Securing File Storage

The File Storage service exposes an NFSv3 endpoint as a mount target in each customer's VCN subnet. The mount target is identified by a DNS name and is mapped to an IP address. Oracle recommends that you use VCN security lists (of the mount target subnet) to configure network access to the mount target from only authorized IP addresses. For more information, see Configuring VCN Security Rules for File Storage.

You can mount a file system using the Console or from a Linux command line using NFS utilities. You can authorize users to mount file systems using IAM security policies, but this applies to the Console only.

For data durability, Oracle recommends that you take periodic snapshots of the file system. To minimize accidental deletion of data, constrain the set of users having privileges to delete mount targets, file-systems, and snapshots.

All file-system data is encrypted at rest.

Access to mounted NFS file systems from a remote host is determined by POSIX user and group permissions. Oracle recommends that you use well-known NFS security best practices such as the all_squash option to map all users to nfsnobody, and NFS ACLs to enforce access control to the mounted file system.

Allow group FileUsers to manage file-systems in tenancy
 where request.permission!='FILE_SYSTEM_DELETE' 
Allow group FileUsers to manage mount-targets in tenancy
 where request.permission!='MOUNT_TARGET_DELETE' 
Allow group FileUsers to manage export-sets in tenancy
 where request.permission!='EXPORT_SET_DELETE'