Back to Checks
oraclecloud

File Storage file system is encrypted with a customer-managed KMS key

filestorage_file_system_encrypted_with_cmk
Service: filestorageSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:FileSystem

OCI File Storage file systems use Customer-Managed Keys (CMEK) for encryption when a KMS key is associated, instead of the default Oracle-managed encryption.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Using provider-managed keys limits control over key lifecycle and access, weakening confidentiality. You cannot enforce custom rotation, revoke use, or apply granular key permissions, increasing exposure to insider misuse, legal compulsion, or compromised services. It may hinder compliance and complicate incident response.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks filestorage_file_system_encrypted_with_cmk

Recommendation

Encrypt file systems with Customer-Managed Keys in OCI KMS. Apply least privilege on key usage, enable periodic rotation, and require dual control for key administration. Monitor key activity with centralized logging. Use defense in depth by combining CMEK with network isolation and strong access governance.

Remediation

CLI

oci fs file-system update --file-system-id <FILE_SYSTEM_OCID> --kms-key-id <KMS_KEY_OCID>

Terraform

resource "oci_file_storage_file_system" "<example_resource_name>" {
  availability_domain = "<AVAILABILITY_DOMAIN>"
  compartment_id      = "<COMPARTMENT_OCID>"
  kms_key_id          = "<KMS_KEY_OCID>"  # Critical: associates a customer-managed KMS key to encrypt the file system
}

Other

1Sign in to the OCI Console
2Go to Storage > File Storage > File Systems and select the target file system
3In the Encryption section, click Edit (or Change key)
4Select Customer-managed key, choose the Vault and KMS key
5Click Save to apply

Check Code

"""Check Ensure File Storage Systems are encrypted with Customer Managed Keys."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.filestorage.filestorage_client import (
    filestorage_client,
)


class filestorage_file_system_encrypted_with_cmk(Check):
    """Check Ensure File Storage Systems are encrypted with Customer Managed Keys."""

    def execute(self) -> Check_Report_OCI:
        """Execute the filestorage_file_system_encrypted_with_cmk check."""
        findings = []

        for resource in filestorage_client.file_systems:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=resource,
                region=resource.region,
                resource_name=resource.name,
                resource_id=resource.id,
                compartment_id=resource.compartment_id,
            )

            if resource.kms_key_id is not None:
                report.status = "PASS"
                report.status_extended = (
                    f"{resource.name} meets the security requirement."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"{resource.name} does not meet the security requirement."
                )

            findings.append(report)

        return findings

References