Validation & CIS audit · 05
STEP 5 — Post-Build Validation & CIS Benchmark Audit
Run after every landing-zone build and after every workload onboarding wave; then monthly as Day-2 hygiene. Two passes: functional validation (does it work as designed) and compliance audit (is it configured per the benchmark).
5.1 Functional Validation Pass
5.2 CIS OCI Foundations Benchmark Audit (manual)
Audit against the CIS Oracle Cloud Infrastructure Foundations Benchmark (current version, Level 1 minimum; Level 2 where the governance standard demands). Method: for each control family, run the documented read-only CLI/console checks, record evidence, log findings as SEC-XX items with severity and owner:
| Family | Representative manual checks |
|---|---|
| IAM | No API keys on tenancy admins; MFA enforced; password/lockout policy; no policies granting manage all-resources in tenancy beyond break-glass; unused credentials aged out |
| Networking | No security lists/NSGs allowing 0.0.0.0/0 to 22/3389; default security lists locked; no public IPs where the exposure rules forbid them |
| Logging & Monitoring | Audit retention at maximum; Events rules exist for IAM/network changes; VCN flow logs enabled on every subnet in scope; notifications topics subscribed and confirmed |
| Object Storage | No public buckets (or documented exceptions); versioning on state and evidence buckets; lifecycle rules where mandated |
| Encryption & Keys | Customer-managed keys for mandated data classes; key rotation policy; secrets in Vault, none in code or tfvars |
| Cloud Guard / Posture | Enabled at tenancy scope; reporting region as decided; problems triaged; responder posture per environment maturity |
Close the loop: every SEC-XX finding gets a remediation MR or a Governance-Board-approved exception with expiry. The audit is complete when the findings register is empty or fully dispositioned — and the signed audit report is filed with the build evidence.
STEP 5 · DOCUMENT 5 OF 6
Post-Build Validation & CIS Benchmark Audit
Consolidated validation after every landing-zone phase and every workload build · CIS OCI Foundations Benchmark audit procedure · findings register · remediation workflow
Run (a) at each phase gate of Doc 3, (b) after every Doc 4 workload acceptance, and (c) as a full audit before production go-live and quarterly thereafter.
Post-Build Validation & CIS Audit Runbook
| Field | Value |
|---|---|
| Document ID | <CUSTOMER>-RUN-VAL-005 |
| Version | v1.0 (Generic Template) |
| Execution model | OPTION A — FULLY MANUAL (human engineers, OCI Console; no IaC/automation in the build path) |
| Customer | <CUSTOMER> — replace on engagement start |
| Tenancy | <TENANCY-NAME> / OCID: <TENANCY-OCID> |
| Prepared by | Cloud Platform Engineering |
| Review cycle | Per engagement; template annually |
1. Validation Model
| Trigger | Scope | Output |
|---|---|---|
| Phase gate (Doc 3 G-A1…G-A5) | Gate test set for that phase (§2) | Gate record: pass/fail per test, evidence links, sign-off |
| Workload acceptance (Doc 4 §10) | Workload test set + regression of touched shared services | Acceptance record |
| Pre-go-live audit | Full §2 + §3 CIS audit + §4 evidence pack | Audit report + findings register |
| Quarterly operations audit | §3 CIS audit + access reviews + tag compliance | Quarterly compliance report (Doc 1 §14 metrics) |
MANUAL-MODE RULE:Validation tooling is read-only: console inspection, Cloud Guard, and the CIS compliance checker script (§3.2) which only lists and reads resources. Nothing in this document creates, modifies, or deletes a resource — remediations found here go back through the change process and the relevant runbook section.
2. Consolidated Validation Test Matrix
2.1 Identity and access
| ID | Test | Pass criterion |
|---|---|---|
| T-ID-01 | Federated pilot user Console login | IdP redirect + MFA challenged; group-scoped visibility only |
| T-ID-02 | Break-glass login BG-OCI-ADMIN-01 | ALM-BREAKGLASS-LOGIN fires ≤ 5 min; login recorded in audit |
| T-ID-03 | OCI-DEVELOPER member attempts read in Applications:PRD | Not authorized |
| T-ID-04 | Vendor member lists another vendor’s compartment | Not authorized |
| T-ID-05 | OCI-AUDITOR attempts any create | Not authorized |
| T-ID-06 | Local-user sweep in all domains | Only the two break-glass users exist locally |
| T-ID-07 | Service-account register vs Vault | Every service credential exists as a Vault secret with owner + rotation date |
2.2 Structure and governance
| ID | Test | Pass criterion |
|---|---|---|
| T-GV-01 | Compartment tree read-only export vs design (oci iam compartment list --compartment-id-in-subtree true) | Zero drift |
| T-GV-02 | Create test resource without CostCenter tag | Creation fails (tag default enforcement) |
| T-GV-03 | Tag compliance sweep (console/Tenancy Explorer or CD3 extract) | ≥ 98% resources fully tagged; gaps listed with owners |
| T-GV-04 | Budget alert simulation (temporary low-threshold budget) | Alert e-mail received by DL; test budget deleted after, logged |
| T-GV-05 | GPU shape launch in Sandbox/DEV | Blocked by quota policy |
| T-GV-06 | Policy inventory review | One policy per compartment per purpose; no root grants beyond baseline; every statement traceable to Doc 1 §7 |
2.3 Network
| ID | Test | Pass criterion |
|---|---|---|
| T-NW-01 | ATP private endpoint reachability | 1522 connects from App-Processing subnet with wallet; blocked from Integration-Shared subnet |
| T-NW-02 | OSN reachability via Service Gateway from each subnet | Object Storage/OSN endpoints resolve and connect without NAT/IGW |
| T-NW-03 | Ingress sweep | No 0.0.0.0/0 ingress rule anywhere (NSGs + security lists); Cloud Guard clean on the detector |
| T-NW-04 | IGW presence check TST/PRD | No Internet Gateway exists; creation attempt in PRD blocked by Security Zone |
| T-NW-05 | Hybrid (if built): tunnel/BGP state + failover | Both IPSec tunnels UP; FastConnect BGP Established; failover drill passes in window |
| T-NW-06 | DNS resolution matrix | Private zones resolve per design; no unapproved forwarders |
2.4 Platform workloads (run per workload, from Doc 4 §10)
| ID | Test | Pass criterion |
|---|---|---|
| T-WL-01 | End-to-end integration with Vault-sourced credentials | Succeeds; zero inline credentials |
| T-WL-02 | Forced fault → error queue → alert routing | Alert to correct SupportGroup destination |
| T-WL-03 | Manual promotion with config plan | No hand-edits; four-eyes recorded; checksums match |
| T-WL-04 | SFTP/File Server counterparty exchange | Key-only, chrooted, logged |
| T-WL-05 | Backup evidence | ATP backups listed per policy; bucket versioning/lifecycle active; PRD long-term retention shown |
| T-WL-06 | Restore drill (pre-go-live at minimum) | ATP point-in-time restore to a clone succeeds; documented duration vs RTO |
3. CIS OCI Foundations Benchmark Audit
3.1 Scope and method
The audit assesses the tenancy against the current CIS Oracle Cloud Infrastructure Foundations Benchmark (use the latest published version; record which version and level — Level 1 minimum, Level 2 where the compliance frame demands). Three evidence sources are combined:
3.2 Running the compliance checker (read-only)
3.3 Recommendation walkthrough (summary map)
The full recommendation list lives in the benchmark itself; the map below shows where each CIS section is evidenced in this engagement and the design intent it should find. Audit = confirm reality matches; deviations go to the findings register (§4).
| CIS section | What it checks | Where this series set it | Typical manual-build risks to look for |
|---|---|---|---|
| 1. IAM | MFA, no tenancy-admin sprawl, policy hygiene, credential/key rotation, no local users, API key age | Doc 3 A1/A3; Doc 1 §5–7 | Leftover temporary admin; engineer API keys created during build and never deleted; missing rotation dates on service accounts |
| 2. Networking | No unrestricted ingress (22/3389/0.0.0.0/0), security list vs NSG hygiene, no public IPs where private suffices | Doc 3 A4 | Temporary test rules left open after connectivity debugging; test VM from VPN validation not deleted |
| 3. Compute | Instance metadata service v2, no public IPs, patching posture | Doc 4 §5.4/§6.2 | Agent/SFTP VMs built quickly without IMDSv2 enforced |
| 4. Logging & Monitoring | Audit retention 365d, VCN flow logs, object storage write logs, alarms/events for IAM changes, Cloud Guard enabled | Doc 2 §6; Doc 3 A4/A5 | Flow logs enabled on some subnets only; missing event rules for IAM changes (add them if the benchmark version requires — via change process) |
| 5. Object Storage | No public buckets, versioning, CMK encryption where required | Doc 4 §4.2 | Migration-era buckets made public "temporarily"; versioning skipped on ad hoc buckets |
| 6. Asset Management | Resources tagged and inventoried | Doc 1 §9; Doc 6 register | Tag gaps on manually created resources (T-GV-03) |
WARNING:Manual builds fail CIS audits in predictable places: forgotten temporary access, debug-era network rules, and untracked test resources. Sweep the build log for every "temporary" entry and verify each was reverted BEFORE running the audit — finding them yourself is a build-log line; the auditor finding them is a finding.
4. Findings Register and Remediation
4.1 Findings register (one row per deviation)
| Field | Content |
|---|---|
| ID | FND-<YYYY>-<seq> |
| Source | CIS <rec #> / Cloud Guard problem ID / test ID (§2) |
| Severity | Critical / High / Medium / Low (CIS profile level + data classification of affected resource) |
| Resource(s) | OCID(s) + compartment |
| Description & evidence | What deviates from which control; screenshot/CSV reference |
| Owner | Per control-family ownership (Doc 1 §13) |
| Remediation path | Runbook section that rebuilds it correctly (e.g., Doc 3 §5.3 NSG rules) + change record ID |
| Due / closed | SLA per severity: Critical same-day, High 7d, Medium 30d, Low next quarter |
4.2 Remediation workflow
5. Go-Live Readiness Gate
| # | Criterion |
|---|---|
| 1 | All §2 validation tests green, evidence archived. |
| 2 | CIS audit complete; zero open Critical findings; High findings remediated or formally excepted with compensating controls. |
| 3 | Cloud Guard: no open Critical problems in PRD/Analytics/Regulated; detector recipes at agreed tuning. |
| 4 | Restore drill (T-WL-06) completed within RTO; backup evidence archived. |
| 5 | Break-glass procedure tested this quarter; credentials custody confirmed. |
| 6 | Access review completed: group memberships, vendor time-boxes, service-account register. |
| 7 | As-built documentation current: CD3 extract reconciled, diagrams updated (Doc 6), build log complete. |
| 8 | O&M handover accepted: alarm destinations verified, on-call rota published, runbook set delivered. |
Gate approved by the Cloud Governance Board → production cutover may proceed under the customer cutover plan.
Revision History
| Version | Date | Description |
|---|---|---|
| 1.0 | <DATE> | Generic template — validation + CIS audit edition. |