> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Oracle Cloud Security Penetration and Vulnerability Testing

### More Info:

Perform authorized penetration and vulnerability testing on Oracle Cloud services after reviewing the Oracle Cloud Testing Policies. Submit a Cloud Security Testing Notification with an appropriately privileged Oracle Account.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS OKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. **Confirm who can submit Cloud Security Testing Notifications**
           * In the OCI Console (any machine with browser access), go to **Identity & Security → Identity → Groups** and verify there is a group (for example, `sec-testing-admins`) with permissions to file service maintenance requests (typically groups that can open/modify Cloud Support Requests).
           * Go to **Identity & Security → Identity → Users** and confirm at least one active user in that group with MFA enabled and access to the tenancy/compartment where the Kubernetes cluster and related services run.

        2. **Review Oracle Cloud Security Testing Policy and scope**
           * Using a browser, open:\
             `https://docs.cloud.oracle.com/en-us/iaas/Content/Security/Concepts/security_testing-policy.htm`
           * Confirm that the services and regions you plan to test (VCN, Load Balancers, OKE clusters, compute nodes, object storage, etc.) are allowed under the policy, and note any prohibited activities, ports, or testing types.

        3. **Inventory resources and testing targets for the cluster**
           * On any machine with OCI CLI configured, list compartments and identify the one hosting your OKE cluster:
             ```bash theme={null}
             oci iam compartment list --all
             ```
           * List OKE clusters in the target compartment:
             ```bash theme={null}
             oci ce cluster list --compartment-id <COMPARTMENT_OCID> --all
             ```
           * Enumerate public-facing endpoints that may be in scope:
             ```bash theme={null}
             # Load balancers
             oci lb load-balancer list --compartment-id <COMPARTMENT_OCID> --all

             # Public subnets
             oci network subnet list --compartment-id <COMPARTMENT_OCID> --all \
               --query 'data[?contains("PUBLIC", lifecycle-state)==`true`]'
             ```
           * Capture this list as the proposed testing scope.

        4. **Submit a Cloud Security Testing Notification for the identified scope**
           * Log in to the OCI Console with the privileged Oracle Account.
           * From the console header, open **Help → Support Center → Create Support Request** (or equivalent in your region/console version).
           * Select the appropriate category for **Cloud Security Testing Notification** and fill in:
             * Tenancy OCID, compartments, and regions.
             * Exact resources/endpoints (from step 3).
             * Types of tests (e.g., network penetration test, web app scan, container image scan) aligned with the policy.
             * Planned dates and times, source IP ranges of your testing infrastructure, and any third-party testers.
           * Submit and record the Request/Reference ID.

        5. **Await and document Oracle’s approval/conditions**
           * Monitor the Support Request in the **Support Center** for approval or required changes (timing, scope, methods).
           * Save the approval message and any conditions (e.g., specific disallowed techniques) in your security documentation or IaC repo docs adjacent to the OKE/infra code.

        6. **Verify compliance and evidence for the benchmark**
           * Ensure you have:
             * A copy/screenshot of the submitted Cloud Security Testing Notification (request details and ID).
             * A copy/screenshot of Oracle’s approval/response showing the request status and allowed testing window.
           * Optionally, from any machine with OCI CLI, retrieve Support Request metadata (if enabled in your tenancy) to show status:
             ```bash theme={null}
             oci os object get --bucket-name <BUCKET_WITH_AUDIT_EXPORTS> \
               --name <PATH_TO_SUPPORT_REQUEST_LOG_OR_AUDIT_LOG> \
               --file /tmp/oci-support-request-log.json
             ```
           * Confirm that this documentation is current (covers your active OKE environment and testing schedule) to consider the control satisfied.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot be used to address this finding because it concerns Oracle Cloud account- and tenancy-level security testing approvals, not Kubernetes API objects. Remediation must be performed in the Oracle Cloud Console/OCI APIs/IaC at the cloud provider level; follow the guidance in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        set -euo pipefail

        # PURPOSE:
        # This script does NOT perform or register penetration tests.
        # It collects context about all OKE clusters in the tenancy/compartment(s)
        # so you can manually confirm whether:
        # - required Oracle Cloud Security Testing Notifications have been submitted
        # - any in-scope clusters are missing required approvals
        #
        # REQUIREMENTS:
        # - OCI CLI configured with a user that can list compartments and OKE clusters
        # - jq installed
        #
        # RUN ON: any admin workstation with OCI CLI access.

        # ---------------------------------------------------------------------------
        # CONFIGURATION
        # ---------------------------------------------------------------------------

        # Set the parent compartment OCID that contains your OKE compartments.
        # If you want the entire tenancy, set this to your tenancy OCID.
        PARENT_COMPARTMENT_OCID="ocid1.tenancy.oc1...."

        # Optionally, narrow to specific regions (space-separated).
        # Leave empty to use all regions configured for the tenancy.
        REGIONS=()  # e.g.: REGIONS=(eu-frankfurt-1 us-ashburn-1)

        # Optional: tag key used to mark clusters that have testing approval recorded
        # (you define the process for maintaining this tag).
        TEST_APPROVED_TAG_KEY="security-testing-approved"

        # ---------------------------------------------------------------------------
        # HELPER FUNCTIONS
        # ---------------------------------------------------------------------------

        get_all_regions() {
          if [ "${#REGIONS[@]}" -gt 0 ]; then
            printf "%s\n" "${REGIONS[@]}"
          else
            oci iam region list --all \
              | jq -r '.data[].name'
          fi
        }

        get_child_compartments() {
          local parent_ocid="$1"
          oci iam compartment list \
            --compartment-id "$parent_ocid" \
            --compartment-id-in-subtree true \
            --all \
            | jq -r '.data[] | select(.lifecycle-state=="ACTIVE") | [.name, .id] | @tsv'
        }

        list_oke_clusters_in_compartment() {
          local compartment_ocid="$1"
          local region="$2"
          oci ce cluster list \
            --compartment-id "$compartment_ocid" \
            --region "$region" \
            --all \
            | jq -r '.data[] | [.name, .id, .lifecycle-state, ."time-created"] | @tsv'
        }

        get_cluster_defined_tags() {
          local cluster_ocid="$1"
          local region="$2"
          oci ce cluster get \
            --cluster-id "$cluster_ocid" \
            --region "$region" \
            | jq -c '.data."defined-tags"'
        }

        get_cluster_freeform_tags() {
          local cluster_ocid="$1"
          local region="$2"
          oci ce cluster get \
            --cluster-id "$cluster_ocid" \
            --region "$region" \
            | jq -c '.data."freeform-tags"'
        }

        # ---------------------------------------------------------------------------
        # MAIN
        # ---------------------------------------------------------------------------

        echo "Collecting OKE cluster inventory for security testing review..." >&2
        echo "Parent compartment: $PARENT_COMPARTMENT_OCID" >&2
        echo

        echo -e "REGION\tCOMPARTMENT_NAME\tCOMPARTMENT_OCID\tCLUSTER_NAME\tCLUSTER_OCID\tSTATE\tTIME_CREATED\tAPPROVAL_TAG_PRESENT\tAPPROVAL_TAG_VALUE"

        while IFS= read -r region; do
          while IFS=$'\t' read -r comp_name comp_ocid; do
            while IFS=$'\t' read -r c_name c_ocid c_state c_time; do
              [ -z "$c_ocid" ] && continue

              # Check tags that might record testing approval
              defined_tags_json=$(get_cluster_defined_tags "$c_ocid" "$region")
              freeform_tags_json=$(get_cluster_freeform_tags "$c_ocid" "$region")

              approval_value=""
              approval_present="no"

              # Search both defined and freeform tags for the configured key
              if echo "$defined_tags_json" | jq -e "to_entries[]?.value | select(has(\"$TEST_APPROVED_TAG_KEY\"))" >/dev/null 2>&1; then
                approval_value=$(echo "$defined_tags_json" | jq -r "to_entries[]?.value.\"$TEST_APPROVED_TAG_KEY\" // empty" | head -n1)
                [ -n "$approval_value" ] && approval_present="yes"
              fi

              if [ "$approval_present" = "no" ]; then
                # Fallback to freeform tags
                if echo "$freeform_tags_json" | jq -e "has(\"$TEST_APPROVED_TAG_KEY\")" >/dev/null 2>&1; then
                  approval_value=$(echo "$freeform_tags_json" | jq -r ".\"$TEST_APPROVED_TAG_KEY\"")
                  [ -n "$approval_value" ] && approval_present="yes"
                fi
              fi

              echo -e "${region}\t${comp_name}\t${comp_ocid}\t${c_name}\t${c_ocid}\t${c_state}\t${c_time}\t${approval_present}\t${approval_value}"
            done < <(list_oke_clusters_in_compartment "$comp_ocid" "$region")
          done < <(get_child_compartments "$PARENT_COMPARTMENT_OCID")
        done < <(get_all_regions)
        ```

        Explanation of output and what indicates a problem:

        * Each line represents an OKE cluster.
        * Key columns:
          * `REGION`, `COMPARTMENT_NAME`, `CLUSTER_NAME`, `CLUSTER_OCID`: identify the cluster that might be in scope for penetration/vulnerability testing.
          * `STATE`: clusters in `ACTIVE` or `CREATING` state are typically in scope for review.
          * `APPROVAL_TAG_PRESENT`: `yes` if the cluster has a tag named `security-testing-approved` (or whatever you configure in `TEST_APPROVED_TAG_KEY`), `no` otherwise.
          * `APPROVAL_TAG_VALUE`: free-form value your process can use (e.g., “request-1234”, “approved-2026‑07‑01”, or a link to the submitted Cloud Security Testing Notification).

        Potential problems to investigate manually:

        * Any cluster that:
          * Is planned to be tested, **and**
          * Has `APPROVAL_TAG_PRESENT` = `no`, **or**
          * Has an empty/invalid `APPROVAL_TAG_VALUE`.

        For such clusters, manually verify:

        1. That Oracle Cloud Security Testing Policies have been reviewed.
        2. That a Cloud Security Testing Notification has been submitted for the correct tenancy/region and timeframe, using an Oracle Account with appropriate privileges.
        3. That your internal tracking (e.g., tags, CMDB, ticket system) is updated to reflect the approval.

        This script only highlights clusters where approval evidence may be missing or incomplete; it cannot file notifications or validate approval with Oracle automatically.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>