> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Encryption Vaults Should Be In Active And Secure State ### More Info: OCI Vaults should be in an active, healthy state with a secure vault type (DEFAULT or VIRTUAL\_PRIVATE). Vaults in degraded states may fail to serve encryption operations. ### Risk Level High ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Follow these steps in the OCI Console to ensure vaults are in **Active** and **Secure** state so they pass encryption monitoring checks: *** ### 1. Find vaults that are not Active/Secure 1. Sign in to the **OCI Console**. 2. In the top left, open the **Navigation Menu**. 3. Go to **Identity & Security → Vault**. 4. Select the **Compartment** where your vaults reside (top left compartment selector). 5. In the vault list, check the **Lifecycle state** column: * Look for states like **Pending deletion**, **Creating**, **Deleted**, or **Failed**. 6. Also check the **Vault type** and any security-related configuration (network access, key management). *** ### 2. Cancel deletion for vaults in “Pending deletion” If a vault is in **Pending deletion**, monitoring tools will flag it as not Active/Secure. 1. Click the **vault name**. 2. On the vault details page, check **Lifecycle state**. 3. If it is **Pending deletion**, click **Cancel deletion** (button near the top). 4. Confirm the action. 5. Wait until the **Lifecycle state** becomes **Active**. If **Cancel deletion** is not available (e.g., close to or past deletion time), you will need to: * Create a **new vault** (see next section) and * Re-create keys and update applications to use the new vault. *** ### 3. Create a new Active vault if needed If a vault is deleted or unusable: 1. Go to **Identity & Security → Vault**. 2. Click **Create vault**. 3. Fill in: * **Name**: meaningful name. * **Compartment**: choose correct compartment. * **Type**: * **Default** (Oracle-managed HSM) or **Virtual Private (Dedicated)** depending on your security requirements. * **Protection mode**: choose as per your policy. 4. Optionally configure: * **Network access** (if using private endpoint; prefer private where your policy requires it). 5. Click **Create vault**. 6. Wait until **Lifecycle state** is **Active**. Update all services and apps to use this new vault & keys. *** ### 4. Tighten security configuration (“Secure” state) To be considered “secure” by typical monitoring baselines, ensure: 1. **Access control (IAM):** * Go to **Identity & Security → Policies**. * Restrict vault access to minimum required groups. * Avoid broad policies like `allow group X to manage all-resources in tenancy` if not needed. 2. **Key management:** * Inside the vault, go to **Master Encryption Keys**. * Use **Customer-managed keys** for sensitive data. * Configure **key rotation**: * Open a key → **Key Protection** or **Rotation** settings → enable and set an appropriate rotation interval. 3. **Network exposure (for virtual private vaults):** * If available, prefer **private endpoints** controlled with security lists/NSGs. * Avoid unnecessary public access paths. *** ### 5. Verify remediation in Encryption Monitoring 1. After changes propagate (a few minutes), go to your **OCI Security/Monitoring tool** (e.g., Cloud Guard, Security Zones, or external CSPM). 2. Re-run or refresh the **OCI Encryption Monitoring** checks. 3. Confirm the finding for **“OCI Encryption Vaults Should Be In Active And Secure State”** is cleared or marked as remediated. *** If you tell me which monitoring product is raising this control (Cloud Guard, Security Zones, or third-party CSPM), I can map the above steps exactly to that tool’s requirement. Below is how to remediate and enforce **“OCI Encryption Vaults Should Be In Active And Secure State”** using **OCI CLI**, assuming: * **Active** = vault lifecycle state is `ACTIVE` (not `PENDING_DELETION` / `DELETED`) * **Secure** = vault type is HSM-backed (`PROTECTION_MODE_HSM`) and keys are `ENABLED` *** ## 0. Prerequisites 1. OCI CLI installed and configured: ```bash theme={null} oci setup config ``` 2. Have these values handy (or replace with your own): ```bash theme={null} COMPARTMENT_OCID="" VAULT_OCID="" # used in some steps KEY_OCID="" # used in some steps ``` *** ## 1. List All Vaults and Check Their State ```bash theme={null} oci kms management vault list \ --compartment-id "$COMPARTMENT_OCID" \ --all \ --query "data[].{name:\"display-name\", id:id, lifecycle:\"lifecycle-state\", type:\"vault-type\"}" \ --output table ``` * You want: * `lifecycle-state` = `ACTIVE` * `vault-type` = `DEFAULT` or `VIRTUAL_PRIVATE` (both are valid types; “secure” comes from HSM-backed keys rather than vault-type) If any vaults show `PENDING_DELETION`, remediate in step 2. *** ## 2. Cancel Vaults in Pending Deletion (So They Become Active) Get vaults in `PENDING_DELETION`: ```bash theme={null} oci kms management vault list \ --compartment-id "$COMPARTMENT_OCID" \ --all \ --query "data[?\"lifecycle-state\"=='PENDING_DELETION'].{name:\"display-name\", id:id}" \ --output table ``` For each `id` returned, cancel pending deletion: ```bash theme={null} oci kms management vault cancel-vault-deletion \ --vault-id "" ``` Verify the state is now `ACTIVE`: ```bash theme={null} oci kms management vault get \ --vault-id "" \ --query "data.{name:\"display-name\", lifecycle:\"lifecycle-state\"}" \ --output table ``` *** ## 3. Ensure Keys in the Vault Are in Secure (HSM) and Enabled State List keys for a specific vault: ```bash theme={null} oci kms management key list \ --compartment-id "$COMPARTMENT_OCID" \ --all \ --query "data[?\"vault-id\"=='$VAULT_OCID'].{name:\"display-name\", id:id, state:\"lifecycle-state\", mode:\"protection-mode\"}" \ --output table ``` You want: * `lifecycle-state` = `ENABLED` * `protection-mode` = `HSM` (this is what typically satisfies “secure”) ### 3.1 Enable Any Disabled Keys Find DISABLED keys: ```bash theme={null} oci kms management key list \ --compartment-id "$COMPARTMENT_OCID" \ --all \ --query "data[?\"vault-id\"=='$VAULT_OCID' && \"lifecycle-state\"=='DISABLED'].{name:\"display-name\", id:id}" \ --output table ``` For each `id`: ```bash theme={null} oci kms management key enable \ --key-id "" ``` Verify: ```bash theme={null} oci kms management key get \ --key-id "" \ --query "data.{name:\"display-name\", state:\"lifecycle-state\"}" \ --output table ``` ### 3.2 Recreate Non-HSM Keys as HSM Keys (If Required) You **cannot** change `protection-mode` of an existing key.\ If compliance requires HSM, create new HSM-backed keys and migrate usage to them. Create an HSM key in the vault: ```bash theme={null} oci kms management key create \ --compartment-id "$COMPARTMENT_OCID" \ --display-name "hsm-secure-key-1" \ --vault-id "$VAULT_OCID" \ --protection-mode HSM \ --key-shape '{"algorithm":"AES","length":32}' ``` Confirm: ```bash theme={null} oci kms management key list \ --compartment-id "$COMPARTMENT_OCID" \ --all \ --query "data[?\"vault-id\"=='$VAULT_OCID' && \"display-name\"=='hsm-secure-key-1'].{name:\"display-name\", id:id, mode:\"protection-mode\", state:\"lifecycle-state\"}" \ --output table ``` Then: * Update any services that used SOFTWARE keys to use these new HSM keys. * Optionally schedule deletion of old (non-HSM) keys once unused. *** ## 4. (Optional) Create New “Compliant” Vaults If some vaults cannot be recovered or you want dedicated, clean ones: ```bash theme={null} oci kms management vault create \ --compartment-id "$COMPARTMENT_OCID" \ --display-name "secure-vault-1" \ --vault-type DEFAULT ``` After creation, create only HSM-backed keys in it (step 3.2). *** ## 5. Scriptable Remediation (Bulk) Example shell skeleton to auto-cancel pending deletions and list non-secure keys: ```bash theme={null} #!/bin/bash COMPARTMENT_OCID="" # Cancel pending-deletion vaults for vid in $(oci kms management vault list \ --compartment-id "$COMPARTMENT_OCID" --all \ --query "data[?\"lifecycle-state\"=='PENDING_DELETION'].id" \ --raw-output); do oci kms management vault cancel-vault-deletion --vault-id "$vid" done # Show keys that are not ENABLED or not HSM oci kms management key list \ --compartment-id "$COMPARTMENT_OCID" --all \ --query "data[?\"lifecycle-state\"!='ENABLED' || \"protection-mode\"!='HSM'].[\"display-name\", id, \"lifecycle-state\", \"protection-mode\", \"vault-id\"]" \ --output table ``` Use the last list to manually fix keys (enable or recreate as HSM). *** If you share the exact policy/rule text or tool generating this finding, I can adjust the CLI steps to match its exact definition of “active” and “secure.” Below is how to handle this using Python and the OCI SDK: both to **monitor** vault state and to **remediate** what’s actually remediable. > Important: In OCI you cannot “undelete” a vault that is already in `PENDING_DELETION` or `DELETED`. For those, remediation is to create a new vault and re-point workloads. *** ## 1. Prerequisites 1. Install OCI Python SDK: ```bash theme={null} pip install oci ``` 2. Make sure you have a working OCI config file (`~/.oci/config`) with: * tenancy * user * fingerprint * key\_file * region * profile (e.g., `DEFAULT`) *** ## 2. What “Active and Secure” means in practice For OCI Vaults, minimal checks: * `lifecycle_state == "ACTIVE"` * `is_primary` vault (if you use replication, ensure primary is healthy) * Not `PENDING_DELETION` * Optionally: ensure keys inside vault are `ENABLED` and not pending deletion. You cannot change lifecycle from DELETED/PENDING\_DELETION back to ACTIVE. So: * Non-remediable: `PENDING_DELETION` or `DELETED` → must create a new vault and migrate. * Remediable: misconfig around monitoring, key states, policy, etc. Below are Python examples to: 1. **Monitor** vault states and keys. 2. **Create** a replacement vault when you detect a non-secure one. 3. Optionally export findings for your monitoring. *** ## 3. Python: List and Check Vaults ```python theme={null} import oci from oci.key_management import KmsManagementClient config = oci.config.from_file("~/.oci/config", "DEFAULT") kms_vault_client = oci.key_management.KmsVaultClient(config) compartment_id = "" # put your compartment OCID here def list_vaults(compartment_id): vaults = [] list_vaults_response = oci.pagination.list_call_get_all_results( kms_vault_client.list_vaults, compartment_id=compartment_id ) for v in list_vaults_response.data: vaults.append(v) return vaults def is_vault_secure(vault): """ Define your 'secure' criteria: - lifecycle_state == ACTIVE - not pending deletion """ if vault.lifecycle_state != "ACTIVE": return False, f"Vault is not ACTIVE (state={vault.lifecycle_state})" if getattr(vault, "time_of_deletion", None): return False, "Vault is scheduled for deletion" return True, "Vault is ACTIVE and not scheduled for deletion" def check_all_vaults(compartment_id): vaults = list_vaults(compartment_id) results = [] for v in vaults: secure, reason = is_vault_secure(v) results.append({ "vault_id": v.id, "display_name": v.display_name, "lifecycle_state": v.lifecycle_state, "secure": secure, "reason": reason }) return results if __name__ == "__main__": vault_results = check_all_vaults(compartment_id) for r in vault_results: print( f"Vault: {r['display_name']} ({r['vault_id']}) " f"State: {r['lifecycle_state']}, Secure: {r['secure']}, Reason: {r['reason']}" ) ``` Use this in a scheduled job (Cron, OCI Functions, or OCI Scheduled Jobs) and push results into your monitoring stack (OCI Logging, OCI Monitoring, Prometheus, etc.). *** ## 4. Optional: Check Keys Inside Vaults A vault may be `ACTIVE` but the keys inside are `DISABLED` or `PENDING_DELETION`. This can break encryption operations. ```python theme={null} def list_keys_in_vault(vault): # Each vault has a management endpoint mgmt_endpoint = vault.management_endpoint mgmt_client = KmsManagementClient(config, service_endpoint=mgmt_endpoint) keys = oci.pagination.list_call_get_all_results( mgmt_client.list_keys, compartment_id=compartment_id ).data return mgmt_client, keys def is_key_secure(key): # Define 'secure' key requirements: # Example: must be ENABLED and not scheduled for deletion if key.lifecycle_state != "ENABLED": return False, f"Key not ENABLED (state={key.lifecycle_state})" if getattr(key, "time_of_deletion", None): return False, "Key is scheduled for deletion" return True, "Key is ENABLED and not scheduled for deletion" def check_keys_for_all_vaults(compartment_id): vaults = list_vaults(compartment_id) all_findings = [] for v in vaults: mgmt_client, keys = list_keys_in_vault(v) for k in keys: secure, reason = is_key_secure(k) all_findings.append({ "vault_id": v.id, "vault_name": v.display_name, "key_id": k.id, "key_name": k.display_name, "lifecycle_state": k.lifecycle_state, "secure": secure, "reason": reason }) return all_findings ``` *** ## 5. Remediation Strategy via Python ### 5.1. If Vault is `PENDING_DELETION` or `DELETED` You **cannot** move it back to ACTIVE. Remediation: 1. **Create a new vault**. 2. **Create equivalent keys**. 3. **Reconfigure apps/services** to use the new vault/keys. 4. Decommission old references. Example: create a new vault (Python): ```python theme={null} from oci.key_management.models import CreateVaultDetails def create_vault(compartment_id, display_name, vault_type="DEFAULT"): # vault_type: "DEFAULT" or "VIRTUAL_PRIVATE" create_details = CreateVaultDetails( compartment_id=compartment_id, display_name=display_name, vault_type=vault_type ) response = kms_vault_client.create_vault(create_details) return response.data # a Vault object if __name__ == "__main__": new_vault = create_vault(compartment_id, "replacement-vault") print(f"Created new vault: {new_vault.display_name}, OCID={new_vault.id}, state={new_vault.lifecycle_state}") ``` Then re-create keys: ```python theme={null} from oci.key_management.models import CreateKeyDetails, KeyShape def create_key_in_vault(vault, key_name, algorithm="AES", length=32): mgmt_client = KmsManagementClient(config, service_endpoint=vault.management_endpoint) key_shape = KeyShape( algorithm=algorithm, # e.g., "AES", "RSA" length=length * 8 # length is in bits, e.g., 32 bytes * 8 = 256 bits ) create_key_details = CreateKeyDetails( compartment_id=compartment_id, display_name=key_name, key_shape=key_shape ) response = mgmt_client.create_key(create_key_details) return response.data if __name__ == "__main__": new_key = create_key_in_vault(new_vault, "replacement-key") print(f"Created new key: {new_key.display_name}, OCID={new_key.id}, state={new_key.lifecycle_state}") ``` After that, update: * Block storage, File Storage, Object Storage, DB, etc., to point to the new vault/key OCID. This “re-pointing” is service-specific and usually done via each resource’s update API or console. *** ## 6. Enabling Disabled Keys (Remediable) If a key is `DISABLED` but you want it active again: ```python theme={null} def enable_key(vault, key_id): mgmt_client = KmsManagementClient(config, service_endpoint=vault.management_endpoint) mgmt_client.enable_key(key_id) print(f"Enabled key: {key_id}") ``` You can combine this with the audit loop: when a key is found `DISABLED`, you decide (by policy) whether to auto-enable or just alert. *** ## 7. Wiring to Monitoring To integrate with “OCI Encryption Monitoring”: * Run the check scripts on a schedule (e.g., OCI Functions + OCI Events, or an external scheduler). * For each vault/key that fails your “secure” criteria: * Log a structured JSON line with vault\_id, key\_id, state, reason. * Publish metrics via OCI Monitoring’s `put_metric_data` if you want dashboards/alarms (e.g., `non_secure_vault_count`). Skeleton for sending a custom metric: ```python theme={null} import oci from datetime import datetime, timezone monitoring_client = oci.monitoring.MonitoringClient(config) def push_vault_metric(namespace, compartment_id, metric_name, value, dimensions=None): if dimensions is None: dimensions = {} metric_data = oci.monitoring.models.MetricDataDetails( namespace=namespace, compartment_id=compartment_id, name=metric_name, dimensions=dimensions, datapoints=[ oci.monitoring.models.Datapoint( timestamp=datetime.now(timezone.utc), value=value ) ]) details = oci.monitoring.models.PostMetricDataDetails( metric_data=[metric_data] ) monitoring_client.post_metric_data(details) ``` Example: ```python theme={null} # count how many non-secure vaults we have non_secure_count = sum(1 for r in vault_results if not r["secure"]) push_vault_metric( namespace="encryption_monitoring", compartment_id=compartment_id, metric_name="non_secure_vault_count", value=non_secure_count ) ``` *** ## 8. Summary Remediation Process 1. Use the Python scripts above to list all vaults and keys. 2. Flag anything not `ACTIVE` (vault) or not `ENABLED` (key). 3. For: * `PENDING_DELETION`/`DELETED` vaults → create new vault + keys, update all dependent resources. * `DISABLED` keys (where policy allows) → call `enable_key`. 4. Feed results to OCI Monitoring/Logging so you can alarm on non-secure states. If you share your exact “secure state” policy (e.g., specific algorithms, minimum key length, rotation rules), I can extend the Python checks and remediation steps to match it exactly. ```hcl theme={null} resource "oci_kms_vault" "encryption_vault" { # Replace with the OCID of the compartment where the vault should live compartment_id = var.COMPARTMENT_OCID # set var.COMPARTMENT_OCID to your compartment OCID # Replace with your desired vault name display_name = "ENCRYPTION_VAULT_NAME" # Use one of the secure vault types required by the check # Allowed values: "DEFAULT" or "VIRTUAL_PRIVATE" vault_type = "VIRTUAL_PRIVATE" } ``` Notes: * `vault_type` is only set at creation; changing it in Terraform forces replacement of the vault and all keys/objects in it. This is an outage-scale, irreversible change. * Vault “health/active” state (e.g., degraded vs healthy) is an OCI runtime property and cannot be forced or repaired via Terraform; you must use the OCI Console and/or support to recover a degraded vault. Verification with `terraform plan`: * For an existing vault with a non‑secure or different `vault_type`, the plan will show the existing `oci_kms_vault` being destroyed and a new one created with `vault_type = "VIRTUAL_PRIVATE"` (or `"DEFAULT"`), and no other unrelated changes.