OCI Security Professional cheat sheet

A principal is an IAM user, group, dynamic group, or instance principal; every request must be authenticated as one of these.

Policy syntax: allow to in where ; verb is inspect, read, use, or manage (cumulative).

Inspect grants access to metadata only; read adds read access to the resource; use adds create/update/delete for existing resources; manage adds full control including creating and deleting.

A dynamic group matches instances by matching rule (e.g., instance.compartment.id = 'ocid1.compartment...'), enabling instance principals without storing credentials.

Federation (SAML 2.0 or OIDC) maps external identity-provider groups to OCI groups; users authenticate at the IdP and receive a session token for OCI.

MFA can be enforced per user or via identity-provider policy; API key authentication does not support MFA, so prefer instance principals or auth tokens where MFA is required.

Compartment hierarchy matters: policies inherit downward, so a policy at the tenancy root applies to all child compartments; use least privilege at the lowest compartment that works.

Service-to-service authorization uses resource principals (e.g., Functions, API Gateway) rather than user credentials; policies can grant a service permission to act on another resource.

The tenancy administrator group has unrestricted access and cannot be restricted by policy; protect it with MFA and limit membership.

Security lists apply at the subnet level and are stateful; NSGs apply at the VNIC level and are stateful; both evaluate allow rules only (no explicit deny).

A security list rule with source 0.0.0.0/0 and port 22 exposes SSH to the internet; restrict to bastion CIDR or use a private subnet with a service gateway.

An internet gateway enables bidirectional internet traffic for public subnets; a NAT gateway allows outbound-only internet for private subnets; a service gateway allows private access to OCI services without internet.

A local peering gateway connects two VCNs in the same region; remote peering connects VCNs across regions via DRG; both require non-overlapping CIDR blocks.

A dynamic routing gateway (DRG) attaches to a VCN and provides transit to on-premises (IPSec VPN or FastConnect) and to peered VCNs.

Route tables decide where traffic goes; security lists/NSGs decide whether it is allowed. Both must permit the flow for traffic to pass.

For a private subnet, the route table must point 0.0.0.0/0 to the NAT gateway (outbound) and OCI service traffic to the service gateway; without the route, the security rule alone is insufficient.

NSG membership is per VNIC; a VNIC can belong to up to five NSGs, and rules from all memberships are evaluated together.

VCN flow logs capture accepted and rejected traffic at the VNIC level and can be enabled per subnet or VNIC for troubleshooting and monitoring.

OCI Vault stores keys and secrets; a master encryption key (MEK) is created in a vault and used to wrap data encryption keys (DEKs) for envelope encryption.

Block volume, boot volume, object storage, file storage, and database encryption can use customer-managed keys from Vault instead of Oracle-managed keys.

Key rotation creates a new key version; old versions remain available for decryption, so rotation does not break existing ciphertext.

A key version can be disabled or scheduled for deletion; deletion is irreversible after the waiting period and makes data encrypted with that key unrecoverable.

Object Storage supports server-side encryption with customer-managed keys and also supports client-side encryption where the customer holds the key material.

Secrets in Vault (passwords, tokens, API keys) are versioned and can be retrieved by applications via instance principals, avoiding hard-coded credentials.

Transit encryption uses TLS; at-rest encryption is default for OCI storage services, but customer-managed keys provide control over key lifecycle and audit.

The Vault key policy should separate key administrators from key users (crypto operations) to enforce separation of duties.

OCI Audit captures control-plane API calls (who did what, when, from where) and is retained for 365 days; it is enabled by default and cannot be disabled.

Service logs (e.g., VCN flow logs, Object Storage access logs, Load Balancer logs) are opt-in and are stored in a log group in Logging.

Logging supports service connectors that route logs to Object Storage, Streaming, or Monitoring for long-term retention or SIEM ingestion.

Cloud Guard detects misconfigurations and risky activity using detectors and responders; problems can be remediated manually or automatically via responder recipes.

Security Zones enforce policies that prevent creation of public buckets or unencrypted resources; violations are blocked at resource creation time.

Monitoring alarms evaluate metrics (e.g., audit event counts) and trigger notifications via the Notifications service; alarms can also invoke Functions for automated response.

Vulnerability Scanning Service scans compute instances for open ports and missing patches; results are reported per compartment and can be scheduled.

Compliance: OCI provides compliance reports (SOC 2, ISO 27001, PCI DSS, HIPAA) through the Oracle Cloud Console; customers remain responsible for their own controls in the shared responsibility model.

Events service can react to audit events (e.g., bucket made public) and invoke a Function or send a notification for near-real-time response.