Block volume is encrypted with a Customer Managed Key (CMK)

Check ID: blockstorage_block_volume_encrypted_with_cmk
Provider: Oracle Cloud (OCI)
Service: blockstorage
Severity: MEDIUM
Categories: encryption
Resource type: Volume

What this check verifies

OCI block volumes use Customer-Managed Keys (CMK) from Vault for at-rest encryption instead of Oracle-managed keys. Identifies whether a block volume has a customer-managed key associated for its encryption.

Risk

Without CMK, encryption key control is limited, impacting confidentiality and auditability:

No rapid key disable/rotation to contain breaches
Weaker restrictions and visibility on decrypt operations This can prolong unauthorized data access and hinder incident response and compliance.

Recommendation

Use Customer-Managed Keys in Vault for all block volumes.

Enforce least privilege and separation of duties on key usage
Rotate keys regularly and monitor KMS events
Validate that key disable/deny revokes data access Apply the same controls to snapshots and backups.

Remediation

CLI
Terraform
Dashboard steps

oci bv volume update —volume-id <VOLUME_OCID> —kms-key-id <KMS_KEY_OCID>

resource "oci_core_volume" "<example_resource_name>" {
  compartment_id      = "<example_resource_id>"
  availability_domain = "<example_resource_name>"
  size_in_gbs         = 50

  kms_key_id = "<example_resource_id>" # Critical: uses a Customer Managed Key to encrypt the volume
}

References

https://docs.oracle.com/en-us/iaas/Content/Block/Concepts/overview.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = blockstorage_block_volume_encrypted_with_cmk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Tenancy audit log retention period is 365 days or greater Boot volume is encrypted with Customer Managed Key

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires