Compute instance has in-transit encryption enabled
compute_instance_in_transit_encryption_enabled
OCI compute instances are evaluated for in-transit encryption on paravirtualized block or boot volume attachments, confirming that data exchanged between the instance and attached volumes is encrypted during transfer.
Risk
Without in-transit encryption, volume traffic can be inspected or altered on internal paths. A threat actor or compromised host could read sensitive data, inject corrupted blocks, or replay writes, undermining confidentiality and integrity, and risking availability through data corruption.
prowler oraclecloud --checks compute_instance_in_transit_encryption_enabled
Recommendation
Enable in-transit encryption for all paravirtualized volume attachments and make it standard in golden images and IaC. Apply defense in depth with customer-managed keys and regular rotation. Periodically verify attachments and remediate drift so no instance communicates with volumes over unencrypted channels.
Remediation
oci compute boot-volume-attachment update --boot-volume-attachment-id <boot-volume-attachment-ocid> --is-pv-encryption-in-transit-enabled true
- In the OCI Console, go to Compute > Instances and open the target instance
- Under Resources, click the boot volume attachment, choose Edit, enable "Use in-transit encryption", and Save
- For each attached block volume (paravirtualized), open the attachment (More actions > Edit), enable "Use in-transit encryption", and Save
- If Edit isn't available for an attachment, detach it and reattach it with "Use in-transit encryption" checked
Source Code
Resource Type
Instance