OCI Well-Architected Framework Checklist
Five Pillars Overview
Pillar 1: Security and Compliance
| Focus Area | Best Practice | CLI Verification |
|---|---|---|
| User Authentication | Enable MFA for all IAM users | oci iam user list --query "data[?\"is-mfa-activated\"==\false`]"` |
| Authorization | Use least privilege policies | Review policies for all-resources or any-user |
| Data Encryption | Enable encryption at rest | oci vault secret list --compartment-id <id> |
| Network Security | Use NSGs over Security Lists | oci network nsg list --compartment-id <id> |
| Audit Logging | Enable audit logs for all compartments | oci audit event list --compartment-id <id> |
Pillar 2: Reliability and Resilience
| Focus Area | Best Practice | CLI Verification |
|---|---|---|
| High Availability | Deploy across multiple ADs | Check instance distribution |
| Backup Strategy | Configure automatic backups | oci bv backup list --compartment-id <id> |
| Disaster Recovery | Set up cross-region replication | oci os replication list-replication-policies --bucket-name <bucket> |
| Load Balancing | Use regional load balancers | oci lb load-balancer list --compartment-id <id> |
Pillar 3: Performance and Cost Optimization
| Focus Area | Best Practice | CLI Verification |
|---|---|---|
| Right-Sizing | Match instance shapes to workload | Review CPU/Memory utilization metrics |
| Reserved Capacity | Use committed pricing for predictable workloads | oci limits value list |
| Storage Tiers | Use appropriate storage classes | Check for overprovisioned volumes |
| Networking | Use Service Gateway for OCI services | oci network service-gateway list |
Pillar 4: Operational Efficiency
| Focus Area | Best Practice | CLI Verification |
|---|---|---|
| Infrastructure as Code | Use Terraform for all resources | Check for Resource Manager stacks |
| Monitoring | Set up alarms for critical metrics | oci monitoring alarm list --compartment-id <id> |
| Automation | Use OCI Events for automation | oci events rule list --compartment-id <id> |
| Tagging | Implement mandatory tagging | oci iam tag-namespace list --compartment-id <id> |
Pillar 5: Distributed Cloud
| Focus Area | Best Practice | CLI Verification |
|---|---|---|
| Multi-Region | Deploy critical workloads in multiple regions | Review region distribution |
| Hybrid Cloud | Use FastConnect for on-premises connectivity | oci network fast-connect-provider-service list |
| Edge | Use Content Delivery for global distribution | Check CDN configurations |
CIS OCI Foundations Benchmark Controls
Identity and Access Management
# 1.1 Ensure MFA is enabled for all users
oci iam user list --all --query "data[?\"is-mfa-activated\"==\`false\`].{Name:name,OCID:id}"
# 1.2 Ensure API keys rotate every 90 days
oci iam user api-key list --user-id <user-ocid> --query "data[?\"time-created\" < '\`date -v-90d +%Y-%m-%dT%H:%M:%S\`']"
# 1.3 Ensure no policies use "any-user"
oci iam policy list --compartment-id <tenancy-ocid> --all --query "data[?contains(statements[],'any-user')]"Networking
# 2.1 Ensure no security lists allow 0.0.0.0/0 ingress
oci network security-list list --compartment-id <id> --all --query "data[].{Name:\"display-name\",Rules:\"ingress-security-rules\"[?source=='0.0.0.0/0']}"
# 2.2 Ensure VCN flow logs are enabled (flow logs are Logging service logs, source service "flowlogs")
oci logging log list --log-group-id <log-group-id> --source-service flowlogs --all
# 2.3 Ensure Service Gateway is used for OCI services
oci network service-gateway list --compartment-id <id>Logging and Monitoring
# 3.1 Ensure Audit Log retention is at least 365 days
# Audit logs are retained for 365 days by default and cannot be changed
# 3.2 Ensure Cloud Guard is enabled
oci cloud-guard target list --compartment-id <tenancy-ocid>
# 3.3 Ensure VCN Flow Logs are enabled for all subnets
oci network subnet list --compartment-id <id> --query "data[?!\"vcn-id\"]"Storage
# 4.1 Ensure Object Storage buckets are not public
oci os bucket list --compartment-id <id> --query "data[?\"public-access-type\"!='NoPublicAccess']"
# 4.2 Ensure boot volumes are encrypted with Customer-Managed Keys
oci bv boot-volume list --compartment-id <id> --query "data[?!\"kms-key-id\"]"
# 4.3 Ensure block volumes are encrypted with Customer-Managed Keys
oci bv volume list --compartment-id <id> --query "data[?!\"kms-key-id\"]"Quick Compliance Check Script
#!/bin/bash
# OCI Quick Compliance Check
COMPARTMENT_ID="$1"
echo "=== Security Checks ==="
echo "Public buckets:"
oci os bucket list --compartment-id $COMPARTMENT_ID --query "data[?\"public-access-type\"!='NoPublicAccess'].name" --output table
echo "Security lists with 0.0.0.0/0:"
oci network security-list list --compartment-id $COMPARTMENT_ID --all --query "data[].{Name:\"display-name\"}" --output table
echo "=== Reliability Checks ==="
echo "Instances without backups:"
# Compare instance list with backup list
echo "=== Cost Checks ==="
echo "Stopped instances (still incurring boot volume cost):"
oci compute instance list --compartment-id $COMPARTMENT_ID --lifecycle-state STOPPED --query "data[].{Name:\"display-name\",Shape:shape}" --output tableRemediation Priority Matrix
| Finding | Impact | Effort | Priority |
|---|---|---|---|
| Public S3 bucket | Critical | Low | P0 - Fix immediately |
| No MFA enabled | High | Low | P1 - Fix within 24h |
| Open 22/3389 to 0.0.0.0/0 | High | Low | P1 - Fix within 24h |
| No encryption at rest | High | Medium | P2 - Fix within 1 week |
| No backups configured | Medium | Low | P2 - Fix within 1 week |
| Missing tags | Low | Low | P3 - Fix within 1 month |
| Over-provisioned instances | Low | Medium | P3 - Fix within 1 month |