Checks

OCI dynamic groups configured for instance principal access to workloads like Compute instances, Functions, and Autonomous Databases. The evaluation looks for matching rules that target these resources (e.g., instance, fnfunc, autonomousdatabase) to confirm workload identity usage.

OCI tenancy includes at least one active non-root compartment. Only compartments below the root level are considered, indicating that resources are organized outside the root scope.

OCI root compartment is evaluated for the presence of user resources. The finding highlights any assets created at the tenancy root and provides a count per resource_type.

OCI Identity Domain password policies are evaluated to confirm password expiration is configured and set to <= 365 days (password_expires_after). System-managed immutable policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded.

Legacy IAM lacks password expiration; tenancies without Identity Domains require manual assessment.

OCI IAM password policies are evaluated to confirm a minimum password length of >= 14 characters is enforced. The assessment considers policies defined in Identity Domains and the legacy tenancy policy, and also detects when no password policy exists. System-managed immutable policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded.

OCI Identity Domains password policies are evaluated for password reuse prevention via password history (num_passwords_in_history >= 24). System-managed policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded. Legacy IAM lacks password history.

OCI IAM policies are reviewed for overly broad entitlements, specifically statements granting manage all-resources without scoping to particular services or compartments. Only active policies are considered; the default tenant admin policy is excluded.

OCI IAM policies are reviewed to ensure storage service-level administrator statements that grant manage permissions exclude the relevant storage delete permissions with request.permission. This supports CIS OCI 3.1 control 1.15 separation of duties for Block Volume, File Storage, and Object Storage administrators.

OCI IAM policies are analyzed for statements granting manage all-resources in tenancy to groups. Only the Tenant Admin Policy for the Administrators group should include this broad verb. Any other active policy containing this tenancy-wide permission is identified.

OCI tenancy administrator accounts (members of the Administrators group) are inspected for configured user API keys tied to those identities.

OCI IAM users with active API signing keys older than 90 days are identified. Key age is derived from each key's creation time; only active keys are considered. Users without API keys are recorded.

OCI IAM user auth tokens are evaluated for rotation age against a 90-day threshold using each token's creation time. Tokens older than this window indicate the token has not been recently rotated.

OCI IAM customer secret keys are assessed by creation timestamp to determine whether their age exceeds 90 days.

OCI IAM user database passwords are evaluated for age. Passwords are compared to a rotation window of 90 days, flagging credentials that have not been refreshed within that period for the associated user accounts and regions.

Covers each user's active database passwords tracked by IAM.

OCI IAM users with console password access are expected to have multifactor authentication enabled. The evaluation inspects each local user allowed to sign in to the Console and identifies those without an active second factor.

OCI IAM user accounts are evaluated for a populated email attribute that resembles an address (contains @). Accounts missing this attribute or with malformed values are identified.

Oracle Integration Cloud instances are evaluated for network endpoint restrictions, confirming access is limited to approved IPs or VCNs. Configurations with 0.0.0.0/0, missing endpoint details, or PUBLIC endpoints without allowlists are identified; PRIVATE endpoints or PUBLIC endpoints with IP/VCN allowlists indicate restricted access.

OCI KMS customer-managed keys configured for automatic rotation, with a rotation interval set to <= 365 days, or manually rotated within the last 365 days. Some vault types do not support auto-rotation, so manual rotation is accepted as an alternative.

OCI default security list of each VCN is evaluated to allow only VCN-internal ICMP. Non-ICMP ingress from 0.0.0.0/0 or sources outside the VCN, and non-ICMP egress to 0.0.0.0/0, are considered overly permissive. Only default lists are in scope.

OCI Network Security Groups are evaluated for inbound source 0.0.0.0/0 permitting RDP on TCP 3389, including broad rules (all TCP or any protocol) that implicitly include that port.

Network security groups with ingress from 0.0.0.0/0 exposing SSH are identified. This includes rules that explicitly permit TCP 22, use all protocols, or define TCP port ranges that encompass 22.

OCI security lists are evaluated for rules that permit inbound RDP from the Internet: any source 0.0.0.0/0 allowing TCP 3389-including rules that allow all TCP ports or all protocols-signals public RDP exposure.

OCI security lists are evaluated for rules that permit inbound SSH from 0.0.0.0/0. Any rule where the destination includes TCP 22-or broader rules allowing all TCP or all protocols from 0.0.0.0/0-indicates public SSH exposure.

OCI subnets in a VCN have network flow logging configured. Evaluation considers an active flowlogs configuration targeting the VCN or the specific subnet in the same region and associated with a log group.