OCI Workloads Hardening

Configure every Compute instance with IMDSv2 enforced by setting are_legacy_imds_endpoints_disabled = true in the instance's instance_options block — at both launch time and as a remediation on existing instances. The OCI Instance Metadata Service v2 requires a session token obtained via an authenticated PUT before any GET to 169.254.169.254/opc/v2/ will return credentials or metadata; the legacy v1 surface accepts unauthenticated GETs and is the SSRF-exploitable path (Oracle Cloud Infrastructure — Instance Metadata Service v2 (accessed 2026-05)). Disabling the legacy endpoints turns the metadata service into a token-required surface that an unauthenticated SSRF reflection cannot drive. PITFALL: a Compute instance that obtains an instance principal via dynamic-group membership inherits the same kill-chain risk as an AWS instance-role identity; SSRF reflection against IMDSv1 hands the attacker an instance-principal session token that the workload's compartment-scoped IAM policy may have generously authorised. Mirrors AWS aws-work-01-imdsv2-mandatory, Azure Trusted Launch at azure-work-01-trusted-launch, and GCP gcp-work-01-shielded-vm — all CRITICAL PREVENTIVE across providers because the SSRF-to-credentials path is the highest-leverage Compute misconfiguration. The principle traces back to General Workloads — runtime security: never let a workload's network position alone determine its identity strength.

Remediation — OCI CLI

# oci CLI (v3.x)
# Enforce IMDSv2-only on an existing instance.
oci compute instance update \
  --instance-id "$INSTANCE_OCID" \
  --instance-options '{"areLegacyImdsEndpointsDisabled": true}' \
  --force

# Launch a new instance with IMDSv2-only from the start.
oci compute instance launch \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --availability-domain "$AD" \
  --shape "VM.Standard.E4.Flex" \
  --shape-config '{"ocpus": 2, "memoryInGBs": 16}' \
  --image-id "$IMAGE_OCID" \
  --subnet-id "$PRIVATE_SUBNET_OCID" \
  --assign-public-ip false \
  --instance-options '{"areLegacyImdsEndpointsDisabled": true}'

# Audit: list instances still allowing IMDSv1 (legacy endpoints enabled).
oci search resource structured-search \
  --query-text "query instance resources where (lifecycleState = 'RUNNING')" \
  --output json \
  | jq -r '.data.items[] | .identifier' \
  | while read -r oid; do
      legacy=$(oci compute instance get --instance-id "$oid" --query 'data."instance-options"."are-legacy-imds-endpoints-disabled"' --raw-output)
      [ "$legacy" = "false" ] && echo "LEGACY-IMDS: $oid"
    done

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Source: Oracle Cloud docs (accessed 2026-05)
resource "oci_core_instance" "app_prod" {
  compartment_id      = var.workload_compartment_id
  availability_domain = data.oci_identity_availability_domain.ad.name
  shape               = "VM.Standard.E4.Flex"
  display_name        = "vm-app-prod-01"

  shape_config {
    ocpus         = 2
    memory_in_gbs = 16
  }

  source_details {
    source_type = "image"
    source_id   = var.hardened_image_ocid
  }

  create_vnic_details {
    subnet_id        = oci_core_subnet.app_prod_private.id
    assign_public_ip = false
    nsg_ids          = [oci_core_network_security_group.app_tier.id]
  }

  # IMDSv2 enforced: legacy v1 endpoint is unreachable; SSRF reflection cannot
  # obtain a session token because most SSRF payloads can only emit GETs.
  instance_options {
    are_legacy_imds_endpoints_disabled = true
  }

  agent_config {
    is_management_disabled = false
    is_monitoring_disabled = false

    plugins_config {
      name          = "Vulnerability Scanning"
      desired_state = "ENABLED"
    }

    plugins_config {
      name          = "OS Management Hub Agent"
      desired_state = "ENABLED"
    }
  }
}

# Instance configuration default — every instance launched via this configuration
# inherits IMDSv2-only without each launch having to remember the toggle.
resource "oci_core_instance_configuration" "hardened_default" {
  compartment_id = var.workload_compartment_id
  display_name   = "ic-hardened-default"

  instance_details {
    instance_type = "compute"
    launch_details {
      compartment_id = var.workload_compartment_id
      shape          = "VM.Standard.E4.Flex"

      instance_options {
        are_legacy_imds_endpoints_disabled = true
      }
    }
  }
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-work-01-instance-metadata-v2" \
  --display-name "oci-work-01-instance-metadata-v2" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-work-01-instance-metadata-v2" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Remediation — Pulumi (TypeScript)

import * as pulumi from "@pulumi/pulumi";
import * as oci from "@pulumi/oci";

// Compute instance with IMDSv2-only metadata access (IMDSv1 disabled).
const cfg = new pulumi.Config();
const compartmentId = cfg.require("compartmentOcid");
const subnetOcid = cfg.require("subnetOcid");
const imageOcid = cfg.require("imageOcid");
const sshAuthorizedKeys = cfg.require("sshAuthorizedKeys");

const hardenedInstance = new oci.core.Instance("hardened-vm", {
  compartmentId: compartmentId,
  availabilityDomain: cfg.require("availabilityDomain"),
  shape: "VM.Standard.E5.Flex",
  shapeConfig: { ocpus: 2, memoryInGbs: 16 },
  displayName: "hardened-vm-imdsv2",
  sourceDetails: {
    sourceType: "image",
    sourceId: imageOcid,
  },
  createVnicDetails: {
    subnetId: subnetOcid,
    assignPublicIp: "false",
  },
  metadata: {
    ssh_authorized_keys: sshAuthorizedKeys,
  },
  instanceOptions: {
    areLegacyImdsEndpointsDisabled: true,  // IMDSv1 OFF — IMDSv2 only
  },
  // Trusted launch surrogate: Secure Boot + Measured Boot via plain shielded-instance config.
  platformConfig: {
    type: "AMD_VM",
    isSecureBootEnabled: true,
    isMeasuredBootEnabled: true,
    isTrustedPlatformModuleEnabled: true,
  },
});

export const instanceOcid = hardenedInstance.id;

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'compute'
          and eventName in ('LaunchInstance', 'UpdateInstance')
          | eval legacy_enabled = if(data.request.payload.instanceOptions.areLegacyImdsEndpointsDisabled = 'false', 'YES', 'NO')
          | where legacy_enabled = 'YES'
          | stats count by 'User Name', data.target.instance.id, eventName

Equivalent on: AWS · Azure · GCP

Operators reach workload Compute instances via the OCI Bastion service, which provisions per-session, time-limited SSH sessions (or managed port-forwarding sessions for non-SSH services such as Oracle Database 1521 or RDP 3389) to target instances that have no public IP; sessions are audited in the OCI Audit service, ephemeral SSH key pairs are bound to the session, and the session TTL is capped at 3 hours with explicit renewal required for longer access windows (Oracle Cloud Infrastructure — Bastion Service overview (accessed 2026-05)). The Bastion attaches to a target subnet in your VCN, applies a client-CIDR allow-list (so only operator-network IPs can initiate sessions), and uses Oracle-managed infrastructure to bridge to the target — no public IPs, no open SSH listener on the workload itself, no long-lived SSH key material on disk to compromise. SSH-to-public-IP is an anti-pattern, not an alternative. Putting a public IP on a workload instance and opening TCP 22 to 0.0.0.0/0 on a Security List or NSG exposes the instance to unauthenticated network scanning and SSH brute-force; even with public-key-only authentication and Fail2ban, the attack surface is the SSH daemon itself and the daemon's TLS / SSH-protocol implementation, not just the password layer. The Bastion service is the default; SSH-to-public-IP is documented here only to be ruled out — this control continues the same anti-pattern enumeration started on oci-net-02 (which denies 0.0.0.0/0 on TCP 22 at the firewall layer regardless of whether the workload has a public IP). HIGH PREVENTIVE because the Bastion is the structural fix for the entire class of "operator opens TCP 22 to debug something" misconfigurations; mirrors AWS Session Manager (aws-work-02), Azure JIT Bastion (azure-work-02), and GCP OS Login + IAP (gcp-work-02). The principle traces back to General Workloads — runtime security: never make the workload's SSH daemon the perimeter.

Remediation — OCI CLI

# oci CLI (v3.x)
# Step 1: create a Standard Bastion attached to a private workload subnet.
oci bastion bastion create \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --bastion-type STANDARD \
  --target-subnet-id "$PRIVATE_SUBNET_OCID" \
  --client-cidr-block-allow-list '["10.0.0.0/8","192.0.2.0/24"]' \
  --max-session-ttl-in-seconds 10800 \
  --name bastion-app-prod

# Step 2: create a managed SSH session against a target Compute instance.
oci bastion session create \
  --bastion-id "$BASTION_OCID" \
  --display-name dev-session-2026-05-23 \
  --session-ttl-in-seconds 10800 \
  --key-details '{"publicKeyContent":"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... ops@bastion"}' \
  --target-resource-details '{
    "sessionType": "MANAGED_SSH",
    "targetResourceId": "'"$INSTANCE_OCID"'",
    "targetResourceOperatingSystemUserName": "opc",
    "targetResourcePort": 22
  }'

# Step 3: connect (the bastion returns an ssh ProxyCommand string at session-create time).
ssh -i ~/.ssh/ephemeral_ed25519 \
    -o ProxyCommand="ssh -W %h:%p -p 22 $SESSION_OCID@host.bastion.$REGION.oci.oraclecloud.com" \
    -p 22 opc@"$INSTANCE_PRIVATE_IP"

# Audit: any session activity is in the Audit service (eventName=session.create).
oci audit event list \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --start-time "$(date -u -d '-7 days' '+%Y-%m-%dT%H:%M:%SZ')" \
  --end-time "$(date -u '+%Y-%m-%dT%H:%M:%SZ')" \
  --query 'data[?contains("event-name", `Session`)].[("event-time"),"event-name",("user-name")]' \
  --output table

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Source: Oracle Cloud docs (accessed 2026-05)
resource "oci_bastion_bastion" "app_prod" {
  compartment_id               = var.workload_compartment_id
  bastion_type                 = "STANDARD"
  target_subnet_id             = oci_core_subnet.app_prod_private.id
  client_cidr_block_allow_list = ["10.0.0.0/8", "192.0.2.0/24"]
  max_session_ttl_in_seconds   = 10800 # 3 hours; the Bastion service hard cap
  name                         = "bastion-app-prod"

  freeform_tags = {
    "purpose" = "operator-access"
    "owner"   = "platform-security"
  }
}

# Per-session resource — typically driven by a just-in-time access tool, not
# baked into the static Terraform state. Shown here for completeness.
resource "oci_bastion_session" "dev_session" {
  bastion_id              = oci_bastion_bastion.app_prod.id
  display_name            = "dev-session-${formatdate("YYYY-MM-DD", timestamp())}"
  session_ttl_in_seconds  = 10800

  key_details {
    public_key_content = var.operator_ephemeral_ssh_pubkey
  }

  target_resource_details {
    session_type                               = "MANAGED_SSH"
    target_resource_id                         = oci_core_instance.app_prod.id
    target_resource_operating_system_user_name = "opc"
    target_resource_port                       = 22
  }
}

# NSG rule on the workload tier: SSH only from the Bastion service's managed
# infrastructure (the Bastion injects its source addresses at session create).
# The deny on 0.0.0.0/0 TCP 22 is enforced by absence — see oci-net-02.

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-work-02-bastion-service" \
  --display-name "oci-work-02-bastion-service" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-work-02-bastion-service" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'bastion'
          and eventName in ('CreateSession', 'UpdateBastion')
          | eval wide_client = if(data.request.payload.clientCidrBlockAllowList like '%0.0.0.0/0%', 'YES', 'NO')
          | eval long_ttl = if(data.request.payload.sessionTtlInSeconds > 10800, 'YES', 'NO')
          | where wide_client = 'YES' or long_ttl = 'YES'
          | stats count by 'User Name', data.target.bastion.id, eventName

Equivalent on: AWS · Azure · GCP

Every Container Registry (OCIR) repository that backs a production workload must satisfy three independent requirements: (1) repository immutability via is_immutable = true so that a published tag cannot be overwritten with new bytes after publication (preserves the bytes-to-name binding the rest of the supply chain assumes), (2) vulnerability scanning via a Vulnerability Scanning Service container scan recipe that scans on push and on a recurring schedule, surfacing OS-package CVEs and language-runtime CVEs in the pushed image layers, and (3) image signing via an OCI Vault key, producing an attestation object that oci-work-06 (the OKE image policy) verifies at admission time (Oracle Cloud Infrastructure — Container Registry (accessed 2026-05)). Immutability without scanning lets vulnerable images through; scanning without immutability lets an attacker who compromises the build pipeline overwrite a signed-and-scanned tag with a backdoored layer; signing without scanning attests bytes that may carry critical CVEs. The three controls compose — none of the three on its own is sufficient. HIGH DETECTIVE because VSS scans surface unsafe state after publication; oci-work-07 (signed build pipeline) and oci-work-06 (admission policy that requires signed images) are the paired PREVENTIVE controls that turn detection into enforcement. Mirrors AWS ECR scan-on-push (aws-work-03), Azure Container Registry scanning (azure-work-03), and GCP Artifact Registry scanning (gcp-work-03). The principle traces back to General Workloads — supply chain: every artifact promoted to production must carry both a scan record and a signature whose root of trust the cluster verifies.

Remediation — OCI CLI

# oci CLI (v3.x)
# Step 1: create an immutable Container Registry repository.
oci artifacts container-repository create \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --display-name prod-images-app \
  --is-immutable true \
  --is-public false

# Step 2: create a VSS container scan recipe with standard scan level (OS + lang CVEs).
oci vulnerability-scans container-scan-recipe create \
  --compartment-id "$SECURITY_COMPARTMENT_OCID" \
  --display-name csr-prod-images \
  --scan-settings '{"scanLevel":"STANDARD"}'

# Step 3: bind the recipe to the target repository (container scan target).
oci vulnerability-scans container-scan-target create \
  --compartment-id "$SECURITY_COMPARTMENT_OCID" \
  --display-name cst-prod-images \
  --container-scan-recipe-id "$CSR_OCID" \
  --target-registry '{
    "type":"OCIR",
    "compartmentId":"'"$WORKLOAD_COMPARTMENT_OCID"'",
    "repositoryId":"'"$REPO_OCID"'"
  }'

# Step 4: sign a pushed image with an OCI Vault key (post-push, pre-deploy).
oci artifacts container-image-signature sign-upload \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --image-id "$IMAGE_OCID" \
  --kms-key-id "$VAULT_KEY_OCID" \
  --kms-key-version-id "$VAULT_KEY_VERSION_OCID" \
  --signing-algorithm SHA_512_RSA_PKCS_PSS \
  --description "release v1.2.3"

# Audit: list scan results above CRITICAL for the repository.
oci vulnerability-scans container-scan-result list \
  --compartment-id "$SECURITY_COMPARTMENT_OCID" \
  --container-scan-target-id "$CST_OCID" \
  --highest-problem-severity CRITICAL \
  --output table

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Source: Oracle Cloud docs (accessed 2026-05)
resource "oci_artifacts_container_repository" "prod_images" {
  compartment_id = var.workload_compartment_id
  display_name   = "prod-images-app"

  # Immutability: a published tag cannot be overwritten. Backdoor-swap defence.
  is_immutable = true
  is_public    = false

  readme {
    content = "Production application images. Immutable; scanned by VSS; signed via Vault key."
    format  = "text/markdown"
  }
}

# Vault key dedicated to image-signing — distinct from data-encryption keys
# so its policy can be tightly scoped (sign-only for the CI principal).
resource "oci_kms_key" "image_signing" {
  compartment_id      = var.security_compartment_id
  display_name        = "key-image-signing-app"
  management_endpoint = data.oci_kms_vault.security.management_endpoint
  protection_mode     = "HSM"

  key_shape {
    algorithm = "RSA"
    length    = 512 # 4096-bit RSA for signing
  }
}

# VSS container scan recipe — STANDARD scan level covers OS + language CVEs.
resource "oci_vulnerability_scans_container_scan_recipe" "prod" {
  compartment_id = var.security_compartment_id
  display_name   = "csr-prod-images"

  scan_settings {
    scan_level = "STANDARD"
  }
}

resource "oci_vulnerability_scans_container_scan_target" "prod" {
  compartment_id             = var.security_compartment_id
  display_name               = "cst-prod-images"
  container_scan_recipe_id   = oci_vulnerability_scans_container_scan_recipe.prod.id

  target_registry {
    type           = "OCIR"
    compartment_id = var.workload_compartment_id
    repository_id  = oci_artifacts_container_repository.prod_images.id
  }
}

# Image signature — typically created by the CI pipeline post-push, not in
# static Terraform state. Shape shown here for the build_spec to model.
resource "oci_artifacts_container_image_signature" "release_v123" {
  compartment_id        = var.workload_compartment_id
  image_id              = var.published_image_ocid
  kms_key_id            = oci_kms_key.image_signing.id
  kms_key_version_id    = var.image_signing_key_version_ocid
  signing_algorithm     = "SHA_512_RSA_PKCS_PSS"
  signature             = var.precomputed_signature_b64
  message               = var.signing_message_b64
  description           = "release v1.2.3"
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-work-03-image-scanning" \
  --display-name "oci-work-03-image-scanning" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-work-03-image-scanning" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' in ('artifacts', 'vulnerability-scanning')
          and eventName in ('UpdateContainerRepository', 'CreateContainerImageSignature', 'PutContainerImage')
          | eval scan_off = if(data.request.payload.isImmutable = 'false' or data.request.payload.scanningEnabled = 'false', 'YES', 'NO')
          | where scan_off = 'YES'
          | stats count by 'User Name', data.target.repository.name, eventName

Equivalent on: AWS · Azure · GCP

Every Compute instance in a workload compartment is enrolled in a Vulnerability Scanning Service host scan recipe that reports OS-package CVEs, open ports relative to the workload's expected listening posture, and CIS-benchmark compliance against the instance's OS family. The recipe runs the Oracle-managed scanner agent inside the instance (enrolled via the Compute agent's Vulnerability Scanning plugin set to ENABLED — see the agent_config block in oci-work-01's Terraform) plus optional port-scan and benchmark sub-scans (Oracle Cloud Infrastructure — Vulnerability Scanning Service (accessed 2026-05)). Findings feed back into OS Management Hub (oci-work-08) which is the remediation surface that actually applies patches via scheduled jobs, closing the detect-then-remediate loop. Scope distinction (anti-conflation): this control is workload-level host scanning — the per-instance Compute hardening surface that pairs with the per-image container scanning surface on oci-work-03. Both surfaces are powered by the same Vulnerability Scanning Service but operate on different artefact types (running OS image vs published container image). HIGH DETECTIVE because absence of host scanning means CVE drift on long-running instances goes unnoticed until exploitation; the remediation pair is OS Management Hub. Mirrors AWS Inspector for EC2 (aws-work-04), Azure Defender for Servers (azure-work-04), and GCP VM Manager (gcp-work-04). The principle traces back to General Workloads — patch management: detection + remediation are paired controls, never substitutes.

Remediation — OCI CLI

# oci CLI (v3.x)
# Step 1: create the host scan recipe (STANDARD = OS CVE + open-port + benchmark).
oci vulnerability-scans host-scan-recipe create \
  --compartment-id "$SECURITY_COMPARTMENT_OCID" \
  --display-name hsr-prod-hosts \
  --port-settings '{"scanLevel":"STANDARD"}' \
  --agent-settings '{
    "scanLevel":"STANDARD",
    "agentConfiguration":{
      "vendor":"OCI",
      "cisBenchmarkSettings":{"scanLevel":"STRICT"}
    }
  }' \
  --schedule '{"type":"DAILY","dayOfWeek":null}'

# Step 2: attach the recipe to a target compartment subtree.
oci vulnerability-scans host-scan-target create \
  --compartment-id "$SECURITY_COMPARTMENT_OCID" \
  --display-name hst-prod-hosts \
  --host-scan-recipe-id "$HSR_OCID" \
  --target-compartment-id "$WORKLOAD_COMPARTMENT_OCID"

# Step 3: query latest scan results above HIGH severity in the workload compartment.
oci vulnerability-scans host-scan-result list \
  --compartment-id "$SECURITY_COMPARTMENT_OCID" \
  --highest-problem-severity HIGH \
  --output table

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Source: Oracle Cloud docs (accessed 2026-05)
resource "oci_vulnerability_scans_host_scan_recipe" "prod_hosts" {
  compartment_id = var.security_compartment_id
  display_name   = "hsr-prod-hosts"

  port_settings {
    scan_level = "STANDARD"
  }

  agent_settings {
    scan_level = "STANDARD"

    agent_configuration {
      vendor = "OCI"

      cis_benchmark_settings {
        scan_level = "STRICT"
      }
    }
  }

  schedule {
    type = "DAILY"
  }
}

resource "oci_vulnerability_scans_host_scan_target" "prod_hosts" {
  compartment_id        = var.security_compartment_id
  display_name          = "hst-prod-hosts"
  host_scan_recipe_id   = oci_vulnerability_scans_host_scan_recipe.prod_hosts.id
  target_compartment_id = var.workload_compartment_id

  # Empty instance_ids means: scan every instance in the target compartment subtree.
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-work-04-vulnerability-scanning" \
  --display-name "oci-work-04-vulnerability-scanning" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-work-04-vulnerability-scanning" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'vulnerability-scanning'
          and eventName in ('DeleteHostScanRecipe', 'DeleteHostScanTarget', 'UpdateHostScanRecipe')
          | eval lowered = if(data.request.payload.applicationScanSettings.applicationScanRecurrence in ('WEEKLY', 'MONTHLY'), 'YES', 'NO')
          | where eventName like 'Delete%' or lowered = 'YES'
          | stats count by 'User Name', data.target.id, eventName

Equivalent on: AWS · Azure · GCP

OCI Functions authenticate to OCI APIs via resource principals — a dynamic-group-bound identity OCI injects into the function's runtime as a short-lived session token, so the function code calls the OCI SDK without ever holding a long-lived user API key (Oracle Cloud Infrastructure — Functions Service overview (accessed 2026-05)). The dynamic-group matching rule pins which functions obtain the principal — typically ALL {resource.type = 'fnfunc', resource.compartment.id = '$WORKLOAD_COMPARTMENT_OCID'} so only functions in the named compartment qualify. IAM policy on the dynamic group is least-privilege: name the specific OCI resource families the function actually needs ("read secret-family", "use keys", "manage object-family on bucket X"), never the catch-all manage all-resources in the tenancy. Secrets: the canonical treatment of secrets handling on OCI Functions lives at General IAM — secrets management; this control documents the OCI-specific shape (Functions configuration references the Vault secret OCID, not the secret value; the function reads the secret at invocation time using its resource principal). The same canonical-content rule was applied on AWS aws-work-05 (Secrets Manager), Azure azure-work-05 (Key Vault), and GCP gcp-work-05 (Secret Manager). HIGH PREVENTIVE because embedded API keys in function code or configuration is the single largest source of cloud-credential leaks in serverless workloads; the structural fix is to eliminate the credential entirely. Cross-link oci-iam-06-instance-principals for the canonical instance / resource principal model. Mirrors AWS Lambda execution role least-priv (aws-work-05), Azure Function managed identity (azure-work-05), GCP Cloud Run service account (gcp-work-05). Principle: General Workloads — serverless-specific concerns.

Remediation — OCI CLI

# oci CLI (v3.x)
# Step 1: create the dynamic group bound to Functions in the workload compartment.
oci iam dynamic-group create \
  --compartment-id "$TENANCY_OCID" \
  --name FunctionsResourcePrincipals \
  --description "All Functions in the workload compartment authenticate as this dynamic group." \
  --matching-rule "ALL {resource.type = 'fnfunc', resource.compartment.id = '$WORKLOAD_COMPARTMENT_OCID'}"

# Step 2: write a least-privilege policy — name specific resource families only.
oci iam policy create \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --name policy-functions-resource-principals \
  --description "Least-privilege grants for Functions resource principals." \
  --statements '[
    "Allow dynamic-group FunctionsResourcePrincipals to read secret-family in compartment Prod",
    "Allow dynamic-group FunctionsResourcePrincipals to use keys in compartment Prod where target.key.id = '"'"'ocid1.key.oc1..exampleocid'"'"'",
    "Allow dynamic-group FunctionsResourcePrincipals to read objects in compartment Prod where target.bucket.name = '"'"'app-data-prod'"'"'"
  ]'

# Step 3: configure the Function with VAULT SECRET OCIDs (not secret values).
oci fn function update \
  --function-id "$FUNCTION_OCID" \
  --config '{
    "VAULT_SECRET_OCID":"'"$DB_PASSWORD_SECRET_OCID"'",
    "OCI_REGION":"eu-frankfurt-1"
  }'

# Audit: list any IAM user that is a member of an Administrators-equivalent group
# AND has Functions invoke rights — Functions should authenticate via resource principal only.
oci iam user list --compartment-id "$TENANCY_OCID" --output table

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Source: Oracle Cloud docs (accessed 2026-05)
resource "oci_identity_dynamic_group" "functions_rp" {
  compartment_id = var.tenancy_ocid
  name           = "FunctionsResourcePrincipals"
  description    = "All Functions in the workload compartment authenticate as this dynamic group."

  matching_rule = "ALL {resource.type = 'fnfunc', resource.compartment.id = '${var.workload_compartment_id}'}"
}

resource "oci_identity_policy" "functions_rp" {
  compartment_id = var.workload_compartment_id
  name           = "policy-functions-resource-principals"
  description    = "Least-privilege grants for Functions resource principals."

  statements = [
    "Allow dynamic-group FunctionsResourcePrincipals to read secret-family in compartment Prod",
    "Allow dynamic-group FunctionsResourcePrincipals to use keys in compartment Prod where target.key.id = '${oci_kms_key.app_data.id}'",
    "Allow dynamic-group FunctionsResourcePrincipals to read objects in compartment Prod where target.bucket.name = 'app-data-prod'",
  ]
}

resource "oci_functions_application" "app_prod" {
  compartment_id = var.workload_compartment_id
  display_name   = "fn-app-prod"
  subnet_ids     = [oci_core_subnet.app_prod_private.id]

  # NSG controls Functions ingress at the VNIC layer.
  network_security_group_ids = [oci_core_network_security_group.functions_tier.id]
}

resource "oci_functions_function" "process_event" {
  application_id = oci_functions_application.app_prod.id
  display_name   = "process-event"
  image          = "${var.region}.ocir.io/${var.tenancy_namespace}/prod-images-app:v1.2.3"
  memory_in_mbs  = "256"

  # Config references Vault secret OCIDs — NEVER secret values themselves.
  # The function reads the secret at invocation time via its resource principal.
  config = {
    "VAULT_SECRET_OCID" = oci_vault_secret.db_password.id
    "OCI_REGION"        = var.region
  }
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-work-05-function-resource-principal" \
  --display-name "oci-work-05-function-resource-principal" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-work-05-function-resource-principal" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'functions'
          and eventName in ('UpdateFunction', 'CreateFunction')
          | eval external_image = if(not data.request.payload.image like '%.ocir.io/%', 'YES', 'NO')
          | where external_image = 'YES'
          | stats count by 'User Name', data.target.function.id, eventName, data.request.payload.image

Equivalent on: AWS · Azure · GCP

Production OKE clusters satisfy a single umbrella of hardening properties simultaneously: (a) Workload Identity — per-pod OCI principal via instance principals on worker nodes plus dynamic-group OCID-based matching, so each Kubernetes service account maps to an OCI dynamic group that scopes the pod's OCI rights to least privilege; (b) private cluster endpoint via endpoint_config { is_public_ip_enabled = false }, so the Kubernetes API server has no public IP and the only access path is from inside the VCN (or via the Bastion service); (c) image signing via OCI Vault keys with the cluster image-policy enabled (image_policy_config { is_policy_enabled = true; key_details { kms_key_id = ... } }), so the kubelet rejects unsigned images at admission and the supply chain from oci-work-03 / oci-work-07 is actually enforced; (d) network policies via the Calico CNI add-on (default OKE networking) or the optional Cilium add-on, enforcing east-west pod isolation that is independent of NSG rules at the worker-node VNIC level; (e) Bastion service for worker-node SSH — workers carry no public IPs, and any node-level debugging happens via Bastion-managed SSH sessions per oci-work-02 (Oracle Cloud Infrastructure — Container Engine for Kubernetes (OKE) (accessed 2026-05)). Basic vs Enhanced clusters: Basic clusters lack the Oracle-managed control-plane SLA and the Cluster Add-on Management feature; Enhanced clusters add the SLA, Virtual Nodes, and Workload Identity in its current GA shape. The hardening posture (this umbrella) is identical between tiers — Basic vs Enhanced is a billing axis, not a control-surface axis. This is authored as one umbrella control because the surfaces compose: private endpoint without image-policy lets unsigned bytes run on internal-only API; image-policy without Workload Identity makes signed pods carry over-broad worker-node-inherited principals; network policies without private endpoint protect pod-to-pod but leave the API server exposed. Mirrors AWS EKS Pod Identity umbrella (aws-work-06), Azure AKS Workload Identity umbrella (azure-work-06), and GCP GKE Workload Identity Federation umbrella (gcp-work-06). HIGH PREVENTIVE because the cluster is the multi-tenant runtime where misconfigurations compound across workloads. Principle: General Workloads — container-specific concerns.

Remediation — OCI CLI

# oci CLI (v3.x)
# Step 1: create the OKE cluster as Enhanced, with a private endpoint and image-policy.
oci ce cluster create \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --name oke-app-prod \
  --vcn-id "$VCN_OCID" \
  --kubernetes-version v1.30.1 \
  --type ENHANCED_CLUSTER \
  --endpoint-config '{
    "isPublicIpEnabled": false,
    "subnetId":"'"$ENDPOINT_SUBNET_OCID"'",
    "nsgIds":["'"$ENDPOINT_NSG_OCID"'"]
  }' \
  --options '{
    "addOns": {"isKubernetesDashboardEnabled": false},
    "kubernetesNetworkConfig": {"podsCidr":"10.244.0.0/16","servicesCidr":"10.96.0.0/16"}
  }' \
  --image-policy-config '{
    "isPolicyEnabled": true,
    "keyDetails":[{"kmsKeyId":"'"$VAULT_KEY_OCID"'"}]
  }'

# Step 2: create the worker node pool in a private subnet — no public IPs on workers.
oci ce node-pool create \
  --cluster-id "$CLUSTER_OCID" \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --name np-app-prod \
  --kubernetes-version v1.30.1 \
  --node-shape "VM.Standard.E4.Flex" \
  --node-shape-config '{"ocpus":2,"memoryInGBs":16}' \
  --node-image-id "$HARDENED_NODE_IMAGE_OCID" \
  --node-config-details '{
    "placementConfigs":[{"availabilityDomain":"'"$AD"'","subnetId":"'"$WORKER_SUBNET_OCID"'"}],
    "size":3,
    "nsgIds":["'"$WORKER_NSG_OCID"'"]
  }'

# Step 3: dynamic group + policy for Workload Identity (per-pod resource principal).
oci iam dynamic-group create \
  --compartment-id "$TENANCY_OCID" \
  --name OkeAppProdWorkloadIdentity \
  --matching-rule "ALL {resource.type = 'workload', resource.compartment.id = '$WORKLOAD_COMPARTMENT_OCID', resource.workload.kind = 'pod', resource.workload.cluster.id = '$CLUSTER_OCID', resource.workload.namespace = 'app-prod', resource.workload.serviceaccount = 'app-sa'}"

oci iam policy create \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --name policy-oke-app-prod-workload-identity \
  --statements '["Allow dynamic-group OkeAppProdWorkloadIdentity to read secret-family in compartment Prod"]'

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Source: Oracle Cloud docs (accessed 2026-05)
resource "oci_kms_key" "oke_image_signing" {
  compartment_id      = var.security_compartment_id
  display_name        = "key-oke-image-signing"
  management_endpoint = data.oci_kms_vault.security.management_endpoint
  protection_mode     = "HSM"

  key_shape {
    algorithm = "RSA"
    length    = 512
  }
}

resource "oci_containerengine_cluster" "app_prod" {
  compartment_id     = var.workload_compartment_id
  name               = "oke-app-prod"
  vcn_id             = oci_core_vcn.app_prod.id
  kubernetes_version = "v1.30.1"
  type               = "ENHANCED_CLUSTER" # Required for Workload Identity GA shape.

  endpoint_config {
    # Private cluster endpoint: API server has no public IP.
    is_public_ip_enabled = false
    subnet_id            = oci_core_subnet.app_prod_oke_endpoint.id
    nsg_ids              = [oci_core_network_security_group.oke_endpoint.id]
  }

  options {
    add_ons {
      is_kubernetes_dashboard_enabled = false
      is_tiller_enabled               = false
    }

    kubernetes_network_config {
      pods_cidr     = "10.244.0.0/16"
      services_cidr = "10.96.0.0/16"
    }

    admission_controller_options {
      is_pod_security_policy_enabled = false # PSPs are removed in v1.25+; use Pod Security Admission.
    }
  }

  # Image policy: kubelet verifies image signatures against the named Vault key
  # at admission time. Unsigned images are rejected.
  image_policy_config {
    is_policy_enabled = true

    key_details {
      kms_key_id = oci_kms_key.oke_image_signing.id
    }
  }
}

resource "oci_containerengine_node_pool" "app_prod" {
  cluster_id         = oci_containerengine_cluster.app_prod.id
  compartment_id     = var.workload_compartment_id
  name               = "np-app-prod"
  kubernetes_version = "v1.30.1"
  node_shape         = "VM.Standard.E4.Flex"

  node_shape_config {
    ocpus         = 2
    memory_in_gbs = 16
  }

  node_source_details {
    source_type = "IMAGE"
    image_id    = var.hardened_node_image_ocid
  }

  node_config_details {
    placement_configs {
      availability_domain = data.oci_identity_availability_domain.ad.name
      subnet_id           = oci_core_subnet.app_prod_oke_workers.id
    }
    size    = 3
    nsg_ids = [oci_core_network_security_group.oke_workers.id]
  }
}

# Workload Identity dynamic group — per-pod (per-namespace + per-service-account) OCID match.
resource "oci_identity_dynamic_group" "oke_workload_identity" {
  compartment_id = var.tenancy_ocid
  name           = "OkeAppProdWorkloadIdentity"
  description    = "Per-pod resource principal for app-prod namespace / app-sa service account."

  matching_rule = "ALL {resource.type = 'workload', resource.compartment.id = '${var.workload_compartment_id}', resource.workload.kind = 'pod', resource.workload.cluster.id = '${oci_containerengine_cluster.app_prod.id}', resource.workload.namespace = 'app-prod', resource.workload.serviceaccount = 'app-sa'}"
}

resource "oci_identity_policy" "oke_workload_identity" {
  compartment_id = var.workload_compartment_id
  name           = "policy-oke-app-prod-workload-identity"

  statements = [
    "Allow dynamic-group OkeAppProdWorkloadIdentity to read secret-family in compartment Prod",
  ]
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-work-06-oke-workload-identity" \
  --display-name "oci-work-06-oke-workload-identity" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-work-06-oke-workload-identity" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'identity'
          and eventName in ('CreateDynamicGroup', 'UpdateDynamicGroup', 'UpdatePolicy')
          | eval workload_bound = if(data.target.id in_subset 'OKEWorkloadIdentityGroups', 'YES', 'NO')
          | where workload_bound = 'YES'
          | stats count by 'User Name', data.target.id, eventName

Equivalent on: AWS · Azure · GCP

Production container images are produced by an OCI DevOps build pipeline (or an external CI system that emits identical artefacts), pushed to an immutable Container Registry repository per oci-work-03, signed with the OCI Vault image-signing key, and only then promoted to the OKE deployment manifest that references them by digest. The build pipeline is the provenance origin — every byte in production must trace to a build job in a known compartment, with the build_spec.yaml stored in source-control and the build context limited to the source repository plus signed dependency manifests (Oracle Cloud Infrastructure — DevOps service (accessed 2026-05)). The signing step inside the pipeline uses the same oci artifacts container-image-signature sign-upload primitive as oci-work-03, but bound to the build pipeline's instance principal so signatures are attributable to specific build jobs. oci-work-06's image-policy verifies the signatures at admission time, closing the supply-chain loop. MEDIUM PREVENTIVE because the build pipeline is the provenance origin; absent a controlled build, every other supply-chain control downstream is verifying signatures whose subjects nobody can audit. Mirrors AWS EC2 Image Builder golden AMIs (aws-work-07), Azure VM Images / Azure DevOps signed builds (azure-work-07), and GCP confidential / signed images (gcp-work-07). Principle: General Workloads — supply chain.

Remediation — OCI CLI

# oci CLI (v3.x)
# Step 1: DevOps project (top-level container for pipelines).
oci devops project create \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --name proj-app-prod \
  --notification-config '{"topicId":"'"$NOTIFICATION_TOPIC_OCID"'"}'

# Step 2: build pipeline.
oci devops build-pipeline create \
  --project-id "$PROJECT_OCID" \
  --display-name bp-app-prod-image-build \
  --description "Builds, scans, and signs the prod-images-app container image."

# Step 3: build stage that invokes build_spec.yaml from source-control.
oci devops build-pipeline-stage create \
  --build-pipeline-id "$BP_OCID" \
  --build-pipeline-stage-type BUILD \
  --display-name stage-docker-build \
  --build-spec-file build_spec.yaml \
  --image OL7_X86_64_STANDARD_10

# A representative build_spec.yaml fragment that does the sign step:
cat <<'EOF' > build_spec.yaml
version: 0.1
component: build
timeoutInSeconds: 1800
shell: bash

steps:
  - type: Command
    name: docker-build
    command: |
      docker build -t "$REGION.ocir.io/$NAMESPACE/prod-images-app:$BUILDRUN_HASH" .
      docker push "$REGION.ocir.io/$NAMESPACE/prod-images-app:$BUILDRUN_HASH"

  - type: Command
    name: sign-image
    command: |
      IMAGE_OCID=$(oci artifacts container-image list \
        --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
        --repository-name prod-images-app \
        --version "$BUILDRUN_HASH" \
        --query 'data.items[0].id' --raw-output)
      oci artifacts container-image-signature sign-upload \
        --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
        --image-id "$IMAGE_OCID" \
        --kms-key-id "$VAULT_KEY_OCID" \
        --kms-key-version-id "$VAULT_KEY_VERSION_OCID" \
        --signing-algorithm SHA_512_RSA_PKCS_PSS \
        --description "build $BUILDRUN_HASH"
EOF

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Source: Oracle Cloud docs (accessed 2026-05)
resource "oci_devops_project" "app_prod" {
  compartment_id = var.workload_compartment_id
  name           = "proj-app-prod"

  notification_config {
    topic_id = oci_ons_notification_topic.devops.id
  }
}

resource "oci_devops_build_pipeline" "image_build" {
  project_id   = oci_devops_project.app_prod.id
  display_name = "bp-app-prod-image-build"
  description  = "Builds, scans, and signs the prod-images-app container image."
}

resource "oci_devops_build_pipeline_stage" "docker_build" {
  build_pipeline_id            = oci_devops_build_pipeline.image_build.id
  build_pipeline_stage_type    = "BUILD"
  display_name                 = "stage-docker-build"
  build_spec_file              = "build_spec.yaml"
  image                        = "OL7_X86_64_STANDARD_10"

  build_source_collection {
    items {
      connection_type = "DEVOPS_CODE_REPOSITORY"
      branch          = "main"
      name            = "source"
      repository_id   = oci_devops_repository.app_prod.id
      repository_url  = oci_devops_repository.app_prod.http_url
    }
  }

  build_pipeline_stage_predecessor_collection {
    items {
      id = oci_devops_build_pipeline.image_build.id
    }
  }
}

# Dynamic group + policy so the build pipeline's instance principal can sign images.
resource "oci_identity_dynamic_group" "devops_build_signers" {
  compartment_id = var.tenancy_ocid
  name           = "DevOpsBuildSigners"

  matching_rule = "ALL {resource.type = 'devopsbuildpipeline', resource.compartment.id = '${var.workload_compartment_id}'}"
}

resource "oci_identity_policy" "devops_build_signers" {
  compartment_id = var.workload_compartment_id
  name           = "policy-devops-build-signers"

  statements = [
    "Allow dynamic-group DevOpsBuildSigners to use keys in compartment Security where target.key.id = '${oci_kms_key.image_signing.id}'",
    "Allow dynamic-group DevOpsBuildSigners to manage repos in compartment Prod where target.repo.name = 'prod-images-app'",
  ]
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-work-07-image-build" \
  --display-name "oci-work-07-image-build" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-work-07-image-build" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'compute'
          and eventName in ('LaunchInstance', 'CreateImage')
          | eval external_image = if(eventName = 'CreateImage' and not data.request.payload.imageSourceDetails.bucketName like '%golden-image-pipeline%', 'YES', 'NO')
          | where external_image = 'YES'
          | stats count by 'User Name', data.target.id, eventName

Equivalent on: AWS · Azure · GCP

Every Compute instance is enrolled as a managed instance in OS Management Hub, attached to one or more software sources (custom mirrors or vendor-default Oracle Linux / Windows software sources), with a scheduled job that installs available package updates on a defined cadence (typical baseline: monthly on a recurring rule such as FREQ=MONTHLY;BYMONTHDAY=15). Patch-compliance reports flow from OS Management Hub into Cloud Guard, where they show up as configuration-detector findings that pair with the Vulnerability Scanning Service CVE detections from oci-work-04 to close the detect-then-remediate loop (Oracle Cloud Infrastructure — OS Management Hub (accessed 2026-05)). Scope distinction: OS Management Hub is the remediation surface (installs patches); VSS is the detection surface (reports unpatched CVEs). Neither replaces the other — VSS without OS Management Hub leaves remediation manual; OS Management Hub without VSS leaves compliance unverified. MEDIUM DETECTIVE because the compliance reports surface unsafe state (instances out of patch SLA); the active remediation is the scheduled-job that pairs with the maintenance window. Mirrors AWS Systems Manager Patch Manager (aws-work-08), Azure Update Manager (azure-work-08), and GCP VM Manager Patch (gcp-work-08) — all MEDIUM DETECTIVE across providers because patch-management reports compliance and pairs with the remediation schedule, not because it prevents single-step exploitation. Principle: General Workloads — patch management.

Remediation — OCI CLI

# oci CLI (v3.x)
# Step 1: attach a Compute instance as an OS Management Hub managed instance.
oci os-management-hub managed-instance attach \
  --managed-instance-id "$INSTANCE_OCID" \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID"

# Step 2: create a vendor-default software source for Oracle Linux 9 x86_64.
oci os-management-hub software-source create \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --display-name ss-prod-ol9-x86 \
  --vendor-name ORACLE \
  --os-family ORACLE_LINUX_9 \
  --architecture-type X86_64 \
  --software-source-type VENDOR

# Step 3: attach the software source to the managed instance.
oci os-management-hub managed-instance attach-software-source \
  --managed-instance-id "$INSTANCE_OCID" \
  --software-source-id "$SS_OCID"

# Step 4: scheduled monthly patch job — install all available package updates on the 15th.
oci os-management-hub scheduled-job create \
  --display-name sj-prod-monthly-patch \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --schedule-type CUSTOM \
  --time-next-execution "$(date -u -d 'next month 15' '+%Y-%m-%dT02:00:00Z')" \
  --recurring-rule "FREQ=MONTHLY;BYMONTHDAY=15" \
  --operations '[{"operationType":"INSTALL_PACKAGES","manageModuleStreamsDetails":null}]' \
  --managed-instance-ids '["'"$INSTANCE_OCID"'"]'

# Audit: list managed instances out of patch compliance.
oci os-management-hub managed-instance list \
  --compartment-id "$WORKLOAD_COMPARTMENT_OCID" \
  --status NEEDS_ATTENTION \
  --output table

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Source: Oracle Cloud docs (accessed 2026-05)
resource "oci_os_management_hub_managed_instance" "app_prod" {
  managed_instance_id = oci_core_instance.app_prod.id

  # The agent_config in oci-work-01's instance Terraform must have the
  # 'OS Management Hub Agent' plugin set to ENABLED for this enrolment to take.
}

resource "oci_os_management_hub_software_source" "prod_ol9" {
  compartment_id       = var.workload_compartment_id
  display_name         = "ss-prod-ol9-x86"
  vendor_name          = "ORACLE"
  os_family            = "ORACLE_LINUX_9"
  arch_type            = "X86_64"
  software_source_type = "VENDOR"
}

resource "oci_os_management_hub_managed_instance_attach_software_sources_management" "app_prod" {
  managed_instance_id = oci_os_management_hub_managed_instance.app_prod.id
  software_sources    = [oci_os_management_hub_software_source.prod_ol9.id]
}

resource "oci_os_management_hub_scheduled_job" "monthly_patch" {
  display_name         = "sj-prod-monthly-patch"
  compartment_id       = var.workload_compartment_id
  schedule_type        = "CUSTOM"
  time_next_execution  = "2026-06-15T02:00:00Z"
  recurring_rule       = "FREQ=MONTHLY;BYMONTHDAY=15"
  managed_instance_ids = [oci_core_instance.app_prod.id]

  operations {
    operation_type = "INSTALL_PACKAGES"
  }
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-work-08-os-management-hub" \
  --display-name "oci-work-08-os-management-hub" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-work-08-os-management-hub" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'osmh'
          and eventName in ('UpdateProfile', 'DeleteProfile', 'DisableManagementForManagedInstance')
          | eval channels_dropped = if(data.request.payload.softwareSources = '[]', 'YES', 'NO')
          | where eventName like 'Delete%' or eventName like 'Disable%' or channels_dropped = 'YES'
          | stats count by 'User Name', data.target.id, eventName

Equivalent on: AWS · Azure · GCP