OCI Compute Instance boot volume has in-transit data encryption is disabled misconfiguration detecte

Rule Details

Cortex AppSec Rule ID	APPSEC_OCI_4
Category - Subcategory	Compute - Unsanctioned Resource Or Type
Provider	ORACLE
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

This rule identifies the OCI Compute Instances that are configured with disabled in-transit data encryption boot or block volumes. It is recommended that Compute Instance boot or block volumes should be configured with in-transit data encryption to minimize risk for sensitive data being leaked.

How to Fix

Resource: oci_core_instance

• Arguments: is_pv_encryption_in_transit_enabled [source,go]

---

resource "oci_core_instance" "pass" { ...

} ipxe_script = var.instance_ipxe_script is_pv_encryption_in_transit_enabled = var.instance_is_pv_encryption_in_transit_enabled

launch_options { boot_volume_type = var.instance_launch_options_boot_volume_type firmware = var.instance_launch_options_firmware is_consistent_volume_naming_enabled = var.instance_launch_options_is_consistent_volume_naming_enabled is_pv_encryption_in_transit_enabled = true network_type = var.instance_launch_options_network_type remote_data_volume_type = var.instance_launch_options_remote_data_volume_type } ... }