Oracle Cloud Security Penetration and Vulnerability Testing

#!/usr/bin/env bash
set -euo pipefail

# PURPOSE:
# This script does NOT perform or register penetration tests.
# It collects context about all OKE clusters in the tenancy/compartment(s)
# so you can manually confirm whether:
# - required Oracle Cloud Security Testing Notifications have been submitted
# - any in-scope clusters are missing required approvals
#
# REQUIREMENTS:
# - OCI CLI configured with a user that can list compartments and OKE clusters
# - jq installed
#
# RUN ON: any admin workstation with OCI CLI access.

# ---------------------------------------------------------------------------
# CONFIGURATION
# ---------------------------------------------------------------------------

# Set the parent compartment OCID that contains your OKE compartments.
# If you want the entire tenancy, set this to your tenancy OCID.
PARENT_COMPARTMENT_OCID="ocid1.tenancy.oc1...."

# Optionally, narrow to specific regions (space-separated).
# Leave empty to use all regions configured for the tenancy.
REGIONS=()  # e.g.: REGIONS=(eu-frankfurt-1 us-ashburn-1)

# Optional: tag key used to mark clusters that have testing approval recorded
# (you define the process for maintaining this tag).
TEST_APPROVED_TAG_KEY="security-testing-approved"

# ---------------------------------------------------------------------------
# HELPER FUNCTIONS
# ---------------------------------------------------------------------------

get_all_regions() {
  if [ "${#REGIONS[@]}" -gt 0 ]; then
    printf "%s\n" "${REGIONS[@]}"
  else
    oci iam region list --all \
      | jq -r '.data[].name'
  fi
}

get_child_compartments() {
  local parent_ocid="$1"
  oci iam compartment list \
    --compartment-id "$parent_ocid" \
    --compartment-id-in-subtree true \
    --all \
    | jq -r '.data[] | select(.lifecycle-state=="ACTIVE") | [.name, .id] | @tsv'
}

list_oke_clusters_in_compartment() {
  local compartment_ocid="$1"
  local region="$2"
  oci ce cluster list \
    --compartment-id "$compartment_ocid" \
    --region "$region" \
    --all \
    | jq -r '.data[] | [.name, .id, .lifecycle-state, ."time-created"] | @tsv'
}

get_cluster_defined_tags() {
  local cluster_ocid="$1"
  local region="$2"
  oci ce cluster get \
    --cluster-id "$cluster_ocid" \
    --region "$region" \
    | jq -c '.data."defined-tags"'
}

get_cluster_freeform_tags() {
  local cluster_ocid="$1"
  local region="$2"
  oci ce cluster get \
    --cluster-id "$cluster_ocid" \
    --region "$region" \
    | jq -c '.data."freeform-tags"'
}

# ---------------------------------------------------------------------------
# MAIN
# ---------------------------------------------------------------------------

echo "Collecting OKE cluster inventory for security testing review..." >&2
echo "Parent compartment: $PARENT_COMPARTMENT_OCID" >&2
echo

echo -e "REGION\tCOMPARTMENT_NAME\tCOMPARTMENT_OCID\tCLUSTER_NAME\tCLUSTER_OCID\tSTATE\tTIME_CREATED\tAPPROVAL_TAG_PRESENT\tAPPROVAL_TAG_VALUE"

while IFS= read -r region; do
  while IFS=$'\t' read -r comp_name comp_ocid; do
    while IFS=$'\t' read -r c_name c_ocid c_state c_time; do
      [ -z "$c_ocid" ] && continue

      # Check tags that might record testing approval
      defined_tags_json=$(get_cluster_defined_tags "$c_ocid" "$region")
      freeform_tags_json=$(get_cluster_freeform_tags "$c_ocid" "$region")

      approval_value=""
      approval_present="no"

      # Search both defined and freeform tags for the configured key
      if echo "$defined_tags_json" | jq -e "to_entries[]?.value | select(has(\"$TEST_APPROVED_TAG_KEY\"))" >/dev/null 2>&1; then
        approval_value=$(echo "$defined_tags_json" | jq -r "to_entries[]?.value.\"$TEST_APPROVED_TAG_KEY\" // empty" | head -n1)
        [ -n "$approval_value" ] && approval_present="yes"
      fi

      if [ "$approval_present" = "no" ]; then
        # Fallback to freeform tags
        if echo "$freeform_tags_json" | jq -e "has(\"$TEST_APPROVED_TAG_KEY\")" >/dev/null 2>&1; then
          approval_value=$(echo "$freeform_tags_json" | jq -r ".\"$TEST_APPROVED_TAG_KEY\"")
          [ -n "$approval_value" ] && approval_present="yes"
        fi
      fi

      echo -e "${region}\t${comp_name}\t${comp_ocid}\t${c_name}\t${c_ocid}\t${c_state}\t${c_time}\t${approval_present}\t${approval_value}"
    done < <(list_oke_clusters_in_compartment "$comp_ocid" "$region")
  done < <(get_child_compartments "$PARENT_COMPARTMENT_OCID")
done < <(get_all_regions)