Oracle Cloud Security Penetration And Vulnerability Testing

More Info:

As a service administrator, you can run tests for some Oracle Cloud services. Before running the tests, you must first review the Oracle Cloud Testing Policies section.

Risk Level

Medium

Address

Security

Compliance Standards

CIS OKE

Triage and Remediation

Remediation

Remediation

Manual Steps

Confirm account privileges and scope
- Sign in to the Oracle Cloud Console for the tenancy and region where the Kubernetes cluster and related services (VCNs, Load Balancers, Registry, etc.) run.
- Verify you have a user with permission to submit service requests and manage the tenancy (for example, tenancy-administrators group or equivalent custom IAM policy granting manage support-requests and inspect tenancy).
Identify services and environments you intend to test
- In the Console, list the relevant services you plan to include in penetration/vulnerability testing (e.g., OKE clusters, Compute instances, Load Balancers, API Gateways, Object Storage, OCI Registry).
- Document: tenancy OCID, compartment OCIDs, regions, and high‑level list of assets (cluster names, public IPs, hostnames).
- From any machine with OCI CLI configured, capture a basic inventory, for example:
```
oci iam tenancy get
oci ce cluster list --all
oci lb load-balancer list --all
oci compute instance list --all
```
Review Oracle Cloud Security Testing Policy
- Navigate to the Oracle Cloud Security Testing Policy page:
  https://docs.cloud.oracle.com/en-us/iaas/Content/Security/Concepts/security_testing-policy.htm
- Explicitly verify:
  - Which services are eligible for customer‑initiated testing.
  - Any prohibited activities (e.g., denial‑of‑service, social engineering).
  - Required notification process and lead times.
  - Scope limitations (e.g., shared services that may not be tested).
- Compare your intended test methods and tools against these requirements and adjust your test plan to comply.
Submit required Cloud Security Testing Notification / Service Request
- In the Console, go to “Help” → “Create Support Request” (or “Support” → “Create Service Request” depending on UI).
- Create a request of the appropriate type for Security Testing Notification, and include at minimum:
  - Tenancy OCID and contact details.
  - Exact time window (with timezone) for testing.
  - Detailed scope (IPs, FQDNs, compartments, services, OKE cluster identifiers).
  - Types of tests and tools to be used.
- Wait for Oracle’s acknowledgment/approval and retain the SR number for audit purposes.
Align internal procedures and tooling with the approved scope
- Update your internal penetration/vulnerability testing runbooks to:
  - Reference the Oracle Security Testing Policy URL and the specific SR number.
  - Clearly define which targets and techniques are allowed and which are prohibited.
- Ensure all testing tools are configured to respect the approved time window and scope (targets, rate limits, and test types).
Verify and document compliance evidence
- From any machine with OCI CLI configured, export details that show what is being tested and keep them linked to the support request:
```
oci ce cluster list --all > /tmp/oke_clusters_under_test.json
oci lb load-balancer list --all > /tmp/load_balancers_under_test.json
```
- In the Console, confirm the Security Testing Notification / Support Request is in an accepted/open state that covers the planned testing window.
- Store: a copy of the Oracle testing policy, your approved SR, and the asset inventory as evidence that penetration and vulnerability testing on OCI is being conducted in accordance with CISOKE 5.1.1 and Oracle’s policy.

Using kubectl

kubectl cannot be used to configure Oracle Cloud’s penetration and vulnerability testing or accept the Oracle Cloud Testing Policies; those actions must be performed in the Oracle Cloud Console/CLI or via IaC at the cloud-provider level. Refer to the Manual Steps section for the required review and notification process in Oracle Cloud.

Automation

#!/usr/bin/env bash
set -euo pipefail

# PURPOSE:
# This script runs from any machine with kubectl access and OCI CLI access.
# It does NOT perform any changes. It collects evidence so you can manually
# decide whether current image sources and policies align with Oracle Cloud
# Security Testing Policies for penetration and vulnerability testing.
#
# REQUIREMENTS:
# - kubectl configured to reach the target OKE cluster
# - OCI CLI configured with tenancy/region matching the cluster’s tenancy
# - jq installed

echo "==[ 1/4 ] Cluster identification (OKE hints) =="

# Try to detect if we are on OKE by looking for Oracle-specific annotations/labels
kubectl get ns kube-system -o yaml | grep -i 'oracle' || true
kubectl get nodes -o json | jq -r '
  .items[] |
  {
    name: .metadata.name,
    providerID: .spec.providerID,
    labels: .metadata.labels
  }' 2>/dev/null || true

cat <<'EOF'

INTERPRETATION:
- If node.spec.providerID contains "oci://", cluster likely runs on Oracle Cloud Infrastructure.
- Presence of Oracle/OKE-specific labels or annotations further confirms OKE.

POTENTIAL PROBLEM INDICATION:
- If you intend to run penetration or vulnerability tests against this OKE cluster
  but have NOT reviewed and complied with Oracle Cloud Security Testing Policies,
  this CIS control is not satisfied.
EOF

echo
echo "==[ 2/4 ] List all container images currently used in the cluster =="

kubectl get pods --all-namespaces -o json | jq -r '
  .items[]
  | .spec.containers[]?.image,
    .spec.initContainers[]?.image
' | sort -u

cat <<'EOF'

INTERPRETATION:
- This is the authoritative list of container images (including init containers)
  currently running in the cluster.

POTENTIAL PROBLEM INDICATION:
- If planned penetration/vulnerability testing will target any of these images
  (e.g., scanning, fuzzing, active probing) and:
  * you have not submitted the appropriate Oracle Cloud Security Testing
    Notification as required by:
      https://docs.cloud.oracle.com/en-us/iaas/Content/Security/Concepts/security_testing-policy.htm
  * or the testing scope exceeds what is allowed without prior approval,
  then this CIS control is not met.
EOF

echo
echo "==[ 3/4 ] Detect common security / scanning tools deployed in-cluster =="

# Heuristic: look for namespaces and deployments commonly used for scanning/testing
echo "-- Namespaces (look for security / scanning / pentest tooling) --"
kubectl get ns

echo
echo "-- Workloads with common scanner/pentest keywords in names --"
kubectl get deploy,ds,sts,job,cronjob -A -o json 2>/dev/null | jq -r '
  .items[]
  | select(
      (.metadata.name | test("trivy|anchore|clair|grype|falco|kube-bench|kubehunter|kube-hunter|zap|nessus|qualys|tenable|burp|pentest"; "i"))
      or
      (.metadata.namespace | test("security|scanner|pentest|audit|compliance"; "i"))
    )
  | "\(.kind) \(.metadata.namespace)/\(.metadata.name)"
' || true

cat <<'EOF'

INTERPRETATION:
- If you see tools like Trivy, Anchore, Clair, Grype, kube-bench, kube-hunter,
  Falco, or other scanning/pentest tools, they may be performing security testing
  against workloads running on Oracle Cloud.

POTENTIAL PROBLEM INDICATION:
- If such tools are performing active penetration or vulnerability testing
  that:
  * has not been reviewed against Oracle Cloud Security Testing Policies, or
  * exceeds permitted testing without an approved Cloud Security Testing Notification,
  the environment may be out of compliance with CIS OKE 5.1.1.
EOF

echo
echo "==[ 4/4 ] OCI tenancy context for formal testing notification (via OCI CLI) =="

# These commands do NOT file a request; they show context you should use when filing.
echo "-- OCI CLI user and tenancy context --"
oci iam compartment list --all 1>/dev/null 2>&1 && {
  oci iam user list --all | jq -r '.data[] | .name + " (" + (.id) + ")"' | head -n 5
  echo
  echo "-- Current region (as configured in OCI CLI) --"
  oci iam region-subscription list | jq -r '.data[]."region-name"'
} || {
  echo "OCI CLI not configured or insufficient privileges; skipping OCI context."
}

cat <<'EOF'

INTERPRETATION:
- Use the OCI tenancy, region, and account information from the OCI CLI
  configuration when submitting a Cloud Security Testing Notification.

POTENTIAL PROBLEM INDICATION:
- If cluster administrators are running or planning to run penetration /
  vulnerability tests but:
  * there is no clear mapping between the cluster and the OCI tenancy/region, or
  * administrators lack an Oracle Account with privileges to file service
    maintenance / security testing requests,
  then you may be unable to comply with Oracle’s testing policy.

NEXT MANUAL STEPS (REQUIRED BY CIS OKE 5.1.1):
1. Manually review Oracle Cloud Security Testing Policies:
   https://docs.cloud.oracle.com/en-us/iaas/Content/Security/Concepts/security_testing-policy.htm
2. Decide whether planned or ongoing tests against this OKE cluster fall under
   those policies.
3. If required, submit a Cloud Security Testing Notification using an Oracle
   Account with the necessary privileges, for the correct tenancy and region.
4. Retain evidence of the notification/approval and link it to this cluster.

This script only surfaces information; it does NOT and CANNOT automate policy
acceptance or notification submission.
EOF

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​