OCI Encryption Storage Buckets Should Use Customer-Managed KMS Keys

Using Console

Below are the step‑by‑step remediation steps using the OCI Console so that an Object Storage bucket uses a customer‑managed KMS key instead of the Oracle‑managed default key.

1. Confirm / Create a Vault

In the OCI Console, open the navigation menu.
Go to Identity & Security → Vault.
Make sure you are in the correct compartment.
If you don’t have a vault yet:
- Click Create vault.
- Enter Name, select Compartment.
- Choose Vault type (Default or Virtual Private).
- Click Create vault and wait until its lifecycle state is Active.

2. Create / Identify a Customer-Managed Key

Open the vault you plan to use.
Go to the Master Encryption Keys (or Keys) tab.
To create a new key:
- Click Create key.
- Select Key shape (e.g., AES, 256‑bit).
- Set Protection mode to HSM or Software as required.
- Provide a Name and optional description.
- Click Create key and wait for it to become Enabled.

Keep note of the key and vault (they must be in a region that supports the bucket’s region).

3. Update the Bucket to Use the Customer-Managed KMS Key

In the OCI Console, go to Storage → Buckets.
Choose the Compartment where your “OCI Encryption Monitoring” bucket (or target bucket) resides.
Click the bucket name you want to remediate.
On the bucket details page, click Edit (top-right).
In the Encryption section:
- Change from Encrypt using Oracle-managed keys to Encrypt using Customer-managed keys.
- Select the Vault created earlier.
- Select the Master Encryption Key you created/identified.
Click Save changes (or Update).

OCI will now use your customer-managed KMS key for that bucket’s encryption going forward.

4. (Optional) Verify Configuration

Return to the bucket details page.
Under Encryption, confirm it shows:
- Customer-managed keys.
- The correct Vault and Key.

This completes remediation for the finding “OCI Encryption Storage Buckets Should Use Customer-Managed KMS Keys” using the OCI Console.

Using CLI

Below are the exact steps to remediate “OCI Encryption Storage Buckets Should Use Customer-Managed KMS Keys” using the OCI CLI.Assumptions:

You already have the OCI CLI configured (oci setup config done).
You know your compartment OCID and region (or are using defaults in ~/.oci/config).

1. Create (or identify) a Customer-Managed KMS Key

1.1. Create a Vault (if you don’t have one)

COMPARTMENT_OCID="<your_compartment_ocid>"
VAULT_NAME="my-vault"

oci kms management vault create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$VAULT_NAME" \
  --vault-type DEFAULT

Get the vault OCID and management endpoint:

oci kms management vault list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$VAULT_NAME" \
  --all

From the output, note:

id → VAULT_OCID
management-endpoint → KMS_ENDPOINT

VAULT_OCID="<vault_ocid_from_previous_command>"
KMS_ENDPOINT="<management_endpoint_from_previous_command>"

1.2. Create a Master Encryption Key

KEY_NAME="os-bucket-key"

oci kms management key create \
  --endpoint "$KMS_ENDPOINT" \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$KEY_NAME" \
  --key-shape '{"algorithm":"AES","length":32}'

Get the key OCID:

oci kms management key list \
  --endpoint "$KMS_ENDPOINT" \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$KEY_NAME" \
  --all

Note the id as:

KEY_OCID="<key_ocid_from_previous_command>"

If you already have a CMK created, just identify its KEY_OCID and skip the creation steps.

2. Identify Buckets Not Using Customer-Managed Keys

Get the Object Storage namespace:

NAMESPACE=$(oci os ns get --query 'data' --raw-output)

List all buckets in a compartment with their current KMS key:

oci os bucket list \
  --compartment-id "$COMPARTMENT_OCID" \
  --fields "kmsKeyId" \
  --all

In the output:

Buckets with "kmsKeyId": null are using Oracle-managed keys.
Buckets with "kmsKeyId": "<ocid1.key...>" are already using a CMK.

3. Update a Single Bucket to Use the Customer-Managed KMS Key

BUCKET_NAME="<your_bucket_name>"

oci os bucket update \
  --namespace-name "$NAMESPACE" \
  --name "$BUCKET_NAME" \
  --kms-key-id "$KEY_OCID"

Verify:

oci os bucket get \
  --namespace-name "$NAMESPACE" \
  --name "$BUCKET_NAME" \
  --fields "kmsKeyId"

You should see "kmsKeyId": "<your_key_ocid>".

4. Bulk Remediation: Update All Non-Compliant Buckets in a Compartment

This example updates every bucket in the compartment that does not yet have kmsKeyId set.

NAMESPACE=$(oci os ns get --query 'data' --raw-output)
COMPARTMENT_OCID="<your_compartment_ocid>"
KEY_OCID="<your_key_ocid>"

# List non-compliant buckets (kmsKeyId == null)
NON_COMPLIANT_BUCKETS=$(oci os bucket list \
  --compartment-id "$COMPARTMENT_OCID" \
  --fields "kmsKeyId" \
  --all \
  --query "data[?kmsKeyId==null].name" \
  --raw-output)

for BUCKET in $NON_COMPLIANT_BUCKETS; do
  echo "Updating bucket: $BUCKET to use KMS key: $KEY_OCID"
  oci os bucket update \
    --namespace-name "$NAMESPACE" \
    --name "$BUCKET" \
    --kms-key-id "$KEY_OCID"
done

5. (Optional) Script for Monitoring / Reporting via CLI

To only monitor (no changes), you can run:

oci os bucket list \
  --compartment-id "$COMPARTMENT_OCID" \
  --fields "kmsKeyId" \
  --all \
  --query "data[?kmsKeyId==null].{name:name, namespace:namespace}" \
  --output table

This will show all buckets in the compartment that are still using Oracle-managed encryption, which you can feed into your monitoring or alerting.

Using Python

Below is a concise, practical way to remediate this finding using Python and the OCI SDK: detect buckets not using a customer-managed KMS key and update them to use one.

1. Prerequisites

OCI Python SDK installed

pip install oci

Configured OCI credentials (one of):

~/.oci/config with a profile, e.g. [DEFAULT]
Or use instance principal / resource principal (for functions) – code below shows both patterns.

Existing Vault and KMS Key

You must already have:

vault_id (OCID of the KMS vault)
kms_key_id (OCID of the key inside that vault you want to use for bucket encryption)

IAM Policies

The principal running this script must be allowed to:

Allow group <your-group> to manage buckets in compartment <compartment-name>
Allow group <your-group> to use keys in compartment <vault-compartment-name> where target.key.id = '<kms-key-ocid>'

(Adjust for dynamic groups if using instance/resource principals.)

2. Script Outline

What it does:

Lists all compartments (or uses a specific one).
Lists all Object Storage buckets per compartment.
Identifies buckets where:
- kms_key_id is None (Oracle-managed encryption) OR
- kms_key_id is not the desired KMS key.
Updates each such bucket to use the customer-managed KMS key.

3. Python Remediation Script

import oci

# ----------------- CONFIGURATION -----------------
# Either use config file:
USE_INSTANCE_PRINCIPAL = False
CONFIG_PROFILE = "DEFAULT"

TENANCY_OCID = "<your-tenancy-ocid>"
# If you only want to remediate a single compartment, set COMPARTMENT_OCID
# otherwise leave it None to scan all compartments in the tenancy.
COMPARTMENT_OCID = None

# Target customer-managed KMS key:
TARGET_KMS_KEY_ID = "<your-kms-key-ocid>"   # ocid1.key.oc1...
# Region for Object Storage:
REGION = "us-ashburn-1"
# -------------------------------------------------


def get_signer_and_config():
    if USE_INSTANCE_PRINCIPAL:
        signer = oci.auth.signers.InstancePrincipalsSecurityTokenSigner()
        config = {"region": REGION, "tenancy": TENANCY_OCID}
    else:
        config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
        config["region"] = REGION
        signer = None
    return config, signer


def list_compartments(identity_client, tenancy_id):
    """List all active compartments in the tenancy."""
    compartments = []
    response = oci.pagination.list_call_get_all_results(
        identity_client.list_compartments,
        tenancy_id,
        compartment_id_in_subtree=True
    )
    for c in response.data:
        if c.lifecycle_state == "ACTIVE":
            compartments.append(c)
    return compartments


def remediate_buckets_in_compartment(object_storage_client, compartment_id, namespace, target_kms_key_id):
    # List buckets in this compartment
    buckets = oci.pagination.list_call_get_all_results(
        object_storage_client.list_buckets,
        namespace,
        compartment_id=compartment_id
    ).data

    for bucket in buckets:
        bucket_name = bucket.name
        current_kms_key_id = bucket.kms_key_id

        # Skip if already using the desired key
        if current_kms_key_id == target_kms_key_id:
            continue

        print(f"Updating bucket '{bucket_name}' (compartment: {compartment_id}) "
              f"from kms_key_id={current_kms_key_id} to {target_kms_key_id}")

        update_details = oci.object_storage.models.UpdateBucketDetails(
            kms_key_id=target_kms_key_id
        )

        object_storage_client.update_bucket(
            namespace_name=namespace,
            bucket_name=bucket_name,
            update_bucket_details=update_details
        )


def main():
    config, signer = get_signer_and_config()

    identity_client = oci.identity.IdentityClient(config, signer=signer)
    object_storage_client = oci.object_storage.ObjectStorageClient(config, signer=signer)

    # Get namespace (Object Storage is per-tenant per-region)
    namespace = object_storage_client.get_namespace().data

    if COMPARTMENT_OCID:
        # Only remediate one compartment
        remediate_buckets_in_compartment(
            object_storage_client,
            COMPARTMENT_OCID,
            namespace,
            TARGET_KMS_KEY_ID
        )
    else:
        # Remediate all compartments in the tenancy
        compartments = list_compartments(identity_client, TENANCY_OCID)
        for comp in compartments:
            print(f"Scanning compartment: {comp.name} ({comp.id})")
            remediate_buckets_in_compartment(
                object_storage_client,
                comp.id,
                namespace,
                TARGET_KMS_KEY_ID
            )


if __name__ == "__main__":
    main()

4. How This Ties to “Encryption Monitoring”

If you are using Cloud Guard / Security Zones / Cloud Advisor with a control such as “OCI Encryption Storage Buckets Should Use Customer-Managed KMS Keys,” rerun the detector after this script:

All buckets will have kms_key_id set to your customer-managed key.
The encryption control should move from “Problem” to “Resolved” state once the service re-evaluates.

If you share whether you want to target only specific compartments, tags, or exclude some buckets, I can adjust the script accordingly.

Using Terraform

# Customer-managed KMS vault
resource "oci_kms_vault" "cmk_vault" {
  compartment_id = "OCID_OF_BUCKET_COMPARTMENT"  # replace with the compartment OCID
  display_name   = "CUSTOMER_MANAGED_VAULT_NAME" # replace with desired vault name
  vault_type     = "DEFAULT"
}

# Customer-managed KMS key
resource "oci_kms_key" "cmk_key" {
  compartment_id = "OCID_OF_BUCKET_COMPARTMENT"  # replace with the compartment OCID
  display_name   = "CUSTOMER_MANAGED_KEY_NAME"   # replace with desired key name
  management_endpoint = oci_kms_vault.cmk_vault.management_endpoint

  key_shape {
    algorithm = "AES"
    length    = 256
  }
}

# Object Storage bucket using the customer-managed KMS key
resource "oci_objectstorage_bucket" "encrypted_bucket" {
  compartment_id = "OCID_OF_BUCKET_COMPARTMENT"   # replace with the compartment OCID
  name           = "BUCKET_NAME"                  # replace with the bucket name
  namespace      = "OBJECTSTORAGE_NAMESPACE"      # replace with your Object Storage namespace

  # This is the setting that remediates the finding
  kms_key_id = oci_kms_key.cmk_key.id
}

Changing kms_key_id on an existing oci_objectstorage_bucket updates the bucket in place; it does not force replacement, so no outage is expected.To verify, terraform plan should show an in-place ~ update on oci_objectstorage_bucket.encrypted_bucket with kms_key_id changing from null (or the old key OCID) to the OCID of oci_kms_key.cmk_key.

OCI Misconfigurations

OCI Encryption Storage Buckets Should Use Customer-Managed KMS Keys

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Confirm / Create a Vault

2. Create / Identify a Customer-Managed Key

3. Update the Bucket to Use the Customer-Managed KMS Key

4. (Optional) Verify Configuration

1. Create (or identify) a Customer-Managed KMS Key

1.1. Create a Vault (if you don’t have one)

1.2. Create a Master Encryption Key

2. Identify Buckets Not Using Customer-Managed Keys

3. Update a Single Bucket to Use the Customer-Managed KMS Key

4. Bulk Remediation: Update All Non-Compliant Buckets in a Compartment

5. (Optional) Script for Monitoring / Reporting via CLI

1. Prerequisites

2. Script Outline

3. Python Remediation Script

4. How This Ties to “Encryption Monitoring”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Confirm / Create a Vault

​2. Create / Identify a Customer-Managed Key

​3. Update the Bucket to Use the Customer-Managed KMS Key

​4. (Optional) Verify Configuration

​1. Create (or identify) a Customer-Managed KMS Key

​1.1. Create a Vault (if you don’t have one)

​1.2. Create a Master Encryption Key

​2. Identify Buckets Not Using Customer-Managed Keys

​3. Update a Single Bucket to Use the Customer-Managed KMS Key

​4. Bulk Remediation: Update All Non-Compliant Buckets in a Compartment

​5. (Optional) Script for Monitoring / Reporting via CLI

​1. Prerequisites

​2. Script Outline

​3. Python Remediation Script

​4. How This Ties to “Encryption Monitoring”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Confirm / Create a Vault

2. Create / Identify a Customer-Managed Key

3. Update the Bucket to Use the Customer-Managed KMS Key

4. (Optional) Verify Configuration

1. Create (or identify) a Customer-Managed KMS Key

1.1. Create a Vault (if you don’t have one)

1.2. Create a Master Encryption Key

2. Identify Buckets Not Using Customer-Managed Keys

3. Update a Single Bucket to Use the Customer-Managed KMS Key

4. Bulk Remediation: Update All Non-Compliant Buckets in a Compartment

5. (Optional) Script for Monitoring / Reporting via CLI

1. Prerequisites

2. Script Outline

3. Python Remediation Script

4. How This Ties to “Encryption Monitoring”