Back to Checks
oraclecloud

Compute instance has in-transit encryption enabled

compute_instance_in_transit_encryption_enabled
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Instance

OCI compute instances are evaluated for in-transit encryption on paravirtualized block or boot volume attachments, confirming that data exchanged between the instance and attached volumes is encrypted during transfer.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without in-transit encryption, volume traffic can be inspected or altered on internal paths. A threat actor or compromised host could read sensitive data, inject corrupted blocks, or replay writes, undermining confidentiality and integrity, and risking availability through data corruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks compute_instance_in_transit_encryption_enabled

Recommendation

Enable in-transit encryption for all paravirtualized volume attachments and make it standard in golden images and IaC. Apply defense in depth with customer-managed keys and regular rotation. Periodically verify attachments and remediate drift so no instance communicates with volumes over unencrypted channels.

Remediation

CLI

oci compute boot-volume-attachment update --boot-volume-attachment-id <boot-volume-attachment-ocid> --is-pv-encryption-in-transit-enabled true

Terraform

resource "oci_core_instance" "<example_resource_name>" {
  # ... other required configuration ...
  launch_options {
    is_pv_encryption_in_transit_enabled = true  # Critical: enables in-transit encryption for paravirtualized attachments
  }
}

Other

1In the OCI Console, go to Compute > Instances and open the target instance
2Under Resources, click the boot volume attachment, choose Edit, enable "Use in-transit encryption", and Save
3For each attached block volume (paravirtualized), open the attachment (More actions > Edit), enable "Use in-transit encryption", and Save
4If Edit isn't available for an attachment, detach it and reattach it with "Use in-transit encryption" checked

Check Code

"""Check if In-transit Encryption is enabled on Compute Instance."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.compute.compute_client import compute_client


class compute_instance_in_transit_encryption_enabled(Check):
    """Check if In-transit Encryption is enabled on Compute Instance."""

    def execute(self) -> Check_Report_OCI:
        """Execute the compute_instance_in_transit_encryption_enabled check.

        Returns:
            List of Check_Report_OCI objects with findings
        """
        findings = []

        for instance in compute_client.instances:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=instance,
                region=instance.region,
                resource_name=instance.name,
                resource_id=instance.id,
                compartment_id=instance.compartment_id,
            )

            # In-transit encryption is enabled when is_pv_encryption_in_transit_enabled is True
            if instance.is_pv_encryption_in_transit_enabled:
                report.status = "PASS"
                report.status_extended = f"Compute instance {instance.name} has in-transit encryption enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"Compute instance {instance.name} does not have in-transit encryption enabled."

            findings.append(report)

        return findings

References