Skip to main content

OCI Encryption Storage Buckets Should Use Customer-Managed

More Info:​

Object Storage buckets should be encrypted with customer-managed KMS keys rather than Oracle-managed defaults. Customer-managed keys provide full control over encryption lifecycle and audit trails

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are the step‑by‑step remediation steps using the OCI Console so that an Object Storage bucket uses a customer‑managed KMS key instead of the Oracle‑managed default key.

1. Confirm / Create a Vault​

  1. In the OCI Console, open the navigation menu.
  2. Go to Identity & Security → Vault.
  3. Make sure you are in the correct compartment.
  4. If you don’t have a vault yet:
    • Click Create vault.
    • Enter Name, select Compartment.
    • Choose Vault type (Default or Virtual Private).
    • Click Create vault and wait until its lifecycle state is Active.

2. Create / Identify a Customer-Managed Key​

  1. Open the vault you plan to use.
  2. Go to the Master Encryption Keys (or Keys) tab.
  3. To create a new key:
    • Click Create key.
    • Select Key shape (e.g., AES, 256‑bit).
    • Set Protection mode to HSM or Software as required.
    • Provide a Name and optional description.
    • Click Create key and wait for it to become Enabled.

Keep note of the key and vault (they must be in a region that supports the bucket’s region).

3. Update the Bucket to Use the Customer-Managed KMS Key​

  1. In the OCI Console, go to Storage → Buckets.
  2. Choose the Compartment where your “OCI Encryption Monitoring” bucket (or target bucket) resides.
  3. Click the bucket name you want to remediate.
  4. On the bucket details page, click Edit (top-right).
  5. In the Encryption section:
    • Change from Encrypt using Oracle-managed keys to Encrypt using Customer-managed keys.
    • Select the Vault created earlier.
    • Select the Master Encryption Key you created/identified.
  6. Click Save changes (or Update).

OCI will now use your customer-managed KMS key for that bucket’s encryption going forward.

4. (Optional) Verify Configuration​

  1. Return to the bucket details page.
  2. Under Encryption, confirm it shows:
    • Customer-managed keys.
    • The correct Vault and Key.

This completes remediation for the finding “OCI Encryption Storage Buckets Should Use Customer-Managed KMS Keys” using the OCI Console.

Using CLI

Below are the exact steps to remediate “OCI Encryption Storage Buckets Should Use Customer-Managed KMS Keys” using the OCI CLI.

Assumptions:

  • You already have the OCI CLI configured (oci setup config done).
  • You know your compartment OCID and region (or are using defaults in ~/.oci/config).

1. Create (or identify) a Customer-Managed KMS Key​

1.1. Create a Vault (if you don’t have one)​

COMPARTMENT_OCID="<your_compartment_ocid>"
VAULT_NAME="my-vault"

oci kms management vault create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$VAULT_NAME" \
  --vault-type DEFAULT

Get the vault OCID and management endpoint:

oci kms management vault list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$VAULT_NAME" \
  --all

From the output, note:

  • id → VAULT_OCID
  • management-endpoint → KMS_ENDPOINT
VAULT_OCID="<vault_ocid_from_previous_command>"
KMS_ENDPOINT="<management_endpoint_from_previous_command>"

1.2. Create a Master Encryption Key​

KEY_NAME="os-bucket-key"

oci kms management key create \
  --endpoint "$KMS_ENDPOINT" \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$KEY_NAME" \
  --key-shape '{"algorithm":"AES","length":32}'

Get the key OCID:

oci kms management key list \
  --endpoint "$KMS_ENDPOINT" \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$KEY_NAME" \
  --all

Note the id as:

KEY_OCID="<key_ocid_from_previous_command>"

If you already have a CMK created, just identify its KEY_OCID and skip the creation steps.

2. Identify Buckets Not Using Customer-Managed Keys​

Get the Object Storage namespace:

NAMESPACE=$(oci os ns get --query 'data' --raw-output)

List all buckets in a compartment with their current KMS key:

oci os bucket list \
  --compartment-id "$COMPARTMENT_OCID" \
  --fields "kmsKeyId" \
  --all

In the output:

  • Buckets with "kmsKeyId": null are using Oracle-managed keys.
  • Buckets with "kmsKeyId": "<ocid1.key...>" are already using a CMK.

3. Update a Single Bucket to Use the Customer-Managed KMS Key​

BUCKET_NAME="<your_bucket_name>"

oci os bucket update \
  --namespace-name "$NAMESPACE" \
  --name "$BUCKET_NAME" \
  --kms-key-id "$KEY_OCID"

Verify:

oci os bucket get \
  --namespace-name "$NAMESPACE" \
  --name "$BUCKET_NAME" \
  --fields "kmsKeyId"

You should see "kmsKeyId": "<your_key_ocid>".

4. Bulk Remediation: Update All Non-Compliant Buckets in a Compartment​

This example updates every bucket in the compartment that does not yet have kmsKeyId set.

NAMESPACE=$(oci os ns get --query 'data' --raw-output)
COMPARTMENT_OCID="<your_compartment_ocid>"
KEY_OCID="<your_key_ocid>"

# List non-compliant buckets (kmsKeyId == null)
NON_COMPLIANT_BUCKETS=$(oci os bucket list \
  --compartment-id "$COMPARTMENT_OCID" \
  --fields "kmsKeyId" \
  --all \
  --query "data[?kmsKeyId==null].name" \
  --raw-output)

for BUCKET in $NON_COMPLIANT_BUCKETS; do
  echo "Updating bucket: $BUCKET to use KMS key: $KEY_OCID"
  oci os bucket update \
    --namespace-name "$NAMESPACE" \
    --name "$BUCKET" \
    --kms-key-id "$KEY_OCID"
done

5. (Optional) Script for Monitoring / Reporting via CLI​

To only monitor (no changes), you can run:

oci os bucket list \
  --compartment-id "$COMPARTMENT_OCID" \
  --fields "kmsKeyId" \
  --all \
  --query "data[?kmsKeyId==null].{name:name, namespace:namespace}" \
  --output table

This will show all buckets in the compartment that are still using Oracle-managed encryption, which you can feed into your monitoring or alerting.

Using Python

Below is a concise, practical way to remediate this finding using Python and the OCI SDK: detect buckets not using a customer-managed KMS key and update them to use one.

1. Prerequisites​

  1. OCI Python SDK installed
pip install oci
  1. Configured OCI credentials (one of):
  • ~/.oci/config with a profile, e.g. [DEFAULT]
  • Or use instance principal / resource principal (for functions) – code below shows both patterns.
  1. Existing Vault and KMS Key

You must already have:

  • vault_id (OCID of the KMS vault)
  • kms_key_id (OCID of the key inside that vault you want to use for bucket encryption)
  1. IAM Policies

The principal running this script must be allowed to:

Allow group <your-group> to manage buckets in compartment <compartment-name>
Allow group <your-group> to use keys in compartment <vault-compartment-name> where target.key.id = '<kms-key-ocid>'

(Adjust for dynamic groups if using instance/resource principals.)

2. Script Outline​

What it does:

  1. Lists all compartments (or uses a specific one).
  2. Lists all Object Storage buckets per compartment.
  3. Identifies buckets where:
    • kms_key_id is None (Oracle-managed encryption) OR
    • kms_key_id is not the desired KMS key.
  4. Updates each such bucket to use the customer-managed KMS key.

3. Python Remediation Script​

import oci

# ----------------- CONFIGURATION -----------------
# Either use config file:
USE_INSTANCE_PRINCIPAL = False
CONFIG_PROFILE = "DEFAULT"

TENANCY_OCID = "<your-tenancy-ocid>"
# If you only want to remediate a single compartment, set COMPARTMENT_OCID
# otherwise leave it None to scan all compartments in the tenancy.
COMPARTMENT_OCID = None

# Target customer-managed KMS key:
TARGET_KMS_KEY_ID = "<your-kms-key-ocid>"   # ocid1.key.oc1...
# Region for Object Storage:
REGION = "us-ashburn-1"
# -------------------------------------------------


def get_signer_and_config():
    if USE_INSTANCE_PRINCIPAL:
        signer = oci.auth.signers.InstancePrincipalsSecurityTokenSigner()
        config = {"region": REGION, "tenancy": TENANCY_OCID}
    else:
        config = oci.config.from_file("~/.oci/config", CONFIG_PROFILE)
        config["region"] = REGION
        signer = None
    return config, signer


def list_compartments(identity_client, tenancy_id):
    """List all active compartments in the tenancy."""
    compartments = []
    response = oci.pagination.list_call_get_all_results(
        identity_client.list_compartments,
        tenancy_id,
        compartment_id_in_subtree=True
    )
    for c in response.data:
        if c.lifecycle_state == "ACTIVE":
            compartments.append(c)
    return compartments


def remediate_buckets_in_compartment(object_storage_client, compartment_id, namespace, target_kms_key_id):
    # List buckets in this compartment
    buckets = oci.pagination.list_call_get_all_results(
        object_storage_client.list_buckets,
        namespace,
        compartment_id=compartment_id
    ).data

    for bucket in buckets:
        bucket_name = bucket.name
        current_kms_key_id = bucket.kms_key_id

        # Skip if already using the desired key
        if current_kms_key_id == target_kms_key_id:
            continue

        print(f"Updating bucket '{bucket_name}' (compartment: {compartment_id}) "
              f"from kms_key_id={current_kms_key_id} to {target_kms_key_id}")

        update_details = oci.object_storage.models.UpdateBucketDetails(
            kms_key_id=target_kms_key_id
        )

        object_storage_client.update_bucket(
            namespace_name=namespace,
            bucket_name=bucket_name,
            update_bucket_details=update_details
        )


def main():
    config, signer = get_signer_and_config()

    identity_client = oci.identity.IdentityClient(config, signer=signer)
    object_storage_client = oci.object_storage.ObjectStorageClient(config, signer=signer)

    # Get namespace (Object Storage is per-tenant per-region)
    namespace = object_storage_client.get_namespace().data

    if COMPARTMENT_OCID:
        # Only remediate one compartment
        remediate_buckets_in_compartment(
            object_storage_client,
            COMPARTMENT_OCID,
            namespace,
            TARGET_KMS_KEY_ID
        )
    else:
        # Remediate all compartments in the tenancy
        compartments = list_compartments(identity_client, TENANCY_OCID)
        for comp in compartments:
            print(f"Scanning compartment: {comp.name} ({comp.id})")
            remediate_buckets_in_compartment(
                object_storage_client,
                comp.id,
                namespace,
                TARGET_KMS_KEY_ID
            )


if __name__ == "__main__":
    main()

4. How This Ties to “Encryption Monitoring”​

If you are using Cloud Guard / Security Zones / Cloud Advisor with a control such as “OCI Encryption Storage Buckets Should Use Customer-Managed KMS Keys,” rerun the detector after this script:

  • All buckets will have kms_key_id set to your customer-managed key.
  • The encryption control should move from “Problem” to “Resolved” state once the service re-evaluates.

If you share whether you want to target only specific compartments, tags, or exclude some buckets, I can adjust the script accordingly.

Using Terraform
# Customer-managed KMS vault
resource "oci_kms_vault" "cmk_vault" {
  compartment_id = "OCID_OF_BUCKET_COMPARTMENT"  # replace with the compartment OCID
  display_name   = "CUSTOMER_MANAGED_VAULT_NAME" # replace with desired vault name
  vault_type     = "DEFAULT"
}

# Customer-managed KMS key
resource "oci_kms_key" "cmk_key" {
  compartment_id = "OCID_OF_BUCKET_COMPARTMENT"  # replace with the compartment OCID
  display_name   = "CUSTOMER_MANAGED_KEY_NAME"   # replace with desired key name
  management_endpoint = oci_kms_vault.cmk_vault.management_endpoint

  key_shape {
    algorithm = "AES"
    length    = 256
  }
}

# Object Storage bucket using the customer-managed KMS key
resource "oci_objectstorage_bucket" "encrypted_bucket" {
  compartment_id = "OCID_OF_BUCKET_COMPARTMENT"   # replace with the compartment OCID
  name           = "BUCKET_NAME"                  # replace with the bucket name
  namespace      = "OBJECTSTORAGE_NAMESPACE"      # replace with your Object Storage namespace

  # This is the setting that remediates the finding
  kms_key_id = oci_kms_key.cmk_key.id
}

Changing kms_key_id on an existing oci_objectstorage_bucket updates the bucket in place; it does not force replacement, so no outage is expected.

To verify, terraform plan should show an in-place ~ update on oci_objectstorage_bucket.encrypted_bucket with kms_key_id changing from null (or the old key OCID) to the OCID of oci_kms_key.cmk_key.