> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Compute Instances Should Have Secure Boot Enabled

### More Info:

Compute instances should have Shielded Instance secure boot enabled. Secure boot ensures only verified, trusted firmware and OS components are loaded during startup, preventing rootkit attacks

### Risk Level

High

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate “OCI Compute Instances Should Have Secure Boot Enabled” using the OCI Console, you need to enable Shielded Instance features (Secure Boot) on each affected instance.

        ### 1. Verify the instance can use Secure Boot

        1. In the OCI Console, go to:
           * **Menu → Compute → Instances**
        2. Click the **compartment** where the instance resides.
        3. Open the **instance details** page.
        4. Confirm:
           * The **shape** supports Shielded Instances.
           * The instance is using **UEFI** (most current platform images do).\
             If you do *not* see any “Shielding” options on the instance page, the shape or image likely doesn’t support Secure Boot; in that case, you must recreate the instance (see step 4).

        ### 2. Stop the instance

        1. From the instance details page, click **Stop**.
        2. Wait until the instance state is **Stopped**.

        ### 3. Enable Secure Boot on the instance

        1. On the same instance details page, in the **Resources** section (left side), look for **Shielding** (or similar).
        2. Click **Shielding** → **Edit**.
        3. Check **Enable Secure Boot**.
        4. (Optional but recommended) Also enable **Trusted Platform Module (TPM)** and **Measured Boot** if your policy requires them.
        5. Click **Save changes**.

        ### 4. If Secure Boot cannot be enabled on the existing instance

        If there is no Shielding section or the option is disabled:

        1. Create a new instance with Secure Boot enabled:
           * **Menu → Compute → Instances → Create instance**
        2. Choose the **same image** (or an updated platform image) and **compatible shape**.
        3. In the **Image and shape** / **Advanced options** section, find **Shielding**:
           * Check **Enable Secure Boot**.
           * (Optionally) enable **TPM** and **Measured Boot**.
        4. Complete the rest of the instance configuration and **Create**.
        5. Migrate workload/data from the old instance (e.g., attach old boot/block volumes, restore from backup, etc.).
        6. Decommission the non‑compliant instance.

        ### 5. Confirm remediation for monitoring / Cloud Guard

        1. After starting the (updated or new) instance, ensure it is in **Running** state.
        2. In the instance details → **Shielding**, verify **Secure Boot: Enabled**.
        3. If you’re using **Cloud Guard** or a similar detector:
           * Allow time for the next evaluation cycle.
           * Confirm the “Compute Instances Should Have Secure Boot Enabled” problem is cleared.
      </Accordion>

      <Accordion title="Using CLI">
        Below are minimal, step‑by‑step OCI CLI instructions to enable Secure Boot on existing compute instances so that the “OCI Compute Instances Should Have Secure Boot Enabled” check passes.

        > Note: Secure Boot can only be enabled on supported shapes and while the instance is stopped.

        ***

        ### 1. Prerequisites

        * OCI CLI installed and configured (`oci setup config`)
        * OCID of the instance: `<INSTANCE_OCID>`
        * Shape must support Secure Boot (most recent VM shapes do)

        ***

        ### 2. Stop the Instance

        ```bash theme={null}
        oci compute instance action \
          --instance-id <INSTANCE_OCID> \
          --action SOFTSTOP
        ```

        Wait until it’s stopped:

        ```bash theme={null}
        oci compute instance get \
          --instance-id <INSTANCE_OCID> \
          --query "data.\"lifecycle-state\"" \
          --raw-output
        # Should return: STOPPED
        ```

        ***

        ### 3. Check Current Platform Configuration (Optional)

        ```bash theme={null}
        oci compute instance get \
          --instance-id <INSTANCE_OCID> \
          --query "data.\"platform-config\"" \
          --raw-output
        ```

        Note the `type` value (for example `AMD_VM`, `INTEL_VM`, `GENERIC_VM`, etc.).

        ***

        ### 4. Enable Secure Boot via CLI

        Use `instance update` with a `platform-config` block. Replace `<TYPE>` with the type you saw in step 3 (e.g. `AMD_VM`):

        ```bash theme={null}
        oci compute instance update \
          --instance-id <INSTANCE_OCID> \
          --platform-config '{
            "type": "<TYPE>",
            "isSecureBootEnabled": true
          }'
        ```

        Examples:

        ```bash theme={null}
        # AMD-based VM
        oci compute instance update \
          --instance-id <INSTANCE_OCID> \
          --platform-config '{
            "type": "AMD_VM",
            "isSecureBootEnabled": true
          }'

        # Intel-based VM
        oci compute instance update \
          --instance-id <INSTANCE_OCID> \
          --platform-config '{
            "type": "INTEL_VM",
            "isSecureBootEnabled": true
          }'
        ```

        If your shape still uses `launch-options` instead of `platform-config`, use:

        ```bash theme={null}
        oci compute instance update \
          --instance-id <INSTANCE_OCID> \
          --launch-options '{
            "isSecureBootEnabled": true
          }'
        ```

        ***

        ### 5. Start the Instance

        ```bash theme={null}
        oci compute instance action \
          --instance-id <INSTANCE_OCID> \
          --action START
        ```

        ***

        ### 6. Verify Secure Boot Status

        ```bash theme={null}
        oci compute instance get \
          --instance-id <INSTANCE_OCID> \
          --query "data.\"platform-config\".\"is-secure-boot-enabled\"" \
          --raw-output
        # Should return: true
        ```

        Once this flag is true for the instance, OCI Security/Monitoring checks for “Compute Instances Should Have Secure Boot Enabled” will pass for that resource.
      </Accordion>

      <Accordion title="Using Python">
        In OCI, Secure Boot is controlled per instance via its `launch_options`. You can remediate non‑compliant instances with the OCI Python SDK by:

        1. **Prerequisites**
           * Install SDK:
             ```bash theme={null}
             pip install oci
             ```
           * Have an OCI config file (`~/.oci/config`) or use instance principals.
           * The instance’s shape must support Secure Boot (UEFI). If not, enabling will fail.
           * You must have permission: `inspect/ use` on instances and `manage` if you will stop/update them.

        2. **High‑level remediation flow**

           For each target instance:

           1. Check current `launch_options.is_secure_boot_enabled`.
           2. If `False` or `None`:
              * Stop the instance (if running).
              * Call `UpdateInstance` with `launch_options.is_secure_boot_enabled = True`.
              * Start the instance again.

        3. **Python code example**

           ```python theme={null}
           import oci

           # -------------- CONFIGURE SDK -------------- #
           # Uses default profile from ~/.oci/config. Adjust as needed.
           config = oci.config.from_file()
           compute_client = oci.core.ComputeClient(config)
           compute_waiter = oci.core.ComputeClientCompositeOperations(compute_client)

           compartment_id = "<your_compartment_ocid>"  # scope of remediation

           # -------------- HELPER FUNCTIONS -------------- #
           def get_instances_in_compartment(compartment_id):
               instances = []
               list_response = oci.pagination.list_call_get_all_results(
                   compute_client.list_instances,
                   compartment_id=compartment_id,
                   lifecycle_state="RUNNING"  # or remove this filter to include STOPPED, etc.
               )
               instances.extend(list_response.data)
               return instances

           def ensure_secure_boot_enabled(instance):
               instance_id = instance.id
               details = compute_client.get_instance(instance_id).data

               launch_options = details.launch_options
               # launch_options can be None on some older instances
               if launch_options is None:
                   launch_options = oci.core.models.LaunchOptions()

               if launch_options.is_secure_boot_enabled:
                   print(f"[SKIP] Secure Boot already enabled on {details.display_name} ({instance_id})")
                   return

               print(f"[INFO] Enabling Secure Boot on {details.display_name} ({instance_id})")

               # 1) Stop instance if it is running
               if details.lifecycle_state == "RUNNING":
                   print(f"  - Stopping instance...")
                   stop_details = oci.core.models.InstanceActionDetails(
                       action="SOFTSTOP"  # or "STOP" for hard stop
                   )
                   compute_waiter.instance_action_and_wait_for_state(
                       instance_id,
                       stop_details,
                       wait_for_states=["STOPPED"]
                   )
                   print(f"  - Instance stopped.")

               # 2) Update instance launch options
               launch_options.is_secure_boot_enabled = True
               update_details = oci.core.models.UpdateInstanceDetails(
                   launch_options=launch_options
               )

               print(f"  - Updating instance launch options (enable Secure Boot)...")
               compute_client.update_instance(instance_id, update_details)
               # Wait for some non-transient state if desired
               oci.wait_until(
                   compute_client,
                   compute_client.get_instance(instance_id),
                   "lifecycle_state",
                   "STOPPED"
               )
               print(f"  - Secure Boot flag updated.")

               # 3) Start instance again (optional, based on your policy)
               print(f"  - Starting instance...")
               start_details = oci.core.models.InstanceActionDetails(action="START")
               compute_waiter.instance_action_and_wait_for_state(
                   instance_id,
                   start_details,
                   wait_for_states=["RUNNING"]
               )
               print(f"  - Instance running with Secure Boot enabled.")

           # -------------- MAIN REMEDIATION LOGIC -------------- #
           def remediate_secure_boot_in_compartment(compartment_id):
               instances = get_instances_in_compartment(compartment_id)
               for inst in instances:
                   try:
                       ensure_secure_boot_enabled(inst)
                   except oci.exceptions.ServiceError as e:
                       print(f"[ERROR] Could not update {inst.display_name} ({inst.id}): {e}")
                   except Exception as ex:
                       print(f"[ERROR] Unexpected error on {inst.display_name} ({inst.id}): {ex}")

           if __name__ == "__main__":
               remediate_secure_boot_in_compartment(compartment_id)
           ```

        4. **Using this with a “monitoring/compliance” flow**

        * Use an external scheduler (e.g., cron, CI/CD, or OCI Functions + Events) to:
          * Periodically list instances.
          * Check `is_secure_boot_enabled`.
          * Optionally only remediate those flagged as non‑compliant by your security/monitoring tool (e.g., Cloud Guard detector reports), by filtering on instance OCIDs provided by that tool.
        * Log every change (instance OCID, old state, new state, timestamp) for audit.

        If you specify how your “OCI Compute Monitoring” is surfacing non‑compliant instances (Cloud Guard, Logging, custom metrics), I can adapt the script to consume that input directly.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_core_instance" "SECURE_INSTANCE" {
          # Replace with your instance details
          availability_domain = "YOUR_AVAILABILITY_DOMAIN"
          compartment_id      = "YOUR_COMPARTMENT_OCID"
          display_name        = "YOUR_INSTANCE_NAME"
          shape               = "YOUR_SHAPE"

          source_details {
            source_type = "image"
            source_id   = "YOUR_IMAGE_OCID"
          }

          # Enable Shielded Instance secure boot
          launch_options {
            is_secure_boot_enabled = true
          }

          # ...any other arguments you already use (metadata, agent_config, vnics, etc.)...
        }
        ```

        Enabling `launch_options.is_secure_boot_enabled` on an existing `oci_core_instance` normally forces replacement of the instance, which will cause downtime; plan carefully before applying.

        For verification, `terraform plan` should show either a new `oci_core_instance` with `launch_options.is_secure_boot_enabled = true` or a `-/+` replacement of the existing instance where the only changed field (for this finding) is `is_secure_boot_enabled` from `false` (or `null`) to `true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>