OCI Storage Block Volumes Should Be Encrypted With Customer-Managed Keys

# 1.1 Create a Vault
oci kms management vault create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "cmk-vault" \
  --vault-type DEFAULT \
  --wait-for-state ACTIVE

# 1.2 Capture the Vault OCID from the output:
# "id": "ocid1.vault.oc1..xxxxx"
VAULT_OCID=<VAULT_OCID>

# 2.1 Create a Master Encryption Key (CMK)
oci kms management key create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "block-volume-cmk" \
  --vault-id $VAULT_OCID \
  --key-shape '{"algorithm": "AES", "length": 32}' \
  --protection-mode SOFTWARE \
  --wait-for-state ENABLED

# 2.2 Capture the Key OCID:
# "id": "ocid1.key.oc1..xxxxx"
KMS_KEY_OCID=<KEY_OCID>

oci bv volume create \
  --availability-domain "<AD_NAME>" \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "my-encrypted-volume" \
  --size-in-gbs 100 \
  --kms-key-id $KMS_KEY_OCID \
  --wait-for-state AVAILABLE

oci compute instance launch \
  --compartment-id <COMPARTMENT_OCID> \
  --availability-domain "<AD_NAME>" \
  --shape "<SHAPE_NAME>" \
  --subnet-id <SUBNET_OCID> \
  --image-id <IMAGE_OCID> \
  --metadata '{"ssh_authorized_keys": "<YOUR_SSH_KEY>"}' \
  --block-volumes '{"sourceDetails": {"type": "image", "imageId": "<IMAGE_OCID>"}, "kmsKeyId": "'"$KMS_KEY_OCID"'"}'

oci bv volume list \
  --compartment-id <COMPARTMENT_OCID> \
  --all

oci bv volume get \
  --volume-id <VOLUME_OCID> \
  --query "data.\"kms-key-id\"" \
  --raw-output

oci bv volume update \
  --volume-id <VOLUME_OCID> \
  --kms-key-id $KMS_KEY_OCID \
  --force \
  --wait-for-state AVAILABLE

oci bv volume list \
  --compartment-id <COMPARTMENT_OCID> \
  --all \
  --query "data[?\"kms-key-id\"==''].{\"name\": \"display-name\", id: id}" \
  --output table

import oci
from oci.core import BlockstorageClient
from oci.identity import IdentityClient

# ------------- CONFIG -------------
PROFILE = "DEFAULT"     # OCI config profile name
CONFIG_FILE = "~/.oci/config"
TARGET_REGION = None    # e.g. "us-ashburn-1", or None for region in config
# If you want to check against specific CMKs:
ALLOWED_KEY_OCIDS = []  # e.g. ["ocid1.key.oc1..xxxxx"]
# ---------------------------------


def get_all_compartments(identity_client, tenancy_id):
    compartments = []
    list_compartments_response = oci.pagination.list_call_get_all_results(
        identity_client.list_compartments,
        tenancy_id,
        compartment_id_in_subtree=True,
        access_level="ANY"
    )
    compartments.extend(list_compartments_response.data)
    # Include root compartment itself
    root = identity_client.get_compartment(tenancy_id).data
    compartments.append(root)
    return compartments


def main():
    config = oci.config.from_file(CONFIG_FILE, PROFILE)

    if TARGET_REGION:
        config["region"] = TARGET_REGION

    identity_client = IdentityClient(config)
    block_client = BlockstorageClient(config)

    tenancy_id = config["tenancy"]

    print("Scanning compartments and block volumes...")

    compartments = get_all_compartments(identity_client, tenancy_id)

    non_compliant_volumes = []

    for compartment in compartments:
        if compartment.lifecycle_state != "ACTIVE":
            continue

        comp_id = compartment.id
        comp_name = compartment.name

        # List block volumes in the compartment
        volumes = oci.pagination.list_call_get_all_results(
            block_client.list_volumes,
            compartment_id=comp_id
        ).data

        for vol in volumes:
            # kms_key_id is None or empty => Oracle-managed key
            # If ALLOWED_KEY_OCIDS is provided, enforce those
            kms_key_id = vol.kms_key_id

            uses_cmk = False
            if kms_key_id:
                if ALLOWED_KEY_OCIDS:
                    uses_cmk = (kms_key_id in ALLOWED_KEY_OCIDS)
                else:
                    # Any non-empty kms_key_id is treated as "customer-managed" for monitoring
                    uses_cmk = True

            if not uses_cmk:
                non_compliant_volumes.append((comp_name, vol))

    print("\n=== Non-compliant Block Volumes (not using CMK) ===")
    if not non_compliant_volumes:
        print("All block volumes are using customer-managed keys (or meet the allowed-key policy).")
    else:
        for comp_name, vol in non_compliant_volumes:
            print(f"Compartment: {comp_name}")
            print(f"  Volume OCID: {vol.id}")
            print(f"  Display Name: {vol.display_name}")
            print(f"  Size (GB): {vol.size_in_gbs}")
            print(f"  KMS Key ID: {vol.kms_key_id}")
            print("  STATUS: NON-COMPLIANT (Oracle-managed key)\n")


if __name__ == "__main__":
    main()

import oci
from oci.core import BlockstorageClient
from oci.core.models import CreateVolumeDetails

config = oci.config.from_file("~/.oci/config", "DEFAULT")
block_client = BlockstorageClient(config)

compartment_id = "<compartment_ocid>"
availability_domain = "<AD-name>"  # e.g. "kIdk:US-ASHBURN-AD-1"
kms_key_id = "<ocid1.key.oc1..your_cmk_ocid>"

create_volume_details = CreateVolumeDetails(
    compartment_id=compartment_id,
    availability_domain=availability_domain,
    size_in_gbs=50,
    display_name="cmk-encrypted-volume",
    kms_key_id=kms_key_id
)

response = block_client.create_volume(create_volume_details)
print("Created volume:", response.data.id)

from oci.core.models import CreateVolumeBackupDetails, CreateVolumeDetails

volume_id = "<non_compliant_volume_ocid>"
compartment_id = "<compartment_ocid>"
kms_key_id = "<cmk_ocid>"

# 1. Create backup
backup_details = CreateVolumeBackupDetails(
    volume_id=volume_id,
    display_name="temp-backup-for-cmk-migration"
)
backup = block_client.create_volume_backup(backup_details).data

# Wait for backup to be available (polling omitted for brevity)

# 2. Restore new volume from backup with CMK
create_from_backup = CreateVolumeDetails(
    compartment_id=compartment_id,
    availability_domain="<AD-name>",
    display_name="cmk-encrypted-restored-volume",
    source_details={"type": "volumeBackup", "id": backup.id},
    kms_key_id=kms_key_id
)
new_volume = block_client.create_volume(create_from_backup).data

print("New CMK-encrypted volume OCID:", new_volume.id)

# Customer-managed key (CMK) in OCI Vault
resource "oci_kms_key" "BLOCK_VOLUME_CMK" {
  # Substitute with your KMS management endpoint (e.g. from oci_kms_vault.vault.management_endpoint)
  management_endpoint = "KMS_MANAGEMENT_ENDPOINT"

  compartment_id = "COMPARTMENT_OCID"

  display_name = "BLOCK_VOLUME_CMK_NAME"
  key_shape {
    algorithm = "AES"
    length    = 32
  }
  protection_mode = "HSM" # or "SOFTWARE" as per your requirement
}

# Block volume encrypted with customer-managed key
resource "oci_core_volume" "BLOCK_VOLUME" {
  availability_domain = "AVAILABILITY_DOMAIN_NAME"
  compartment_id      = "COMPARTMENT_OCID"
  display_name        = "BLOCK_VOLUME_NAME"
  size_in_gbs         = 50

  # Critical: use CMK for encryption instead of default Oracle-managed key
  kms_key_id = oci_kms_key.BLOCK_VOLUME_CMK.id

  # Add any other arguments you already use (backup_policy_id, volume_group_id, etc.)
}