Loading controls...
Control: 1.13 Ensure Dynamic Groups are used for OCI instances, OCI Cloud Databases and OCI Function to access OCI resources
Description
OCI instances, OCI database and OCI functions can access other OCI resources either via an OCI API key associated to a user or by being including in a Dynamic Group that has an IAM policy granting it the required access. Access to OCI Resources refers to making API calls to another OCI resource like Object Storage, OCI Vaults, etc.
Remediation
From Console
- Login to OCI Console.
- Select
Identityfrom Services menu. - Select
Dynamic Groupsfrom Identity menu. - Click Create Dynamic Groups.
- Enter a Name.
- Enter a Description.
- Enter Matching Rules to that includes the instances accessing your OCI resources.
- Click
Create.
Usage
Run the control in your terminal:
powerpipe control run oci_compliance.control.cis_v120_1_13Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run oci_compliance.control.cis_v120_1_13 --shareSQL
This control uses a named query:
manual_control