Skip to main content

Assess Oracle Cloud Infrastructure (OCI) Security with cnspec

cnspec assesses your full Oracle Cloud Infrastructure (OCI) environment for misconfigurations that put your organization at risk. You can scan your OCI tenancy for compliance with security policies created by Mondoo or the community, or create your own policies. You also can write individual tests to run on the fly or include in automated tasks.

cnspec can test any aspect of your OCI configuration. For a list of OCI resources you can test, read Mondoo Oracle Cloud Infrastructure (OCI) Resource Pack Reference and Mondoo Core Resource Pack Reference.

Connect cnspec with your OCI environment


To test your OCI environment with cnspec, you must have:

Configure command-line access to OCI

For cnspec to communicate with your OCI tenancy, you need to configure secure access from the command line. You download a private API key and create a config file to automatically authenticate you with Oracle.

  1. In the top-right corner of the Oracle Cloud Infrastructure Console, select your profile icon and select My profile.

    OCI profile menu

  2. Under Resources, select API keys.

    OCI API keys

  3. Select the Add API key button.

    Add OCI API key

  4. Leave Generate API key pair selected and select the Download private key button.

  5. Create a new directory on your workstation, ~/.oci/, and move the downloaded private key file into the new directory.

  6. Select the Add button. OCI generates a config file for you. Copy the contents of the Configuration file preview box.

    OCI config preview

  7. In the new directory, create a file named config and paste the content you copied in step 6. Replace the key_file placeholder on the last line with the path and file name of your private key file.


Verify with a quick OCI check

To quickly confirm that cnspec has access to your OCI environment, run this check from your terminal:

cnspec run oci -c 'oci.tenancy { id!="foo" }'

It asserts that your tenancy does not have the ID foo.

cnspec indicates that the check is true, that your tenancy is not named foo:

oci.tenancy: {
id != "foo": true

You've successfully used cnspec to run your first check on your OCI environment. Now you're ready to explore. The method you choose depends on your goals:

  • For widescale assessment of your OCI infrastructure, scan using policy bundles. These collections of tests work together to present a broad picture of your OCI security posture.

  • To run ad hoc checks against your OCI environment, use cnspec's interactive shell. It has auto-complete to guide you, which is especially helpful when you're new to cnspec and learning MQL.

Assess OCI security with policy-based scanning

The CIS Oracle Cloud Infrastructure Foundation Benchmark policy is available to all in Mondoo's cnspec-policies GitHub repo. This collection of tests evaluates how well your environment follows fundamental OCI security best practices. It checks for misconfigurations across your entire OCI infrastructure.

To scan using the OCI Security by Mondoo policy, run:

cnspec scan oci

This scans the tenancy to which your OCI account gives you access.

cnspec follows these steps to load policies on which it bases the scan:

  • cnspec tries to read a config file, mondoo.yml, which includes the certificate and private key for authenticating with Mondoo Platform. If it finds the config, it loads the policies enabled for the OCI integration in the Mondoo space this OCI environment belongs to. You can enter cnspec status to see if the config file exists and cnspec is registered.
  1. If there is no config file (you have not registered cnspec or you've removed the mondoo.yml file), then cnspec loads the open source policies from the Mondoo Open Security Registry scans based on those.

If cnspec is registered but you want to use the open source policies (and not share results with Mondoo Platform), you can scan in incognito mode:

cnspec scan oci --incognito

You can also specify a particular policy bundle. cnspec uses only the bundle you specify:

cnspec scan oci --policy mondoohq/oracle-cloud-infrastructure-foundation-level-1

You can also create your own policies to meet your specific needs. To learn more about policies, read Policies.

Test OCI with the cnspec shell

The cnspec shell is handy for quick checks and tests, or for developing your MQL skills. Its auto-complete and help features guide you in writing checks.

To launch a shell into your OCI environment, enter:

cnspec shell oci

Discover capabilities with the help command

Once inside the shell, use the help command to learn what OCI resources you can test. This command lists all the OCI resources:

help oci

From the resulting list, you can drill down further. For example, enter this command to list all the OCI Object Storage resources you can test:

help oci.objectStorage

From the resulting list, you can drill down even further. You can also learn about available OCI resources in the Mondoo OCI Resource Pack Reference.

Run tests in the cnspec shell

Now that you know how to discover what's possible with cnspec, let's run some actual tests in the shell.

Assess MFA for console users

This test assures that multi-factor authentication (MFA) is enabled for all users with console access:

oci.identity.users.all( mfaActivated )

If the test passes, that means all users have MFA enabled. If the test fails, cnspec lists all the user accounts that don't have MFA enabled.

[failed] [].all()
actual: [
0: oci.identity.user {
name: ""
mfaActivated: false
1: oci.identity.user {
name: ""
mfaActivated: false
2: oci.identity.user {
name: ""
mfaActivated: false
3: oci.identity.user {
name: ""
mfaActivated: false

Assess audit log retention

This test asserts that audit logs remain in storage for 365 days:

oci.tenancy.retentionPeriod == 365 *

cnspec returns ok or failed and the actual retention time.

Exit the cnspec shell

To exit the cnspec shell, either press Ctrl + D or type exit.

Learn more about querying OCI