Securing Block Volume

To use Block Volume securely, learn about your security and compliance responsibilities.

In general, Oracle provides security of cloud infrastructure and operations, such as cloud operator access controls and infrastructure security patching. You are responsible for securely configuring your cloud resources. Security in the cloud is a shared responsibility between you and Oracle.

Oracle is responsible for the following security requirements:

• Physical Security: Oracle is responsible for protecting the global infrastructure that runs all services offered in Oracle Cloud Infrastructure. This infrastructure consists of the hardware, software, networking, and facilities that run Oracle Cloud Infrastructure services.

Your security responsibilities are described on this page, which include the following areas:

• Access Control: Limit privileges as much as possible. Users should be given only the access necessary to perform their work.
• Encryption and Confidentiality: Use encryption keys and secrets to protect your data and connect to secured resources. Rotate these keys regularly.

Use this checklist to identify the tasks you perform to secure Block Volume in a new Oracle Cloud Infrastructure tenancy.

After getting started with Block Volume use this checklist to identify security tasks that we recommend you perform regularly.

Use policies to limit access to Block Volume.

We recommend that you give DELETE permissions to a minimum set of IAM users and groups. This practice minimizes loss of data from inadvertent deletes by authorized users or from malicious actors. Only give DELETE permissions to tenancy and compartment administrators.

Oracle Cloud Infrastructure supports two types of volumes: block volumes and boot volumes. Block volumes allow instance storage capacity to be expanded dynamically. A boot volume contains the image used to boot the compute instance. The IAM service groups the family of related volume resource types into a combined resource type called volume-family.

Assign least privilege access for IAM users and groups to resource types in volume-family. The resource types in volume-family are volumes,volume-attachments, and volume-backups.

• The volumes resources are detachable block volume devices that allow dynamic expansion of instance storage capacity or contain the image for booting the instance.
• The volume-attachments resources are attachments between volumes and instances.
• The volume-backups resources are point-in-time copies of volumes that can be used to create block volumes or recover block volumes.

Allow group VolumeUsers to manage volumes in tenancy
 where request.permission!='VOLUME_DELETE' 
Allow group VolumeUsers to manage volume-backups in tenancy
 where request.permission!='VOLUME_BACKUP_DELETE'

Allow group VolumeUsers to manage volume-attachments in tenancy
 where request.permission!='VOLUME_ATTACHMENT_DELETE'

For more information about Block Volume policies and to view more examples, see Details for the Core Services.

Enable Cloud Guard and use it to detect and respond to security issues in Block Volume.

Upon detecting a problem, Cloud Guard suggests corrective actions. You can also configure Cloud Guard to automatically take certain actions. Cloud Guard includes the following detector rules for Block Volume.

• Block Volume is encrypted with Oracle-managed key
• Block Volume is not attached

For a list of all available detector rules in Cloud Guard, see Detector Recipe Reference.

If you haven't done so already, enable Cloud Guard and configure it to monitor the compartments that contain your resources. You can configure Cloud Guard targets to examine your entire tenancy (root compartment and all subcompartments), or to check only specific compartments. See Getting Started with Cloud Guard.

After enabling Cloud Guard, you can view and resolve detected security problems. See Processing Reported Problems.

Using Security Zones ensures your resources in Block Volume comply with security best practices.

A security zone is associated with one or more compartments and a security zone recipe. When you create and update resources in a security zone's compartment, Oracle Cloud Infrastructure validates these operations against the list of security zone policies in the recipe. If any policy in the recipe is violated, then the operation is denied. The following security zone policies are available for resources in Block Volume.

• deny block_volume_not_in_security_​zone_attach_to_instance_​in_security_zone
• deny block_volume_in_security_​zone_attach_to_instance_​not_in_security_zone
• deny boot_volume_not_in_security_​zone_attach_to_instance_​in_security_zone
• deny boot_volume_in_security_​zone_attach_to_instance_​not_in_security_zone
• deny attached_block_volume_not_​in_security_zone_move_to_​compartment_in_security_zone
• deny attached_boot_volume_not_in_​security_zone_move_to_​compartment_in_security_zone
• deny block_volume_without_​vault_key
• deny boot_volume_without_​vault_key

For a list of all security zone policies, see Security Zone Policies.

To move existing resources to a compartment that is in a security zone, the resources must comply with all security zone policies in the zone's recipe. Similarly, resources in a security zone can’t be moved to a compartment outside of the security zone because it might be less secure. See Managing Security Zones.

The Block Volume service always encrypts all block volumes, boot volumes, and volume backups at rest by using the Advanced Encryption Standard (AES) algorithm with 256-bit encryption. You can use an Oracle-provided encryption key or a custom key in the Vault service. You can also encrypt your data volumes using tools like dm-crypt, veracrypt, and Bit-Locker.

By default all volumes and their backups are encrypted using the Oracle-provided encryption keys. Each time a volume is cloned or restored from a backup the volume is assigned a new unique encryption key.

Take regular backups of your data in Block Volume. We recommend that you give a minimum set of users and groups permission to delete backups.

To minimize loss of data caused by deletes or corruption, we recommend that you make periodic backups of volumes. Oracle Cloud Infrastructure allows automated scheduled backups. For more information about scheduled backups, see Policy-Based Backups.

To minimize loss of data caused by inadvertent deletes by an authorized user or by malicious deletes, we recommend that you grant VOLUME_DELETE, VOLUME_ATTACHMENT_DELETE, and VOLUME_BACKUP_DELETE permissions to a minimum possible set of IAM users and groups. Grant DELETE permissions only to tenancy and compartment administrators.

Locate access logs and other security data for Block Volume.

The Audit service automatically records all API calls to Oracle Cloud Infrastructure resources. You can achieve your security and compliance goals by using the Audit service to monitor all user activity within your tenancy. Because all Console, SDK, and command line (CLI) calls go through our APIs, all activity from those sources is included. Audit records are available through an authenticated, filterable query API or they can be retrieved as batched files from Object Storage. Audit log contents include what activity occurred, the user that initiated it, the date and time of the request, as well as source IP, user agent, and HTTP headers of the request. See Viewing Audit Log Events.

{
  "datetime": 1642993213028,
  "logContent": {
    "data": {
      "additionalDetails": {
        "X-Real-Port": 55984
      },
      "availabilityDomain": "AD3",
      "compartmentId": "ocid1.compartment.oc1..<unique_ID>",
      "compartmentName": "mycompartment",
      "definedTags": null,
      "eventGroupingId": "<unique_ID>",
      "eventName": "ListBootVolumes",
      "freeformTags": null,
      "identity": {
        "authType": null,
        "callerId": null,
        "callerName": null,
        "consoleSessionId": null,
        "credentials": "<key>",
        "ipAddress": "<IP_address>",
        "principalId": "<user_ID>",
        "principalName": "<user_name>",
        "tenantId": "ocid1.tenancy.oc1..<unique_ID>",
        "userAgent": "Oracle-JavaSDK/1.37.1 (Linux/4.14.35-2047.510.4.1.el7uek.x86_64; Java/1.8.0_301; Java HotSpot(TM) 64-Bit Server VM GraalVM EE 20.3.3/25.301-b09-jvmci-20.3-b18)"
      },
      "message": "ListBootVolumes succeeded",
      "request": {
        "action": "GET",
        "headers": {
          "Accept": [
            "application/json"
          ],
          "Authorization": [
            "Signature headers=\"date (request-target) host\",keyId=<key>"
          ],
          "Connection": [
            "keep-alive"
          ],
          "Date": [
            "Mon, 24 Jan 2022 03:00:12 GMT"
          ],
          "User-Agent": [
            "Oracle-JavaSDK/1.37.1 (Linux/4.14.35-2047.510.4.1.el7uek.x86_64; Java/1.8.0_301; Java HotSpot(TM) 64-Bit Server VM GraalVM EE 20.3.3/25.301-b09-jvmci-20.3-b18)"
          ],
          "opc-client-info": [
            "Oracle-JavaSDK/1.37.1"
          ],
          "opc-request-id": [
            "<unique_ID>"
          ]
        },
        "id": "<unique_ID>",
        "parameters": {
          "availabilityDomain": [
            "EMIr:PHX-AD-3"
          ],
          "compartmentId": [
            "ocid1.compartment.oc1..<unique_ID>"
          ],
          "limit": [
            "1000"
          ]
        },
        "path": "/20160918/bootVolumes"
      },
      "resourceId": null,
      "response": {
        "headers": {
          "Connection": [
            "close"
          ],
          "Content-Length": [
            "2"
          ],
          "Content-Type": [
            "application/json"
          ],
          "Date": [
            "Mon, 24 Jan 2022 03:00:13 GMT"
          ],
          "X-Content-Type-Options": [
            "nosniff"
          ],
          "opc-request-id": [
            "<unique_ID>"
          ]
        },
        "message": null,
        "payload": {},
        "responseTime": "2022-01-24T03:00:13.028Z",
        "status": "200"
      },
      "stateChange": {
        "current": null,
        "previous": null
      }
    },
    "dataschema": "2.0",
    "id": "<unique_ID>",
    "oracle": {
      "compartmentid": "ocid1.compartment.oc1..<unique_ID>",
      "ingestedtime": "2022-01-24T03:00:45.483Z",
      "loggroupid": "_Audit",
      "tenantid": "ocid1.tenancy.oc1..<unique_ID>"
    },
    "source": "",
    "specversion": "1.0",
    "time": "2022-01-24T03:00:13.028Z",
    "type": "com.oraclecloud.BlockVolumes.ListBootVolumes"
  }
}

If you enabled Cloud Guard in your tenancy, then it reports any user activities that are potential security concerns. Upon detecting a problem, Cloud Guard suggests corrective actions. You can also configure Cloud Guard to automatically take certain actions. See Getting Started with Cloud Guard and Processing Reported Problems.