OCI Storage Boot Volumes Should Be Encrypted With Customer-Managed Keys

oci kms management vault list \
  --compartment-id <COMPARTMENT_OCID>

oci kms management key list \
  --compartment-id <COMPARTMENT_OCID> \
  --vault-id <VAULT_OCID>

oci kms management key create \
  --compartment-id <COMPARTMENT_OCID> \
  --vault-id <VAULT_OCID> \
  --display-name "boot-volume-cmk" \
  --protection-mode HSM \
  --key-shape '{"algorithm": "AES", "length": 256}'

Allow service blockstorage to use keys in compartment <COMPARTMENT_NAME>

oci iam policy create \
  --name "blockstorage-use-kms-key" \
  --compartment-id <TENANCY_OR_COMPARTMENT_OCID> \
  --statements '["Allow service blockstorage to use keys in compartment <COMPARTMENT_NAME>"]' \
  --description "Allow Block Volume service to use KMS CMKs"

oci compute instance list \
  --compartment-id <COMPARTMENT_OCID>

oci compute boot-volume-attachment list \
  --compartment-id <COMPARTMENT_OCID> \
  --instance-id <INSTANCE_OCID>

oci bv boot-volume list \
  --compartment-id <COMPARTMENT_OCID>

oci bv boot-volume update \
  --boot-volume-id <BOOT_VOLUME_OCID> \
  --kms-key-id <KEY_OCID>

oci compute instance launch \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "my-instance" \
  --availability-domain "<AD_NAME>" \
  --shape "<SHAPE_NAME>" \
  --source-details '{
    "sourceType": "image",
    "imageId": "<IMAGE_OCID>",
    "kmsKeyId": "<KEY_OCID>"
  }'

oci bv boot-volume get \
  --boot-volume-id <BOOT_VOLUME_OCID> \
  --query 'data."kms-key-id"' \
  --raw-output

pip install oci

import oci
from oci.core import BlockstorageClient
from oci.identity import IdentityClient

# ---------------- CONFIG ----------------
PROFILE_NAME = "DEFAULT"  # OCI CLI profile
REQUIRED_KMS_KEY_ID = "ocid1.key.oc1..xxxxxxxx"  # Your customer-managed KMS key
TARGET_COMPARTMENT_IDS = []  # Optional: fill with compartment OCIDs; if empty, use all under tenancy
DRY_RUN = True  # Set to False to actually remediate
# ----------------------------------------


def get_config(profile_name):
    return oci.config.from_file("~/.oci/config", profile_name=profile_name)


def list_all_compartments(identity_client, tenancy_id):
    """Return list of active compartments under a tenancy (flattened)."""
    compartments = []

    def _list_children(parent_id):
        response = oci.pagination.list_call_get_all_results(
            identity_client.list_compartments,
            tenancy_id,
            compartment_id_in_subtree=True,
            access_level="ACCESSIBLE",
        )
        for c in response.data:
            if c.lifecycle_state == "ACTIVE":
                compartments.append(c)

    _list_children(tenancy_id)
    return compartments


def list_boot_volumes(bs_client, compartment_id, availability_domains):
    """List all boot volumes in a compartment across all ADs."""
    boot_volumes = []
    for ad in availability_domains:
        response = oci.pagination.list_call_get_all_results(
            bs_client.list_boot_volumes,
            compartment_id=compartment_id,
            availability_domain=ad.name,
        )
        boot_volumes.extend(response.data)
    return boot_volumes


def main():
    config = get_config(PROFILE_NAME)
    tenancy_id = config["tenancy"]

    identity_client = IdentityClient(config)
    bs_client = BlockstorageClient(config)

    # Get availability domains for the region
    ads = identity_client.list_availability_domains(tenancy_id).data

    # Determine compartments to scan
    if TARGET_COMPARTMENT_IDS:
        compartments_to_scan = TARGET_COMPARTMENT_IDS
    else:
        all_compartments = list_all_compartments(identity_client, tenancy_id)
        compartments_to_scan = [c.id for c in all_compartments] + [tenancy_id]

    print(f"Scanning {len(compartments_to_scan)} compartments...")

    non_compliant = []
    updated = []

    for compartment_id in compartments_to_scan:
        boot_vols = list_boot_volumes(bs_client, compartment_id, ads)

        for bv in boot_vols:
            current_kms_key = getattr(bv, "kms_key_id", None)

            # Check compliance: must be encrypted with REQUIRED_KMS_KEY_ID
            if not current_kms_key:
                status = "UNENCRYPTED (no KMS key)"
                compliant = False
            elif current_kms_key != REQUIRED_KMS_KEY_ID:
                status = f"ENCRYPTED with different KMS key: {current_kms_key}"
                compliant = False
            else:
                status = "COMPLIANT"
                compliant = True

            print(f"[{status}] BootVolume: {bv.display_name} ({bv.id}) in compartment {compartment_id}")

            if not compliant:
                non_compliant.append(bv.id)

                # Remediation: update the boot volume to use REQUIRED_KMS_KEY_ID
                if not DRY_RUN:
                    try:
                        update_details = oci.core.models.UpdateBootVolumeDetails(
                            kms_key_id=REQUIRED_KMS_KEY_ID
                        )
                        response = bs_client.update_boot_volume(bv.id, update_details)
                        updated.append(response.data.id)
                        print(f"  -> Remediated: set kms_key_id={REQUIRED_KMS_KEY_ID}")
                    except Exception as e:
                        print(f"  -> ERROR updating boot volume {bv.id}: {e}")

    print("\n=== SUMMARY ===")
    print(f"Non-compliant boot volumes found: {len(non_compliant)}")
    print(f"Remediated (this run): {len(updated)}")
    if DRY_RUN:
        print("NOTE: DRY_RUN is True; no changes were applied.")


if __name__ == "__main__":
    main()

# Customer-managed KMS vault (if not already created)
resource "oci_kms_vault" "CMK_VAULT" {
  compartment_id = "OCID_OF_COMPARTMENT_FOR_KMS_VAULT"
  display_name   = "CMK_VAULT_NAME"
  vault_type     = "DEFAULT" # or "VIRTUAL_PRIVATE"
}

# Master encryption key (Customer-Managed Key / CMK)
resource "oci_kms_key" "BOOT_VOLUME_CMK" {
  compartment_id = "OCID_OF_COMPARTMENT_FOR_KMS_KEY"
  display_name   = "BOOT_VOLUME_CMK_NAME"
  key_shape {
    algorithm = "AES"
    length    = 32
  }
  management_endpoint = oci_kms_vault.CMK_VAULT.management_endpoint
}

# Boot volume encrypted with the CMK
resource "oci_core_boot_volume" "ENCRYPTED_BOOT_VOLUME" {
  availability_domain = "AVAILABILITY_DOMAIN_NAME"
  compartment_id      = "OCID_OF_BOOT_VOLUME_COMPARTMENT"

  # If cloning from an existing boot volume or backup, set source_details here
  # source_details {
  #   type                = "bootVolume"
  #   id                  = "OCID_OF_SOURCE_BOOT_VOLUME_OR_BACKUP"
  # }

  kms_key_id = oci_kms_key.BOOT_VOLUME_CMK.id  # Enforce CMK-based encryption
  size_in_gbs = 50                             # ADJUST_SIZE_IN_GB
  display_name = "ENCRYPTED_BOOT_VOLUME_NAME"
}