapidly disable or rotate keys to contain compromise, weakening confidentiality of boot data and backups. Provider-managed keys reduce separation of duties and auditability, hindering incident response and compliance for sensitive systems.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks blockstorage_boot_volume_encrypted_with_cmk

Recommendation

Encrypt boot volumes with customer-managed keys and enforce least privilege on key usage. Define a key lifecycle (new keys for rotation), monitor and audit key access, and restrict key scope to required compartments and services to achieve defense in depth and rapid revocation when needed.

Remediation

CLI

oci bv boot-volume update --boot-volume-id <example_resource_id> --kms-key-id <example_resource_id>

Terraform

resource "oci_core_boot_volume_kms_key" "<example_resource_name>" {
  boot_volume_id = "<example_resource_id>"  # Critical: target boot volume to update
  kms_key_id     = "<example_resource_id>"  # Critical: assigns a Customer Managed Key (CMK) to the boot volume
}

Other

1In the OCI Console, go to Storage > Block Storage > Boot Volumes
2Click the boot volume name
3Click Edit (or Assign master encryption key)
4Select a Customer-managed key from Vault
5Click Save

Check Code

"""Check Ensure Boot Volumes are encrypted with Customer Managed Key."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.blockstorage.blockstorage_client import (
    blockstorage_client,
)


class blockstorage_boot_volume_encrypted_with_cmk(Check):
    """Check Ensure Boot Volumes are encrypted with Customer Managed Key."""

    def execute(self) -> Check_Report_OCI:
        """Execute the blockstorage_boot_volume_encrypted_with_cmk check."""
        findings = []

        for resource in blockstorage_client.boot_volumes:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=resource,
                region=resource.region,
                resource_name=resource.name,
                resource_id=resource.id,
                compartment_id=resource.compartment_id,
            )

            if resource.kms_key_id is not None:
                report.status = "PASS"
                report.status_extended = f"Boot Volume {resource.name} is encrypted with Customer Managed Key."
            else:
                report.status = "FAIL"
                report.status_extended = f"Boot Volume {resource.name} is not encrypted with Customer Managed Key."

            findings.append(report)

        return findings

References