Back to Checks
oraclecloud

Cloud Guard is enabled in the root compartment of the tenancy

cloudguard_enabled
Service: cloudguardSeverity: high
OfficialBuilt-inVerified
Categories:forensics-ready
Resource Type:Compartment

OCI Cloud Guard status in the tenancy's root compartment is evaluated, expecting ENABLED to indicate the service is active for organization-wide detection and response.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without Cloud Guard at the root, signals across compartments can be missed, allowing misconfigurations and malicious activity to persist. This undermines confidentiality (undetected data access), integrity (unauthorized changes), and availability (ongoing abuse without automated response).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks cloudguard_enabled

Recommendation

Enable Cloud Guard at the tenancy root to centralize monitoring and automated response. Apply defense in depth by using detectors/responders, integrate alerts with monitoring, and enforce least privilege for its roles. Regularly tune policies and review findings to prevent blind spots.

Remediation

CLI

oci cloud-guard cloud-guard-configuration update --compartment-id <tenancy-ocid> --status ENABLED --reporting-region <region>

Terraform

resource "oci_cloud_guard_cloud_guard_configuration" "<example_resource_name>" {
  compartment_id   = var.tenancy_ocid
  reporting_region = var.region
  status           = "ENABLED" # Critical: Turns on Cloud Guard in the root compartment
}

Other

1In the OCI Console, go to Security > Cloud Guard
2Ensure the root compartment is selected
3Click Enable Cloud Guard
4Choose a Reporting region
5Click Enable

Check Code

"""Check Ensure Cloud Guard is enabled in the root compartment of the tenancy."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.cloudguard.cloudguard_client import (
    cloudguard_client,
)


class cloudguard_enabled(Check):
    """Check Ensure Cloud Guard is enabled in the root compartment of the tenancy."""

    def execute(self) -> Check_Report_OCI:
        """Execute the cloudguard_enabled check."""
        findings = []

        report = Check_Report_OCI(
            metadata=self.metadata(),
            resource=cloudguard_client.configuration,
            region="global",
            resource_name="Cloud Guard",
            resource_id=cloudguard_client.audited_tenancy,
            compartment_id=cloudguard_client.audited_tenancy,
        )

        if (
            cloudguard_client.configuration
            and cloudguard_client.configuration.status == "ENABLED"
        ):
            report.status = "PASS"
            report.status_extended = "Cloud Guard is enabled in the root compartment."
        else:
            report.status = "FAIL"
            report.status_extended = (
                "Cloud Guard is not enabled in the root compartment."
            )

        findings.append(report)

        return findings

References