Terraform for Oracle Cloud

Use this integration to collect evidence from your Oracle Cloud Infrastructure (OCI) environment

Written By Micah

Use Terraform for Oracle Cloud to collect evidence of your Oracle Cloud Infrastructure (OCI) settings and configurations. Terraform integrations are a flexible, low-code solution that allow you to customize what evidence is collected from your cloud systems. Read more about our Terraform integrations.

Types of evidence you might collect with Terraform for Oracle Cloud

There are many types of evidence you can collect from Oracle Cloud Infrastructure. The flexibility of this integration is limited only by what is available from Terraform in terms of data sources supported by the OCI Terraform provider.

Important note: You do not need to use Terraform in your tech stack in order to use Terraform for Oracle Cloud to collect evidence.

Here is a short, non-exhaustive list of some of the possible evidence you may collect from this integration:

  • Identity and access management (IAM) policies and user configurations

  • Tenancy and compartment details

  • Networking configurations (VCNs, subnets, security lists)

  • Compute instance configurations

  • Database service settings

  • Object storage bucket policies

  • Audit and logging configurations

Follow the instructions on this page to get started collecting evidence from Oracle Cloud using Terraform.

Configuring Terraform for Oracle Cloud

To configure the Terraform integration with Oracle Cloud, you (or someone in your organization) will need access to create API signing keys in your Oracle Cloud account.

Required credentials

This integration authenticates using Oracle Cloud API signing keys. Strike Graph only requires (and recommends) read-only access, meaning that your data and systems remain secure.

Navigate to the Integrations Manager in Strike Graph and open the Terraform for Oracle Cloud integration.

Note: if you do not see this integration listed, it may not be available for your organization or role yet. Reach out to support or your Customer Success Manager to request access.

Click the Add Integration button to begin configuring a new connection. You will need to provide the following credentials:

  • Display Name: A descriptive label to identify this integration in Strike Graph. This does not need to match any value in Oracle Cloud, but should be meaningful enough to distinguish between multiple connections. Limited to 100 characters.

  • Tenancy OCID: The Oracle Cloud Identifier for your tenancy. Found in the Oracle Cloud Console under Administration > Tenancy Details.

  • User OCID: The OCID of the user account that will be used for authentication. Found in the Oracle Cloud Console under Identity > Users.

  • Region: The Oracle Cloud region identifier (e.g., us-ashburn-1, eu-frankfurt-1).

  • Private Key: The PEM-encoded private key associated with your API signing key pair. Generate this in the Oracle Cloud Console under your user's API Keys settings.

  • Fingerprint: The fingerprint of the API signing key, displayed in the Oracle Cloud Console after you upload the public key.

After entering all fields, click Save. Strike Graph will validate the credentials against your Oracle Cloud account before saving the integration.

You can create as many Oracle Cloud connections as you need to manage scope across different tenancies or regions. Each connection must have a unique display name within your organization.

Using Terraform for Oracle Cloud to collect evidence

Once you have configured a Terraform for Oracle Cloud integration, you can begin using it to collect evidence of your OCI resources.

Start by navigating in Strike Graph to the item that you want to collect evidence for. You can choose to attach evidence directly for one-time evidence collection, or configure automated collection (recommended).

Click on either option, and then select the desired Terraform for Oracle Cloud integration from the list of available integrations.

Define the data to collect

Terraform integrations allow you to use a few lines of code to define what data you would like to collect as evidence. These are called "data blocks" and more information about data blocks and local values can be found on the Terraform overview page.

Step 1: Define the data block. Data blocks follow a typical pattern:

  • data_source: Defines which OCI resource to read from (e.g., oci_identity_tenancy). Terraform for Oracle Cloud supports data collection from any resource with a supported data source from the OCI Terraform provider.

  • temp_name: A temporary name you define, used to refer to this data block during execution. The temp name is used in the output filename, so it is recommended to use something recognizable. Names are limited to alphanumeric characters and do not allow spaces.

  • query constraints / arguments: Many data sources require specific arguments (e.g., tenancy_id). Refer to the specific data source requirements in the OCI Terraform provider documentation.

Step 2: Define the local values used for the execution. This follows the pattern: data.data_source.temp_name (sometimes followed by a key if a filter argument is needed).

Run the data collection

After you have defined the data block and local values, click the Attach button to execute the data collection. This may take a few minutes as the data pipeline is set up to collect the attachment.

Once the collection is finished, you can see the collected data by clicking on the attachment to view the results.

Using Terraform for Oracle Cloud with Automated Collection

It is highly recommended that you configure your evidence collection with automated collection. With Automated Collection, Strike Graph can recollect evidence attachments from Oracle Cloud a few days before expiration so that your evidence remains in an effective audit-ready state.

To configure automated collection, follow the steps above after clicking on the "Automated Collection" button found on the evidence item detail pages.

Removing your Terraform for Oracle Cloud integration

You can remove the integration at any time. Removing an integration does not delete any files that were attached using that integration. Removing an integration will also disrupt automated collection.

To remove:

  1. Go to the Integrations Manager and click on the Terraform for Oracle Cloud card to access the integration configurations.

  2. Click the Deactivate button next to your configuration.

If you are fully removing access between Strike Graph and your Oracle Cloud account, you may also wish to delete the API signing key in the Oracle Cloud Console. Before deleting, verify that you are not using it for other purposes.

Troubleshooting

For additional Terraform troubleshooting tips, see the Terraform integrations overview.

Credential validation errors

If you receive an error while setting up the integration, verify that all credential fields are correct: Tenancy OCID, User OCID, Region, Private Key, and Fingerprint. Common issues include copy-paste errors in the private key (ensure the full PEM block is included, including the BEGIN and END lines) and mismatched fingerprints.

General formatting errors

If the error message during evidence collection is generic (like "Something went wrong"), check that your temp_name is formatted correctly (no spaces, only alphanumeric characters) and that there are no unexpected characters in the data block or local values.

Permission errors

If you receive a permissions error, ensure that the user associated with the User OCID has the necessary IAM policies to read the resources you are querying. OCI uses policy-based access control, so you may need to add a policy granting read access to the relevant compartment or resource type.

Confirm the data_source requirements

Check that the resource you defined in the data_source is available from the OCI Terraform provider, and ensure that you have included any required query constraints or arguments.

Common Oracle Cloud data sources

The following list highlights some commonly used data sources from the OCI Terraform provider. The full OCI provider includes hundreds of data sources across all Oracle Cloud services. For the complete and up-to-date list, visit the OCI Terraform provider documentation.

  • oci_identity_tenancy

  • oci_identity_compartments

  • oci_identity_users

  • oci_identity_groups

  • oci_identity_policies

  • oci_identity_api_keys

  • oci_identity_auth_tokens

  • oci_core_instances

  • oci_core_vcns

  • oci_core_subnets

  • oci_core_security_lists

  • oci_core_network_security_groups

  • oci_core_volumes

  • oci_objectstorage_bucket

  • oci_objectstorage_namespace

  • oci_database_db_systems

  • oci_database_autonomous_databases

  • oci_audit_configuration

  • oci_logging_log_groups

  • oci_events_rules

  • oci_kms_vaults

  • oci_kms_keys

  • oci_load_balancer_load_balancers

  • oci_dns_zones