OCI Storage Buckets Should Not Be Publicly Accessible

oci os bucket list \
  --compartment-id <compartment_ocid> \
  --all \
  --output table \
  --query "data[].{name:name, namespace:namespace, access:public-access-type}"

oci os bucket list \
  --compartment-id <compartment_ocid> \
  --all \
  --query "data[?\"public-access-type\" != 'NoPublicAccess'].[name, namespace, \"public-access-type\"]" \
  --output table

oci os bucket update \
  --namespace-name <namespace> \
  --bucket-name <bucket_name> \
  --public-access-type NoPublicAccess

oci os bucket get \
  --namespace-name <namespace> \
  --bucket-name <bucket_name> \
  --query "data.{name:name, access:public-access-type}" \
  --output table

COMPARTMENT_ID="<compartment_ocid>"

oci os bucket list \
  --compartment-id "$COMPARTMENT_ID" \
  --all \
  --raw-output \
  | jq -r '.data[] | select(."public-access-type" != "NoPublicAccess") | "\(.namespace) \(.name)"' \
  | while read NS BUCKET; do
      echo "Locking down bucket: $BUCKET (namespace: $NS)"
      oci os bucket update \
        --namespace-name "$NS" \
        --bucket-name "$BUCKET" \
        --public-access-type NoPublicAccess
    done

oci iam policy list \
  --compartment-id <compartment_ocid> \
  --all \
  --output table \
  --query "data[].{name:name, id:id}"

oci iam policy get \
  --policy-id <policy_ocid> \
  --query "data.statements" \
  --output table

oci os bucket list \
  --compartment-id <compartment_ocid> \
  --all \
  --query "data[?\"public-access-type\" != 'NoPublicAccess'].[name, namespace, \"public-access-type\"]" \
  --output table

pip install oci

[DEFAULT]
user=ocid1.user.oc1..aaaa...
fingerprint=xx:xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..aaaa...
region=us-ashburn-1

import oci

# ---- CONFIG ----
PROFILE = "DEFAULT"  # name in ~/.oci/config
DRY_RUN = False      # set True to only report, False to remediate

config = oci.config.from_file("~/.oci/config", PROFILE)
identity_client = oci.identity.IdentityClient(config)
object_storage_client = oci.object_storage.ObjectStorageClient(config)

tenancy_id = config["tenancy"]
namespace = object_storage_client.get_namespace().data

# 1. Get all compartments (including root)
def list_compartments(tenancy_id):
    compartments = []
    request = oci.identity.models.ListCompartmentsRequest(
        compartment_id=tenancy_id
    )
    # Use paginator to get all
    for c in oci.pagination.list_call_get_all_results(
        identity_client.list_compartments,
        tenancy_id,
        compartment_id_in_subtree=True,
        access_level="ACCESSIBLE"
    ).data:
        if c.lifecycle_state == "ACTIVE":
            compartments.append(c)
    # ensure root compartment is included
    root_compartment = identity_client.get_compartment(tenancy_id).data
    compartments.append(root_compartment)
    return compartments

# 2. Find & fix public buckets
def remediate_public_buckets():
    compartments = list_compartments(tenancy_id)

    for comp in compartments:
        print(f"\nChecking compartment: {comp.name} ({comp.id})")

        buckets = oci.pagination.list_call_get_all_results(
            object_storage_client.list_buckets,
            namespace_name=namespace,
            compartment_id=comp.id
        ).data

        for bucket in buckets:
            # Get full bucket details
            b = object_storage_client.get_bucket(
                namespace_name=namespace,
                bucket_name=bucket.name
            ).data

            pat = b.public_access_type
            if pat in ("ObjectRead", "ObjectReadWithoutList"):
                print(f"  [PUBLIC] Bucket: {b.name}, public_access_type={pat}")

                if not DRY_RUN:
                    # 2a. Set bucket to private
                    update_details = oci.object_storage.models.UpdateBucketDetails(
                        public_access_type="NoPublicAccess"
                    )
                    object_storage_client.update_bucket(
                        namespace_name=namespace,
                        bucket_name=b.name,
                        update_bucket_details=update_details
                    )
                    print(f"    -> Updated public_access_type to NoPublicAccess")

                    # 2b. Optionally: delete PARs on this bucket
                    # (comment out if you only want to change public_access_type)
                    delete_bucket_pars(namespace, b.name)
            else:
                print(f"  [OK] Bucket: {b.name}, public_access_type={pat}")

# 3. Delete Pre-Authenticated Requests (PARs) for a bucket
def delete_bucket_pars(namespace, bucket_name):
    print(f"    -> Checking PARs for bucket: {bucket_name}")
    pars_response = oci.pagination.list_call_get_all_results(
        object_storage_client.list_preauthenticated_requests,
        namespace_name=namespace,
        bucket_name=bucket_name
    )
    pars = pars_response.data

    if not pars:
        print("       No PARs found.")
        return

    for par in pars:
        print(f"       PAR: {par.name} ({par.id}), access_type={par.access_type}")
        if not DRY_RUN:
            object_storage_client.delete_preauthenticated_request(
                namespace_name=namespace,
                bucket_name=bucket_name,
                par_id=par.id
            )
            print(f"         -> Deleted PAR {par.id}")

if __name__ == "__main__":
    print(f"DRY_RUN = {DRY_RUN}")
    remediate_public_buckets()

resource "oci_objectstorage_bucket" "PRIVATE_BUCKET" {
  # Replace with your tenancy details
  compartment_id = "OCID_OF_COMPARTMENT"
  namespace      = "OBJECTSTORAGE_NAMESPACE"
  name           = "BUCKET_NAME"

  # Ensure the bucket is NOT publicly accessible
  public_access_type = "NoPublicAccess"

  # Keep or add any other arguments you already manage here
  storage_tier = "Standard"
}