Overview
LowerPlane connects to Oracle Cloud Infrastructure using an API signing key (service principal) with read-only policies. This provides visibility into your OCI security posture across compute, storage, networking, and database services.Prerequisites
Before connecting OCI to LowerPlane, ensure you have:- An Oracle Cloud tenancy with an active subscription
- Administrator or IAM policy privileges to create users, groups, and policies
- A compartment to scope the monitoring (or use the root compartment)
Services Monitored
| OCI Service | What LowerPlane Collects |
|---|---|
| Compute | Instance metadata, public IPs, monitoring alarm status |
| Object Storage | Bucket encryption, public access, versioning |
| Autonomous Database | ATP backup, encryption, public endpoint status, ACL configuration |
| VCN (Networking) | Virtual Cloud Networks, subnets, security lists, flow logs |
| Load Balancer | Load balancer health, connection monitoring |
| IAM | Users, groups, policies |
| Vault | Key management and secrets |
| Monitoring | Alarm definitions for CPU, storage, and connections |
How to Connect
Create a Group for LowerPlane
In the OCI Console, navigate to Identity & Security > Groups and create a group called
LowerPlane-ReadOnly.Create a User
Navigate to Identity & Security > Users and create a user called
lowerplane-service. Add the user to the LowerPlane-ReadOnly group.Generate API Signing Key
Open the user profile, go to API Keys, and click Add API Key. Select Generate API Key Pair and download the private key. Note the Fingerprint displayed after adding.
Create IAM Policies
Navigate to Identity & Security > Policies and create a policy with these statements:
The
inspect and read verbs provide read-only access. LowerPlane cannot create, update, or delete any resources.Note Required Values
Collect the following from the OCI Console:
| Value | Where to Find It |
|---|---|
| Tenancy OCID | Administration > Tenancy Details |
| User OCID | Identity > Users > lowerplane-service |
| Fingerprint | User > API Keys (shown after adding) |
| Private Key | Downloaded during API key creation |
| Region | Top-right region selector (e.g., us-ashburn-1) |
| Compartment OCID | Identity > Compartments (use root or specific) |
What LowerPlane Collects
Compute Instances
All compute instances with public IP exposure, security list restrictions, and CPU monitoring alarm status.
Object Storage
Storage buckets with encryption at rest verification (Oracle-managed or customer-managed keys).
Autonomous Databases
ATP/ADW instances with backup status, public endpoint exposure, access control lists, and monitoring alarms.
VCN & Networking
Virtual Cloud Networks, subnets, security list rules, and flow log configuration.
Load Balancers
Load balancer health and active connection monitoring alarm status.
Monitoring Alarms
OCI Monitoring alarm definitions for CPU, storage utilization, and connection thresholds.
Security Tests
LowerPlane runs automated tests against your OCI resources:| Test | Severity | Description |
|---|---|---|
| Storage should be encrypted | Critical | Verifies Object Storage buckets have encryption at rest enabled |
| VCN flow logs should be captured | High | Ensures flow logs are enabled on VCN subnets |
| ATP database backup should be enabled | High | Checks automatic backups are configured for Autonomous Databases |
| ATP should be protected from direct internet traffic | Critical | Verifies ATP databases use private endpoints or ACLs |
| Compute CPU utilization should be monitored | Medium | Ensures CPU alarms are configured for compute instances |
| ATP CPU utilization should be monitored | Medium | Checks CPU alarms exist for Autonomous Databases |
| ATP free space should be monitored | Medium | Verifies storage utilization alarms for ATP |
| Compute should be protected from direct internet traffic | Critical | Checks instances don’t have unrestricted public IPs |
| Load balancer connections should be monitored | Medium | Ensures connection count alarms are configured |
Compliance Mapping
| Framework | Controls | What OCI Evidence Satisfies |
|---|---|---|
| SOC 2 | CC6.6, CC6.7, CC7.1, CC7.5 | Network security, encryption, monitoring, backup and recovery |
| ISO 27001 | A.10.1.1, A.12.3.1, A.12.4.1, A.13.1.1 | Encryption, backup, logging, network segmentation |
| PCI-DSS | 1.3, 3.4 | Network isolation, encryption at rest |
Data Access
| Data Type | Access |
|---|---|
| Compute instance metadata | Read |
| Storage bucket configuration | Read |
| Database backup and encryption settings | Read |
| VCN and security list rules | Read |
| Monitoring alarm definitions | Read |
| Vault keys and secrets metadata | Read |
| Data stored in buckets/databases | No access |
| Instance OS-level data | No access |
Troubleshooting
Connection fails with 'NotAuthenticated'
Connection fails with 'NotAuthenticated'
Verify the API key fingerprint matches what’s shown in the OCI Console under the user’s API Keys. Ensure the private key was not modified (it should start with
-----BEGIN RSA PRIVATE KEY-----).Some resources are not showing
Some resources are not showing
Check that the IAM policy is scoped to the correct compartment. If you want to monitor all compartments, use
in tenancy rather than in compartment <name> in the policy statements.Monitoring alarms show as not configured
Monitoring alarms show as not configured
LowerPlane checks for OCI Monitoring alarm definitions via the Monitoring API. If alarms are managed via Terraform or a third-party tool and don’t appear in the OCI Monitoring service, they won’t be detected. Create alarms in the OCI Console under Monitoring > Alarm Definitions.
Autonomous Database shows public endpoint enabled
Autonomous Database shows public endpoint enabled
ATP databases created with “Secure access from everywhere” have a public endpoint. To fix, edit the database and select “Secure access from specified IPs and VCNs only” or enable private endpoint access.