Back to Checks
oraclecloud

Compute instance has Secure Boot enabled

compute_instance_secure_boot_enabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:node-security
Resource Type:Instance

OCI compute instances have UEFI Secure Boot enabled so the platform firmware loads only trusted, signed bootloaders, kernels, and drivers at startup.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without Secure Boot, unsigned or tampered boot code can run before the OS, enabling bootkits/rootkits to gain kernel-level persistence, bypass monitoring, alter logs, and exfiltrate secrets, eroding integrity and confidentiality, and risking availability through destructive changes or ransom staging.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks compute_instance_secure_boot_enabled

Recommendation

Enable Secure Boot across instances and prefer shielded instances. Pair with TPM and Measured Boot where supported for defense in depth. Permit only trusted, signed kernels and drivers, and manage updates via hardened golden images and code signing. On Windows VMs, use Secure Boot with TPM and Measured Boot.

Remediation

Terraform

resource "oci_core_instance" "example" {
  # ... other required configuration ...

  platform_config {
    type                   = "AMD_VM"
    is_secure_boot_enabled = true # Critical: enable Secure Boot to pass the check
  }
}

Other

1In the OCI Console, go to Compute > Instances
2Click Create instance
3Choose an image and shape that support Shielded instance
4In the Security section, click Edit under Shielded instance and enable Secure Boot
5Click Create
6To remove the failing resource, select the original non-shielded instance > More actions > Terminate

Check Code

"""Check if Secure Boot is enabled on Compute Instance."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.compute.compute_client import compute_client


class compute_instance_secure_boot_enabled(Check):
    """Check if Secure Boot is enabled on Compute Instance."""

    def execute(self) -> Check_Report_OCI:
        """Execute the compute_instance_secure_boot_enabled check.

        Returns:
            List of Check_Report_OCI objects with findings
        """
        findings = []

        for instance in compute_client.instances:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=instance,
                region=instance.region,
                resource_name=instance.name,
                resource_id=instance.id,
                compartment_id=instance.compartment_id,
            )

            if instance.is_secure_boot_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"Compute instance {instance.name} has Secure Boot enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"Compute instance {instance.name} does not have Secure Boot enabled."

            findings.append(report)

        return findings

References