Ensure VCN has an inbound security list

Error: OCI VCN has no inbound security list
Bridgecrew Policy ID: BC_OCI_NETWORKING_1
Checkov Check ID: CKV_OCI_16
Severity: HIGH

OCI VCN has no inbound security list

Description

This policy identifies the OCI Virtual Cloud Networks (VCN) that lack ingress rules configured in their security lists. It is recommended that Virtual Cloud Networks (VCN) security lists are configured with ingress rules which provide stateful and stateless firewall capability to control network access to your instances.

Fix - Runtime

OCI Console

  1. Login to the OCI Console
  2. Type the resource reported in the alert into the Search box at the top of the Console.
  3. Click the resource reported in the alert from the Resources submenu
  4. Click on Ingress rules
  5. Click on Add Ingress Rules (To add ingress rules appropriately in the pop up)
  6. Click on Add Ingress Rules

Fix - Buildtime

Terraform

  • Resource: oci_core_security_list
  • Arguments: vcn_id + ingress_security_rules
resource "oci_core_security_list" "pass" {
    compartment_id = oci_identity_compartment.tf-compartment.id
    vcn_id = oci_core_vcn.test_vcn.id
    ingress_security_rules {
        protocol = "all"
        source="192.168.1.0/24"
    }
}