Back to Checks
oraclecloud

Object Storage bucket is encrypted with a Customer Managed Key (CMK)

objectstorage_bucket_encrypted_with_cmk
Service: objectstorageSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Bucket

OCI Object Storage buckets use customer-managed encryption keys (CMEK) for server-side encryption, with an associated KMS key configured on the bucket.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without CMEK, encryption relies on provider-managed keys, reducing control over confidentiality and key lifecycle. You cannot strictly limit key usage, enforce custom rotation, or revoke keys for crypto-erasure, increasing exposure to unauthorized decryption, data exfiltration, and auditability gaps.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks objectstorage_bucket_encrypted_with_cmk

Recommendation

Encrypt buckets with CMEK. Apply least privilege to key usage, enforce separation of duties between key and storage admins, mandate regular rotation, and monitor key access. Use defense in depth so encryption complements strict IAM and network controls rather than replacing them.

Remediation

CLI

oci os bucket update --namespace-name <NAMESPACE> --bucket-name <BUCKET_NAME> --kms-key-id <KEY_OCID>

Terraform

resource "oci_objectstorage_bucket" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  name           = "<example_resource_name>"
  namespace      = "<example_resource_name>"

  kms_key_id = "<example_resource_id>" # Critical: sets the Customer Managed Key to encrypt the bucket
}

Other

1Sign in to the OCI Console
2Go to Storage > Object Storage & Archive Storage > Buckets
3Open the target bucket
4Click Edit bucket
5Under Encryption, select Customer-managed key and choose the desired Vault key
6Click Save

Check Code

"""Check Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK)."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.objectstorage.objectstorage_client import (
    objectstorage_client,
)


class objectstorage_bucket_encrypted_with_cmk(Check):
    """Check Ensure Object Storage Buckets are encrypted with a Customer Managed Key (CMK)."""

    def execute(self) -> Check_Report_OCI:
        """Execute the objectstorage_bucket_encrypted_with_cmk check."""
        findings = []

        # Check buckets are encrypted with CMK
        for bucket in objectstorage_client.buckets:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=bucket,
                region=bucket.region,
                resource_name=bucket.name,
                resource_id=bucket.id,
                compartment_id=bucket.compartment_id,
            )

            if bucket.kms_key_id:
                report.status = "PASS"
                report.status_extended = (
                    f"Bucket {bucket.name} is encrypted with Customer Managed Key."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Bucket {bucket.name} is not encrypted with Customer Managed Key."
                )

            findings.append(report)

        return findings

References