A Cloud Guard Target whose Responders Respond
Oracle ships every responder rule in USERACTION mode: a Remediate button appears on each problem and nothing happens until a person clicks it, so a tenancy with hundreds of findings has by default fixed none of them. Sets AUTOACTION per rule and exports the IAM statements each auto-action needs, since one without its policy fails on every execution.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "cloud_guard" {
source = "www.iac-bazaar.com/iac-bazaar/oci-cloud-guard/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads static-verified because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/oci-cloud-guard?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Terraform module 1.0.0, static-verified on IaC Bazaar: [A Cloud Guard Target whose Responders Respond](https://www.iac-bazaar.com/catalog/oci-cloud-guard?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```hcl
module "cloud_guard" {
source = "www.iac-bazaar.com/iac-bazaar/oci-cloud-guard/oci"
version = "1.0.0"
}
```Preview:
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-cloud-guard
A Cloud Guard target whose responders actually respond. Works with
Terraform and OpenTofu (>= 1.6), oci provider >= 8.0, < 9.0.
Every responder rule starts in "ask me first" mode. Cloud Guard has two
halves: detectors find the public bucket or the stopped audit trail, and
responders can fix it. Oracle's managed responder recipe ships every rule in
USERACTION - a Remediate button appears on the problem and nothing happens
until a person clicks it. A tenancy with Cloud Guard on, the managed recipes
attached and hundreds of problems listed has, by default, fixed none of them,
and the dashboard cannot tell you that. AUTOACTION is set per rule per
target; this module takes the list of rules that should act, and refuses a
target with none of them without accept_advisory_only.
AUTOACTION also needs a policy. Cloud Guard fixes a bucket by calling
Object Storage as itself. The IAM statements each rule needs are reported by
the API and exported here as policies_required, so a test can check them
against what the tenancy actually grants - an auto-action without its policy
fails on every execution.
A target is a compartment and everything beneath it.
inherited_by_compartments is the real scope.
The tenancy-level switch is separate and its reporting region cannot be
changed later. manage_tenancy_configuration = true sets it from the first
target; leave it false for every later one.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
oci-security-zone
The opposite of every other guardrail here: a security zone does not detect or report, it REFUSES - the API call fails. There is no dry-run mode. So the risk inverts too: applied to a compartment that already holds non-compliant resources, the team that owns them discovers they can no longer change them.
oci-customer-identity
An OCI identity domain on the external-user licence. license_type is not updatable, so changing it replaces the domain with an empty one and every customer account is gone - and the admin email is create-time only too. A domain must be deactivated before it can be deleted, which the module exposes, and it stays off your staff sign-in page.
oci-network-firewall
An INSPECT rule hands the flow to the threat engine, and inspection decides what happens next: INTRUSION_PREVENTION drops the session, INTRUSION_DETECTION logs it and forwards it, and the rule reads INSPECT either way. Every inspect rule is prevention unless detection is accepted by name; policy and appliance are both created, and the address the route tables must point at is an output.
oci-waf
CHECK is the action that evaluates the rule, logs the match and lets the request through - the console shows the protection rules and every matched attack reached the backend. BLOCK by default, DETECT only by name. The policy and the firewall binding it to a load balancer are separate resources; both are created, and a policy alone has to be asked for.
oci-network-security-group
An NSG with no rules admits nothing and sends nothing, so a group written with ingress only has VNICs that cannot resolve DNS; a stateless rule drops every reply that has no matching egress; and the subnet's security list still applies, unioned with the NSG. Stateful always, egress explicit and open by default, SSH from 0.0.0.0/0 refused unless accepted, the security list named as still applying.
oci-bastion
Zero-footprint managed bastion with session-managed SSH/port-forward access to private subnets - replaces jump hosts.