Securing File Storage
The File Storage service exposes an NFSv3 endpoint as a mount target in each customer's VCN subnet. The mount target is identified by a DNS name and is mapped to an IP address. Oracle recommends that you use VCN security lists (of the mount target subnet) to configure network access to the mount target from only authorized IP addresses. For more information, see Configuring VCN Security Rules for File Storage.
You can mount a file system using the Console or from a Linux command line using NFS utilities. You can authorize users to mount file systems using IAM security policies, but this applies to the Console only.
For data durability, Oracle recommends that you take periodic snapshots of the file system. To minimize accidental deletion of data, constrain the set of users having privileges to delete mount targets, file-systems, and snapshots.
All file-system data is encrypted at rest.
Access to mounted NFS file systems from a remote host is determined by POSIX user and
group permissions. Oracle recommends that you use well-known NFS security best practices
such as the
all_squash option to map all users to
nfsnobody, and NFS ACLs to enforce access
control to the mounted file system.
Security Policy Examples
Prevent Mount Target and File System Deletion
The following example prevents group FileUsers from deleting mount targets and file-systems.
Allow group FileUsers to manage file-systems in tenancy where request.permission!='FILE_SYSTEM_DELETE' Allow group FileUsers to manage mount-targets in tenancy where request.permission!='MOUNT_TARGET_DELETE' Allow group FileUsers to manage export-sets in tenancy where request.permission!='EXPORT_SET_DELETE'