OCI Compute Instances Should Have Secure Boot Enabled

More Info:

Compute instances should have Shielded Instance secure boot enabled. Secure boot ensures only verified, trusted firmware and OS components are loaded during startup, preventing rootkit attacks

Risk Level

High

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate “OCI Compute Instances Should Have Secure Boot Enabled” using the OCI Console, you need to enable Shielded Instance features (Secure Boot) on each affected instance.

1. Verify the instance can use Secure Boot

In the OCI Console, go to:
- Menu → Compute → Instances
Click the compartment where the instance resides.
Open the instance details page.
Confirm:
- The shape supports Shielded Instances.
- The instance is using UEFI (most current platform images do).
  If you do not see any “Shielding” options on the instance page, the shape or image likely doesn’t support Secure Boot; in that case, you must recreate the instance (see step 4).

2. Stop the instance

From the instance details page, click Stop.
Wait until the instance state is Stopped.

3. Enable Secure Boot on the instance

On the same instance details page, in the Resources section (left side), look for Shielding (or similar).
Click Shielding → Edit.
Check Enable Secure Boot.
(Optional but recommended) Also enable Trusted Platform Module (TPM) and Measured Boot if your policy requires them.
Click Save changes.

4. If Secure Boot cannot be enabled on the existing instance

If there is no Shielding section or the option is disabled:

Create a new instance with Secure Boot enabled:
- Menu → Compute → Instances → Create instance
Choose the same image (or an updated platform image) and compatible shape.
In the Image and shape / Advanced options section, find Shielding:
- Check Enable Secure Boot.
- (Optionally) enable TPM and Measured Boot.
Complete the rest of the instance configuration and Create.
Migrate workload/data from the old instance (e.g., attach old boot/block volumes, restore from backup, etc.).
Decommission the non‑compliant instance.

5. Confirm remediation for monitoring / Cloud Guard

After starting the (updated or new) instance, ensure it is in Running state.
In the instance details → Shielding, verify Secure Boot: Enabled.
If you’re using Cloud Guard or a similar detector:
- Allow time for the next evaluation cycle.
- Confirm the “Compute Instances Should Have Secure Boot Enabled” problem is cleared.

Using CLI

Below are minimal, step‑by‑step OCI CLI instructions to enable Secure Boot on existing compute instances so that the “OCI Compute Instances Should Have Secure Boot Enabled” check passes.

Note: Secure Boot can only be enabled on supported shapes and while the instance is stopped.

1. Prerequisites

OCI CLI installed and configured (oci setup config)
OCID of the instance: <INSTANCE_OCID>
Shape must support Secure Boot (most recent VM shapes do)

2. Stop the Instance

oci compute instance action \
  --instance-id <INSTANCE_OCID> \
  --action SOFTSTOP

Wait until it’s stopped:

oci compute instance get \
  --instance-id <INSTANCE_OCID> \
  --query "data.\"lifecycle-state\"" \
  --raw-output
# Should return: STOPPED

3. Check Current Platform Configuration (Optional)

oci compute instance get \
  --instance-id <INSTANCE_OCID> \
  --query "data.\"platform-config\"" \
  --raw-output

Note the type value (for example AMD_VM, INTEL_VM, GENERIC_VM, etc.).

4. Enable Secure Boot via CLI

Use instance update with a platform-config block. Replace <TYPE> with the type you saw in step 3 (e.g. AMD_VM):

oci compute instance update \
  --instance-id <INSTANCE_OCID> \
  --platform-config '{
    "type": "<TYPE>",
    "isSecureBootEnabled": true
  }'

Examples:

# AMD-based VM
oci compute instance update \
  --instance-id <INSTANCE_OCID> \
  --platform-config '{
    "type": "AMD_VM",
    "isSecureBootEnabled": true
  }'

# Intel-based VM
oci compute instance update \
  --instance-id <INSTANCE_OCID> \
  --platform-config '{
    "type": "INTEL_VM",
    "isSecureBootEnabled": true
  }'

If your shape still uses launch-options instead of platform-config, use:

oci compute instance update \
  --instance-id <INSTANCE_OCID> \
  --launch-options '{
    "isSecureBootEnabled": true
  }'

5. Start the Instance

oci compute instance action \
  --instance-id <INSTANCE_OCID> \
  --action START

6. Verify Secure Boot Status

oci compute instance get \
  --instance-id <INSTANCE_OCID> \
  --query "data.\"platform-config\".\"is-secure-boot-enabled\"" \
  --raw-output
# Should return: true

Once this flag is true for the instance, OCI Security/Monitoring checks for “Compute Instances Should Have Secure Boot Enabled” will pass for that resource.

Using Python

In OCI, Secure Boot is controlled per instance via its launch_options. You can remediate non‑compliant instances with the OCI Python SDK by:

Prerequisites
- Install SDK:
```
pip install oci
```
- Have an OCI config file (~/.oci/config) or use instance principals.
- The instance’s shape must support Secure Boot (UEFI). If not, enabling will fail.
- You must have permission: inspect/ use on instances and manage if you will stop/update them.
High‑level remediation flow

For each target instance:
1. Check current launch_options.is_secure_boot_enabled.
2. If False or None:
  - Stop the instance (if running).
  - Call UpdateInstance with launch_options.is_secure_boot_enabled = True.
  - Start the instance again.

Python code example

import oci

# -------------- CONFIGURE SDK -------------- #
# Uses default profile from ~/.oci/config. Adjust as needed.
config = oci.config.from_file()
compute_client = oci.core.ComputeClient(config)
compute_waiter = oci.core.ComputeClientCompositeOperations(compute_client)

compartment_id = "<your_compartment_ocid>"  # scope of remediation

# -------------- HELPER FUNCTIONS -------------- #
def get_instances_in_compartment(compartment_id):
    instances = []
    list_response = oci.pagination.list_call_get_all_results(
        compute_client.list_instances,
        compartment_id=compartment_id,
        lifecycle_state="RUNNING"  # or remove this filter to include STOPPED, etc.
    )
    instances.extend(list_response.data)
    return instances

def ensure_secure_boot_enabled(instance):
    instance_id = instance.id
    details = compute_client.get_instance(instance_id).data

    launch_options = details.launch_options
    # launch_options can be None on some older instances
    if launch_options is None:
        launch_options = oci.core.models.LaunchOptions()

    if launch_options.is_secure_boot_enabled:
        print(f"[SKIP] Secure Boot already enabled on {details.display_name} ({instance_id})")
        return

    print(f"[INFO] Enabling Secure Boot on {details.display_name} ({instance_id})")

    # 1) Stop instance if it is running
    if details.lifecycle_state == "RUNNING":
        print(f"  - Stopping instance...")
        stop_details = oci.core.models.InstanceActionDetails(
            action="SOFTSTOP"  # or "STOP" for hard stop
        )
        compute_waiter.instance_action_and_wait_for_state(
            instance_id,
            stop_details,
            wait_for_states=["STOPPED"]
        )
        print(f"  - Instance stopped.")

    # 2) Update instance launch options
    launch_options.is_secure_boot_enabled = True
    update_details = oci.core.models.UpdateInstanceDetails(
        launch_options=launch_options
    )

    print(f"  - Updating instance launch options (enable Secure Boot)...")
    compute_client.update_instance(instance_id, update_details)
    # Wait for some non-transient state if desired
    oci.wait_until(
        compute_client,
        compute_client.get_instance(instance_id),
        "lifecycle_state",
        "STOPPED"
    )
    print(f"  - Secure Boot flag updated.")

    # 3) Start instance again (optional, based on your policy)
    print(f"  - Starting instance...")
    start_details = oci.core.models.InstanceActionDetails(action="START")
    compute_waiter.instance_action_and_wait_for_state(
        instance_id,
        start_details,
        wait_for_states=["RUNNING"]
    )
    print(f"  - Instance running with Secure Boot enabled.")

# -------------- MAIN REMEDIATION LOGIC -------------- #
def remediate_secure_boot_in_compartment(compartment_id):
    instances = get_instances_in_compartment(compartment_id)
    for inst in instances:
        try:
            ensure_secure_boot_enabled(inst)
        except oci.exceptions.ServiceError as e:
            print(f"[ERROR] Could not update {inst.display_name} ({inst.id}): {e}")
        except Exception as ex:
            print(f"[ERROR] Unexpected error on {inst.display_name} ({inst.id}): {ex}")

if __name__ == "__main__":
    remediate_secure_boot_in_compartment(compartment_id)

Using this with a “monitoring/compliance” flow

Use an external scheduler (e.g., cron, CI/CD, or OCI Functions + Events) to:
- Periodically list instances.
- Check is_secure_boot_enabled.
- Optionally only remediate those flagged as non‑compliant by your security/monitoring tool (e.g., Cloud Guard detector reports), by filtering on instance OCIDs provided by that tool.
Log every change (instance OCID, old state, new state, timestamp) for audit.

If you specify how your “OCI Compute Monitoring” is surfacing non‑compliant instances (Cloud Guard, Logging, custom metrics), I can adapt the script to consume that input directly.

Using Terraform

resource "oci_core_instance" "SECURE_INSTANCE" {
  # Replace with your instance details
  availability_domain = "YOUR_AVAILABILITY_DOMAIN"
  compartment_id      = "YOUR_COMPARTMENT_OCID"
  display_name        = "YOUR_INSTANCE_NAME"
  shape               = "YOUR_SHAPE"

  source_details {
    source_type = "image"
    source_id   = "YOUR_IMAGE_OCID"
  }

  # Enable Shielded Instance secure boot
  launch_options {
    is_secure_boot_enabled = true
  }

  # ...any other arguments you already use (metadata, agent_config, vnics, etc.)...
}

Enabling launch_options.is_secure_boot_enabled on an existing oci_core_instance normally forces replacement of the instance, which will cause downtime; plan carefully before applying.

For verification, terraform plan should show either a new oci_core_instance with launch_options.is_secure_boot_enabled = true or a -/+ replacement of the existing instance where the only changed field (for this finding) is is_secure_boot_enabled from false (or null) to true.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Verify the instance can use Secure Boot​

2. Stop the instance​

3. Enable Secure Boot on the instance​

4. If Secure Boot cannot be enabled on the existing instance​

5. Confirm remediation for monitoring / Cloud Guard​

1. Prerequisites​

2. Stop the Instance​

3. Check Current Platform Configuration (Optional)​

4. Enable Secure Boot via CLI​

5. Start the Instance​

6. Verify Secure Boot Status​