OCI Compute Instance has Legacy MetaData service endpoint enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_OCI_5
Category - Subcategory	Compute - Unsanctioned Resource Or Type
Provider	ORACLE
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule identifies the OCI Compute Instances that are configured with Legacy MetaData service (IMDSv1) endpoints enabled. It is recommended that Compute Instances should be configured with legacy v1 endpoints (Instance Metadata Service v1) being disabled, and use Instance Metadata Service v2 instead following security best practices.

How to Fix

Resource: oci_core_instance

• Arguments: instance_options.are_legacy_imds_endpoints_disabled [source,go]

---

resource "oci_core_instance" "pass" { ... instance_options { are_legacy_imds_endpoints_disabled = true } ... }