> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Compute Boot Volumes Should Have Backup Policy Assigned ### More Info: Boot volumes should have a backup policy assigned. Without automated backups, data loss from instance failure, corruption, or ransomware cannot be recovered. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate “OCI Compute Boot Volumes Should Have Backup Policy Assigned” using the OCI Console: ### 1. Assign a Backup Policy to Existing Boot Volumes 1. Sign in to the **OCI Console**. 2. In the left navigation menu, go to:\ **Menu → Storage → Block Storage → Boot Volumes**. 3. At the top, select the correct **Compartment** where your instances/boot volumes reside. 4. For each boot volume that shows **No backup policy**: 1. Click the **boot volume name**. 2. On the boot volume detail page, click **Assign Backup Policy** (or **Edit** if available). 3. In the **Backup Policy** dropdown, choose an appropriate predefined policy, for example: * `bronze` (daily, shorter retention) * `silver` (daily + weekly, medium retention) * `gold` (daily + weekly + monthly, longest retention)\ or your **custom policy** if you have one. 4. Click **Assign** (or **Save changes**). Repeat for all non-compliant boot volumes. *** ### 2. Set a Default Backup Policy for New Boot Volumes (Recommended) To avoid future non-compliance: 1. Go to: **Menu → Storage → Block Storage → Block Volume Backups → Policies**. 2. Either: * Use an existing **Predefined Policy**, or * Click **Create Policy** to define a custom schedule/retention. 3. Once you’ve chosen the policy, set it as default for a compartment: 1. Go to: **Menu → Identity & Security → Identity → Compartments**. 2. Select your **Compartment**. 3. Look for **Default backup policy for block/boot volumes** (wording may vary by console version). 4. Choose the desired backup policy and **Save**. New boot volumes in that compartment will automatically get this backup policy. *** ### 3. Verify Compliance (for Monitoring / Security Reports) 1. Return to: **Menu → Storage → Block Storage → Boot Volumes**. 2. Confirm that the **Backup Policy** column shows a policy (not “None”) for every boot volume. 3. If you are using **Cloud Guard / Security Zones / Security Center-like monitoring**, run or refresh the compliance check so the “boot volumes should have backup policy” finding is cleared. Below are step‑by‑step CLI instructions to assign an OCI Block Volume Backup Policy to Compute **boot volumes** so they comply with “Boot Volumes Should Have Backup Policy Assigned.” ### 1. Prerequisites 1. OCI CLI installed and configured (`~/.oci/config` with a working profile). 2. OCIDs ready: * Your **tenancy OCID** and/or **compartment OCID**. * User running CLI must have permissions to manage boot volumes and volume backup policies. Assume: * Profile: `DEFAULT` * Compartment OCID: `ocid1.compartment.oc1..xxxx` If you use a different profile, add `--profile ` to every `oci` command. *** ### 2. List Available Backup Policies First, see which backup policies exist in your region (Oracle‑managed or custom): ```bash theme={null} oci bv volume-backup-policy list \ --compartment-id ocid1.compartment.oc1..xxxx \ --all ``` Common Oracle‑managed policies are usually named like `gold`, `silver`, `bronze`.\ Pick the `policy-id` you want; call it: ```bash theme={null} TARGET_POLICY_OCID="ocid1.volumebackuppolicy.oc1..targetpolicyocid" ``` *** ### 3. List Boot Volumes in a Compartment ```bash theme={null} oci bv boot-volume list \ --compartment-id ocid1.compartment.oc1..xxxx \ --all \ --output table ``` Each entry has a `id` field; that is the **boot volume OCID**.\ For scripting, grab them as: ```bash theme={null} BOOT_VOLUME_IDS=$(oci bv boot-volume list \ --compartment-id ocid1.compartment.oc1..xxxx \ --all \ --query "data[].id" \ --raw-output) ``` *** ### 4. (Optional) Identify Boot Volumes Without a Policy To see current policy assignments for all volumes in the compartment: ```bash theme={null} oci bv volume-backup-policy-assignment list \ --compartment-id ocid1.compartment.oc1..xxxx \ --all ``` For a specific boot volume: ```bash theme={null} oci bv volume-backup-policy-assignment list \ --asset-id ``` If this returns an empty list, the boot volume has **no** backup policy and is non‑compliant. *** ### 5. Assign Backup Policy to a Single Boot Volume Use the chosen policy OCID from step 2 and the boot volume OCID from step 3: ```bash theme={null} oci bv volume-backup-policy-assignment create \ --asset-id \ --policy-id "$TARGET_POLICY_OCID" ``` Verify: ```bash theme={null} oci bv volume-backup-policy-assignment list \ --asset-id \ --output table ``` You should see the selected policy associated. *** ### 6. Bulk‑Assign Policy to All Boot Volumes in a Compartment This loop assigns the same backup policy to **every** boot volume in the compartment: ```bash theme={null} TARGET_POLICY_OCID="ocid1.volumebackuppolicy.oc1..targetpolicyocid" COMPARTMENT_ID="ocid1.compartment.oc1..xxxx" for BV_ID in $(oci bv boot-volume list \ --compartment-id "$COMPARTMENT_ID" \ --all \ --query "data[].id" \ --raw-output); do echo "Processing boot volume: $BV_ID" HAS_POLICY=$(oci bv volume-backup-policy-assignment list \ --asset-id "$BV_ID" \ --query "length(data)" \ --raw-output) if [ "$HAS_POLICY" -eq 0 ]; then echo " No policy found. Assigning $TARGET_POLICY_OCID..." oci bv volume-backup-policy-assignment create \ --asset-id "$BV_ID" \ --policy-id "$TARGET_POLICY_OCID" else echo " Policy already assigned. Skipping." fi done ``` *** ### 7. Confirm Compliance for Monitoring Re-run: ```bash theme={null} oci bv volume-backup-policy-assignment list \ --compartment-id ocid1.compartment.oc1..xxxx \ --all ``` Ensure every boot volume reported by: ```bash theme={null} oci bv boot-volume list \ --compartment-id ocid1.compartment.oc1..xxxx \ --all ``` has at least one corresponding `volume-backup-policy-assignment`. Your OCI monitoring / security/compliance tool should now show “Boot Volumes Should Have Backup Policy Assigned” as remediated. Here’s how you can remediate “OCI Compute Boot Volumes Should Have Backup Policy Assigned” using Python and the OCI SDK, by: 1. Finding boot volumes without a backup policy 2. Assigning a chosen backup policy to them *** ### 1. Prerequisites * Install the OCI Python SDK: ```bash theme={null} pip install oci ``` * Set up your `~/.oci/config` file with: * `tenancy`, `user`, `fingerprint`, `key_file`, `region` * A profile name, e.g. `[DEFAULT]` * Ensure the principal (user/group/instance/principal) has IAM permissions similar to: ```text theme={null} Allow group to read boot-volumes in tenancy Allow group to manage volume-backup-policies in tenancy Allow group to manage volume-backup-policy-assignments in tenancy ``` *** ### 2. Decide which Backup Policy to Apply You can use a predefined policy (e.g. “gold”, “silver”, “bronze”) or a custom one. Example: find available backup policies and pick one: ```python theme={null} import oci config = oci.config.from_file("~/.oci/config", "DEFAULT") blockstorage = oci.core.BlockstorageClient(config) # List predefined and custom volume backup policies in the region policies = blockstorage.list_volume_backup_policies().data for p in policies: print(p.id, p.display_name) ``` Copy the `id` of the policy you want, e.g.: ```python theme={null} TARGET_BACKUP_POLICY_ID = "ocid1.volumebackuppolicy.oc1..xxxxxx" ``` *** ### 3. Script: Assign Backup Policy to All Boot Volumes Without One This example: * Iterates over all compartments (recursive) * Lists boot volumes * Checks if each has at least one backup policy assignment * Assigns `TARGET_BACKUP_POLICY_ID` where missing ```python theme={null} import oci PROFILE = "DEFAULT" TARGET_BACKUP_POLICY_ID = "ocid1.volumebackuppolicy.oc1..xxxxxx" # your chosen policy config = oci.config.from_file("~/.oci/config", PROFILE) identity = oci.identity.IdentityClient(config) blockstorage = oci.core.BlockstorageClient(config) TENANCY_OCID = config["tenancy"] def list_all_compartments(tenancy_id): """Return a list of all active compartments (recursive).""" compartments = [] response = oci.pagination.list_call_get_all_results( identity.list_compartments, tenancy_id, compartment_id_in_subtree=True, access_level="ANY", lifecycle_state="ACTIVE" ) compartments.extend(response.data) # include root compartment itself root = identity.get_tenancy(tenancy_id).data root_compartment = oci.identity.models.Compartment( id=root.id, name=root.name, lifecycle_state="ACTIVE" ) compartments.append(root_compartment) return compartments def boot_volume_has_policy(boot_volume_id): """Return True if boot volume has at least one policy assignment.""" assignments = blockstorage.list_volume_backup_policy_assignments( asset_id=boot_volume_id ).data return len(assignments) > 0 def assign_policy_to_boot_volume(boot_volume_id, policy_id): """Assign a backup policy to the given boot volume.""" details = oci.core.models.CreateVolumeBackupPolicyAssignmentDetails( asset_id=boot_volume_id, policy_id=policy_id ) blockstorage.create_volume_backup_policy_assignment(details) print(f"Assigned policy {policy_id} to boot volume {boot_volume_id}") def remediate_all_boot_volumes(): compartments = list_all_compartments(TENANCY_OCID) for comp in compartments: comp_id = comp.id # List boot volumes in this compartment try: boot_volumes = oci.pagination.list_call_get_all_results( blockstorage.list_boot_volumes, availability_domain=None, # if omitted, lists all ADs for region compartment_id=comp_id ).data except oci.exceptions.ServiceError as e: print(f"Error listing boot volumes in compartment {comp_id}: {e}") continue for bv in boot_volumes: # bv is BootVolume if bv.lifecycle_state != "AVAILABLE": continue if boot_volume_has_policy(bv.id): print(f"Boot volume {bv.id} already has a policy assigned.") continue assign_policy_to_boot_volume(bv.id, TARGET_BACKUP_POLICY_ID) if __name__ == "__main__": remediate_all_boot_volumes() ``` *** ### 4. Integrate with Monitoring / Compliance Typical options: * Run this script on a schedule (e.g., cron on a bastion host, OCI Compute instance, or OCI Container Instances). * Or, wrap it as an OCI Function invoked by: * An Event from Cloud Guard/Cloud Events when a new boot volume/instance is created. * A periodic trigger (e.g., via external scheduler or Functions + Alarm/Event). The logic stays the same; only the execution environment changes. ```hcl theme={null} # Existing boot volume (example) resource "oci_core_boot_volume" "APP_BOOT_VOLUME" { # Replace with your actual details availability_domain = "AD_NAME" compartment_id = "COMPARTMENT_OCID" size_in_gbs = 50 vpus_per_gb = 10 display_name = "app-boot-volume" source_details { type = "image" id = "IMAGE_OCID" } } # Either reference an existing backup policy by OCID... # Replace BACKUP_POLICY_OCID with the OCID of your chosen backup policy # (e.g. Oracle-defined `gold`, `silver`, or `bronze` policy, or a custom one). # # variable "boot_volume_backup_policy_id" { # type = string # description = "OCID of the backup policy to assign to the boot volume" # } # ...or define a custom backup policy in Terraform: resource "oci_core_volume_backup_policy" "BOOT_VOLUME_BACKUP_POLICY" { compartment_id = "COMPARTMENT_OCID" display_name = "boot-volume-backup-policy" # Example: daily backups, keep 7 schedules { backup_type = "INCREMENTAL" period = "ONE_DAY" offset_seconds = 0 retention_seconds = 7 * 24 * 60 * 60 hour_of_day = 1 day_of_week = "MONDAY" month = "JANUARY" day_of_month = "1" schedule_type = "PERIODIC" time_zone = "UTC" } } # Assign the backup policy to the boot volume resource "oci_core_volume_backup_policy_assignment" "APP_BOOT_VOLUME_BACKUP_ASSIGNMENT" { # asset_id may be a boot volume or block volume OCID; here we use the boot volume asset_id = oci_core_boot_volume.APP_BOOT_VOLUME.id # Use either the custom policy defined above... policy_id = oci_core_volume_backup_policy.BOOT_VOLUME_BACKUP_POLICY.id # ...or, if using an existing policy, replace the line above with: # policy_id = var.boot_volume_backup_policy_id } ``` This change does not replace the existing boot volume; it only attaches a backup policy to it. For verification, `terraform plan` should show creation of an `oci_core_volume_backup_policy_assignment` resource (and optionally an `oci_core_volume_backup_policy` if you added one), with no planned replacement of the existing `oci_core_boot_volume`.