OCI Compute Boot Volumes Should Have Backup Policy Assigned

More Info:

Boot volumes should have a backup policy assigned. Without automated backups, data loss from instance failure, corruption, or ransomware cannot be recovered.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate “OCI Compute Boot Volumes Should Have Backup Policy Assigned” using the OCI Console:

1. Assign a Backup Policy to Existing Boot Volumes

Sign in to the OCI Console.
In the left navigation menu, go to:
Menu → Storage → Block Storage → Boot Volumes.
At the top, select the correct Compartment where your instances/boot volumes reside.
For each boot volume that shows No backup policy:
1. Click the boot volume name.
2. On the boot volume detail page, click Assign Backup Policy (or Edit if available).
3. In the Backup Policy dropdown, choose an appropriate predefined policy, for example:
  - bronze (daily, shorter retention)
  - silver (daily + weekly, medium retention)
  - gold (daily + weekly + monthly, longest retention)
    or your custom policy if you have one.
4. Click Assign (or Save changes).

Repeat for all non-compliant boot volumes.

2. Set a Default Backup Policy for New Boot Volumes (Recommended)

To avoid future non-compliance:

Go to: Menu → Storage → Block Storage → Block Volume Backups → Policies.
Either:
- Use an existing Predefined Policy, or
- Click Create Policy to define a custom schedule/retention.
Once you’ve chosen the policy, set it as default for a compartment:
1. Go to: Menu → Identity & Security → Identity → Compartments.
2. Select your Compartment.
3. Look for Default backup policy for block/boot volumes (wording may vary by console version).
4. Choose the desired backup policy and Save.

New boot volumes in that compartment will automatically get this backup policy.

3. Verify Compliance (for Monitoring / Security Reports)

Return to: Menu → Storage → Block Storage → Boot Volumes.
Confirm that the Backup Policy column shows a policy (not “None”) for every boot volume.
If you are using Cloud Guard / Security Zones / Security Center-like monitoring, run or refresh the compliance check so the “boot volumes should have backup policy” finding is cleared.

Using CLI

Below are step‑by‑step CLI instructions to assign an OCI Block Volume Backup Policy to Compute boot volumes so they comply with “Boot Volumes Should Have Backup Policy Assigned.”

1. Prerequisites

OCI CLI installed and configured (~/.oci/config with a working profile).
OCIDs ready:
- Your tenancy OCID and/or compartment OCID.
- User running CLI must have permissions to manage boot volumes and volume backup policies.

Assume:

Profile: DEFAULT
Compartment OCID: ocid1.compartment.oc1..xxxx

If you use a different profile, add --profile <PROFILE> to every oci command.

2. List Available Backup Policies

First, see which backup policies exist in your region (Oracle‑managed or custom):

oci bv volume-backup-policy list \
  --compartment-id ocid1.compartment.oc1..xxxx \
  --all

Common Oracle‑managed policies are usually named like gold, silver, bronze.
Pick the policy-id you want; call it:

TARGET_POLICY_OCID="ocid1.volumebackuppolicy.oc1..targetpolicyocid"

3. List Boot Volumes in a Compartment

oci bv boot-volume list \
  --compartment-id ocid1.compartment.oc1..xxxx \
  --all \
  --output table

Each entry has a id field; that is the boot volume OCID.
For scripting, grab them as:

BOOT_VOLUME_IDS=$(oci bv boot-volume list \
  --compartment-id ocid1.compartment.oc1..xxxx \
  --all \
  --query "data[].id" \
  --raw-output)

4. (Optional) Identify Boot Volumes Without a Policy

To see current policy assignments for all volumes in the compartment:

oci bv volume-backup-policy-assignment list \
  --compartment-id ocid1.compartment.oc1..xxxx \
  --all

For a specific boot volume:

oci bv volume-backup-policy-assignment list \
  --asset-id <BOOT_VOLUME_OCID>

If this returns an empty list, the boot volume has no backup policy and is non‑compliant.

5. Assign Backup Policy to a Single Boot Volume

Use the chosen policy OCID from step 2 and the boot volume OCID from step 3:

oci bv volume-backup-policy-assignment create \
  --asset-id <BOOT_VOLUME_OCID> \
  --policy-id "$TARGET_POLICY_OCID"

Verify:

oci bv volume-backup-policy-assignment list \
  --asset-id <BOOT_VOLUME_OCID> \
  --output table

You should see the selected policy associated.

6. Bulk‑Assign Policy to All Boot Volumes in a Compartment

This loop assigns the same backup policy to every boot volume in the compartment:

TARGET_POLICY_OCID="ocid1.volumebackuppolicy.oc1..targetpolicyocid"
COMPARTMENT_ID="ocid1.compartment.oc1..xxxx"

for BV_ID in $(oci bv boot-volume list \
    --compartment-id "$COMPARTMENT_ID" \
    --all \
    --query "data[].id" \
    --raw-output); do

  echo "Processing boot volume: $BV_ID"

  HAS_POLICY=$(oci bv volume-backup-policy-assignment list \
    --asset-id "$BV_ID" \
    --query "length(data)" \
    --raw-output)

  if [ "$HAS_POLICY" -eq 0 ]; then
    echo "  No policy found. Assigning $TARGET_POLICY_OCID..."
    oci bv volume-backup-policy-assignment create \
      --asset-id "$BV_ID" \
      --policy-id "$TARGET_POLICY_OCID"
  else
    echo "  Policy already assigned. Skipping."
  fi

done

7. Confirm Compliance for Monitoring

Re-run:

oci bv volume-backup-policy-assignment list \
  --compartment-id ocid1.compartment.oc1..xxxx \
  --all

Ensure every boot volume reported by:

oci bv boot-volume list \
  --compartment-id ocid1.compartment.oc1..xxxx \
  --all

has at least one corresponding volume-backup-policy-assignment. Your OCI monitoring / security/compliance tool should now show “Boot Volumes Should Have Backup Policy Assigned” as remediated.

Using Python

Here’s how you can remediate “OCI Compute Boot Volumes Should Have Backup Policy Assigned” using Python and the OCI SDK, by:

Finding boot volumes without a backup policy
Assigning a chosen backup policy to them

1. Prerequisites

Install the OCI Python SDK:

pip install oci

Set up your ~/.oci/config file with:
- tenancy, user, fingerprint, key_file, region
- A profile name, e.g. [DEFAULT]
Ensure the principal (user/group/instance/principal) has IAM permissions similar to:

Allow group <your-group> to read boot-volumes in tenancy
Allow group <your-group> to manage volume-backup-policies in tenancy
Allow group <your-group> to manage volume-backup-policy-assignments in tenancy

2. Decide which Backup Policy to Apply

You can use a predefined policy (e.g. “gold”, “silver”, “bronze”) or a custom one.

Example: find available backup policies and pick one:

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
blockstorage = oci.core.BlockstorageClient(config)

# List predefined and custom volume backup policies in the region
policies = blockstorage.list_volume_backup_policies().data
for p in policies:
    print(p.id, p.display_name)

Copy the id of the policy you want, e.g.:

TARGET_BACKUP_POLICY_ID = "ocid1.volumebackuppolicy.oc1..xxxxxx"

3. Script: Assign Backup Policy to All Boot Volumes Without One

This example:

Iterates over all compartments (recursive)
Lists boot volumes
Checks if each has at least one backup policy assignment
Assigns TARGET_BACKUP_POLICY_ID where missing

import oci

PROFILE = "DEFAULT"
TARGET_BACKUP_POLICY_ID = "ocid1.volumebackuppolicy.oc1..xxxxxx"  # your chosen policy

config = oci.config.from_file("~/.oci/config", PROFILE)
identity = oci.identity.IdentityClient(config)
blockstorage = oci.core.BlockstorageClient(config)

TENANCY_OCID = config["tenancy"]


def list_all_compartments(tenancy_id):
    """Return a list of all active compartments (recursive)."""
    compartments = []
    response = oci.pagination.list_call_get_all_results(
        identity.list_compartments,
        tenancy_id,
        compartment_id_in_subtree=True,
        access_level="ANY",
        lifecycle_state="ACTIVE"
    )
    compartments.extend(response.data)
    # include root compartment itself
    root = identity.get_tenancy(tenancy_id).data
    root_compartment = oci.identity.models.Compartment(
        id=root.id,
        name=root.name,
        lifecycle_state="ACTIVE"
    )
    compartments.append(root_compartment)
    return compartments


def boot_volume_has_policy(boot_volume_id):
    """Return True if boot volume has at least one policy assignment."""
    assignments = blockstorage.list_volume_backup_policy_assignments(
        asset_id=boot_volume_id
    ).data
    return len(assignments) > 0


def assign_policy_to_boot_volume(boot_volume_id, policy_id):
    """Assign a backup policy to the given boot volume."""
    details = oci.core.models.CreateVolumeBackupPolicyAssignmentDetails(
        asset_id=boot_volume_id,
        policy_id=policy_id
    )
    blockstorage.create_volume_backup_policy_assignment(details)
    print(f"Assigned policy {policy_id} to boot volume {boot_volume_id}")


def remediate_all_boot_volumes():
    compartments = list_all_compartments(TENANCY_OCID)

    for comp in compartments:
        comp_id = comp.id
        # List boot volumes in this compartment
        try:
            boot_volumes = oci.pagination.list_call_get_all_results(
                blockstorage.list_boot_volumes,
                availability_domain=None,   # if omitted, lists all ADs for region
                compartment_id=comp_id
            ).data
        except oci.exceptions.ServiceError as e:
            print(f"Error listing boot volumes in compartment {comp_id}: {e}")
            continue

        for bv in boot_volumes:
            # bv is BootVolume
            if bv.lifecycle_state != "AVAILABLE":
                continue

            if boot_volume_has_policy(bv.id):
                print(f"Boot volume {bv.id} already has a policy assigned.")
                continue

            assign_policy_to_boot_volume(bv.id, TARGET_BACKUP_POLICY_ID)


if __name__ == "__main__":
    remediate_all_boot_volumes()

4. Integrate with Monitoring / Compliance

Typical options:

Run this script on a schedule (e.g., cron on a bastion host, OCI Compute instance, or OCI Container Instances).
Or, wrap it as an OCI Function invoked by:
- An Event from Cloud Guard/Cloud Events when a new boot volume/instance is created.
- A periodic trigger (e.g., via external scheduler or Functions + Alarm/Event).

The logic stays the same; only the execution environment changes.

Using Terraform

# Existing boot volume (example)
resource "oci_core_boot_volume" "APP_BOOT_VOLUME" {
  # Replace with your actual details
  availability_domain = "AD_NAME"
  compartment_id      = "COMPARTMENT_OCID"
  size_in_gbs         = 50
  vpus_per_gb         = 10
  display_name        = "app-boot-volume"
  source_details {
    type = "image"
    id   = "IMAGE_OCID"
  }
}

# Either reference an existing backup policy by OCID...
# Replace BACKUP_POLICY_OCID with the OCID of your chosen backup policy
# (e.g. Oracle-defined `gold`, `silver`, or `bronze` policy, or a custom one).
#
# variable "boot_volume_backup_policy_id" {
#   type        = string
#   description = "OCID of the backup policy to assign to the boot volume"
# }

# ...or define a custom backup policy in Terraform:
resource "oci_core_volume_backup_policy" "BOOT_VOLUME_BACKUP_POLICY" {
  compartment_id = "COMPARTMENT_OCID"
  display_name   = "boot-volume-backup-policy"

  # Example: daily backups, keep 7
  schedules {
    backup_type = "INCREMENTAL"
    period      = "ONE_DAY"
    offset_seconds          = 0
    retention_seconds       = 7 * 24 * 60 * 60
    hour_of_day             = 1
    day_of_week             = "MONDAY"
    month                   = "JANUARY"
    day_of_month            = "1"
    schedule_type           = "PERIODIC"
    time_zone               = "UTC"
  }
}

# Assign the backup policy to the boot volume
resource "oci_core_volume_backup_policy_assignment" "APP_BOOT_VOLUME_BACKUP_ASSIGNMENT" {
  # asset_id may be a boot volume or block volume OCID; here we use the boot volume
  asset_id  = oci_core_boot_volume.APP_BOOT_VOLUME.id

  # Use either the custom policy defined above...
  policy_id = oci_core_volume_backup_policy.BOOT_VOLUME_BACKUP_POLICY.id

  # ...or, if using an existing policy, replace the line above with:
  # policy_id = var.boot_volume_backup_policy_id
}

This change does not replace the existing boot volume; it only attaches a backup policy to it.

For verification, terraform plan should show creation of an oci_core_volume_backup_policy_assignment resource (and optionally an oci_core_volume_backup_policy if you added one), with no planned replacement of the existing oci_core_boot_volume.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Assign a Backup Policy to Existing Boot Volumes​

2. Set a Default Backup Policy for New Boot Volumes (Recommended)​

3. Verify Compliance (for Monitoring / Security Reports)​

1. Prerequisites​

2. List Available Backup Policies​

3. List Boot Volumes in a Compartment​

4. (Optional) Identify Boot Volumes Without a Policy​

5. Assign Backup Policy to a Single Boot Volume​

6. Bulk‑Assign Policy to All Boot Volumes in a Compartment​

7. Confirm Compliance for Monitoring​

1. Prerequisites​

2. Decide which Backup Policy to Apply​

3. Script: Assign Backup Policy to All Boot Volumes Without One​

4. Integrate with Monitoring / Compliance​

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Assign a Backup Policy to Existing Boot Volumes

2. Set a Default Backup Policy for New Boot Volumes (Recommended)

3. Verify Compliance (for Monitoring / Security Reports)

1. Prerequisites

2. List Available Backup Policies

3. List Boot Volumes in a Compartment

4. (Optional) Identify Boot Volumes Without a Policy

5. Assign Backup Policy to a Single Boot Volume

6. Bulk‑Assign Policy to All Boot Volumes in a Compartment

7. Confirm Compliance for Monitoring

1. Prerequisites

2. Decide which Backup Policy to Apply

3. Script: Assign Backup Policy to All Boot Volumes Without One

4. Integrate with Monitoring / Compliance