Securing Bastion

To use Bastion securely, learn about your security and compliance responsibilities.

In general, Oracle provides security of cloud infrastructure and operations, such as cloud operator access controls and infrastructure security patching. You are responsible for securely configuring your cloud resources. Security in the cloud is a shared responsibility between you and Oracle.

Oracle is responsible for the following security requirements:

• Physical Security: Oracle is responsible for protecting the global infrastructure that runs all services offered in Oracle Cloud Infrastructure. This infrastructure consists of the hardware, software, networking, and facilities that run Oracle Cloud Infrastructure services.

Your security responsibilities are described on this page, which include the following areas:

• Access Control: Limit privileges as much as possible. Users should be given only the access necessary to perform their work.
• Network Security: Limit the nodes in your cloud network that can access bastions.
• Host Security: Configure SSH on clients and target instances for maximum security.

Use this checklist to identify the tasks you perform to secure Bastion in a new Oracle Cloud Infrastructure tenancy.

After getting started with Bastion, use this checklist to identify security tasks that we recommend you perform regularly.

Use policies to limit access to Bastion.

Bastion supports policy variables to further restrict access to bastions, including:

• target.bastion-session.username - Restrict access to specific POSIX operating system user names when creating a session that connects to a compute instance.
• target.resource.ocid - Restrict access to specific compute instances when creating a session.

We recommend that you give DELETE permissions to a minimum set of IAM users and groups. This practice minimizes loss of data from inadvertent deletes by authorized users or from malicious actors. Only give DELETE permissions to tenancy and compartment administrators.

Allow group SecurityAdmins to manage bastion-family in tenancy
Allow group SecurityAdmins to manage virtual-network-family in tenancy
Allow group SecurityAdmins to read instance-family in tenancy
Allow group SecurityAdmins to read instance-agent-plugins in tenancy
Allow group SecurityAdmins to inspect work-requests in tenancy

Allow group BastionUsers to use bastion in tenancy
Allow group BastionUsers to manage bastion-session in tenancy
Allow group BastionUsers to manage virtual-network-family in tenancy
Allow group BastionUsers to read instance-family in tenancy
Allow group BastionUsers to read instance-agent-plugins in tenancy
Allow group BastionUsers to inspect work-requests in tenancy

Allow group SalesAdmins to use bastion in compartment SalesApps
Allow group SalesAdmins to manage bastion-session in compartment SalesApps where ALL {target.resource.ocid='<instance_OCID>'}
Allow group SalesAdmins to manage virtual-network-family in compartment SalesApps
Allow group SalesAdmins to read instance-family in compartment SalesApps
Allow group SalesAdmins to read instance-agent-plugins in compartment SalesApps
Allow group SalesAdmins to inspect work-requests in tenancy

Allow group SalesAdmins to use bastion in compartment SalesApps
Allow group SalesAdmins to manage bastion-session in compartment SalesApps where ALL {target.bastion-session.username in ('opc')}
Allow group SalesAdmins to manage virtual-network-family in compartment SalesApps
Allow group SalesAdmins to read instance-family in compartment SalesApps
Allow group SalesAdmins to read instance-agent-plugins in compartment SalesApps
Allow group SalesAdmins to inspect work-requests in tenancy

Allow any-user to manage bastion-session in compartment HRProd where ALL {target.bastion-session.username=request.user.name}

For more information about Bastion policies and to view more examples, see Bastion Policies.

In addition to creating IAM policies, follow these additional best practices for securing access to the targets that you connect to with Bastion.

Follow these best practices for using SSH to encrypt communication between clients and bastions.

Secure network access to the resources that you connect to using Bastion.

When creating a bastion, use CIDR block allowlist to specify one or more address ranges in CIDR notation that you want to allow to connect to sessions hosted by this bastion.

A more limited address range offers better security. Do not specify an open CIDR range like 0.0.0.0/0.

Configure the SSH server on target compute instances for maximum security.

We recommend that you update the default values for these settings in /etc/ssh/sshd_config.

Locate access logs and other security data for Bastion.

The Audit service automatically records all API calls to Oracle Cloud Infrastructure resources. You can achieve your security and compliance goals by using the Audit service to monitor all user activity within your tenancy. Because all Console, SDK, and command line (CLI) calls go through our APIs, all activity from those sources is included. Audit records are available through an authenticated, filterable query API or they can be retrieved as batched files from Object Storage. Audit log contents include what activity occurred, the user that initiated it, the date and time of the request, as well as source IP, user agent, and HTTP headers of the request. See Viewing Audit Log Events.

{
  "datetime": 1651547126164,
  "logContent": {
    "data": {
      "additionalDetails": {
        "X-Real-Port": 58181,
        "bastionId": "ocid1.bastion.oc1.<unique_id>",
        "bastionName": "mybastion",
        "displayName": "mysession",
        "lifecycleState": "CREATING",
        "sessionId": "ocid1.bastionsession.oc1.<unique_id>",
        "sessionType": "MANAGED_SSH",
        "targetResourceDisplayName": "mylinuxinstance",
        "targetResourceId": "ocid1.instance.oc1.<unique_id>",
        "targetResourceOperatingSystemUserName": "opc",
        "targetResourcePort": "22",
        "targetResourcePrivateIpAddress": "<target_ip_address>"
      },
      "availabilityDomain": "AD2",
      "compartmentId": "ocid1.compartment.oc1..<unique_id>",
      "compartmentName": "mycompartment",
      "definedTags": null,
      "eventGroupingId": "ocid1.bastionworkrequest.oc1.<unique_id>",
      "eventName": "CreateSession",
      "freeformTags": null,
      "identity": {
        "authType": "natv",
        "callerId": null,
        "callerName": null,
        "consoleSessionId": "<unique_id>",
        "credentials": "<unique_id>",
        "ipAddress": "<source_ip>",
        "principalId": "ocid1.user.oc1..<unique_id>",
        "principalName": "<user_id>",
        "tenantId": "ocid1.tenancy.oc1..<unique_id>",
        "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36"
      },
      "message": "Session-20220502-2304 CreateSession succeeded",
      ...
  }
}

If you enabled Cloud Guard in your tenancy, then it reports any user activities that are potential security concerns. Upon detecting a problem, Cloud Guard suggests corrective actions. You can also configure Cloud Guard to automatically take certain actions. See Getting Started with Cloud Guard and Processing Reported Problems.