OCI Kubernetes Engine Cluster boot volume is not configured with in-transit data encryption misconfi

Rule Details

Cortex AppSec Rule ID	APPSEC2_OCI_5
Category - Subcategory	Storage - Encryption
Provider	ORACLE
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

This rule is assessing whether the Kubernetes Engine Cluster boot volume is set up with in-transit data encryption. The reason why failing to implement this can be harmful is because unencrypted data can be easily intercepted during transit, potentially leading to a confidentiality breach. Enabling in-transit data encryption ensures that the data being transferred cannot be understood if intercepted, and hence, prevents unauthorized access to sensitive information.

How to Fix

Resource: oci_containerengine_node_pool

• Arguments: node_config_details.is_pv_encryption_in_transit_enabled

To fix the issue, you should enable in-transit data encryption for the boot volume of the Kubernetes Engine Cluster. You can do this by setting the "is_pv_encryption_in_transit_enabled" attribute to "TRUE" in your resource block. [source,go]

resource "oci_containerengine_node_pool" "example" { ... node_config_details {

• is_pv_encryption_in_transit_enabled = false } }

---