Vulnerability Scanning that Is Scanning Something
scan_level = NONE is legal for both the agent scan and the port scan, so a recipe with both at NONE runs on schedule, updates its last-run time, and finds nothing because it looked for nothing. A recipe is not a target either: one with no target scans no instance. Refuses a recipe that scans for nothing and always creates the target with it.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "vulnerability_scanning" {
source = "www.iac-bazaar.com/iac-bazaar/oci-vulnerability-scanning/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-vulnerability-scanning
Vulnerability scanning that is scanning something. Works with Terraform
and OpenTofu (>= 1.6), oci provider >= 8.0, < 9.0.
scan_level = "NONE" is a legal setting for both scans. A host scan
recipe has an agent scan (packages against the CVE feed) and a port scan
(open ports from the network), and each offers NONE. A recipe with both at
NONE runs on schedule, updates its last-run time, and finds nothing because
it looked for nothing. Refused; NONE for the agent scan alone needs
accept_no_agent_scan.
A recipe is not a target. The recipe says how; the target says which compartment or instances. A recipe with no target scans nothing. This module always creates both.
The agent scan needs the agent. It runs through the Oracle Cloud Agent's Vulnerability Scanning plugin, enabled per instance and not by this recipe. An instance whose plugin is off shows as "agent not available" - a row in the report, not an alert.
CIS benchmark scanning is a third level, STRICT down to NONE, checking the OS against the benchmark rather than against CVEs.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
oci-cloud-guard
Oracle ships every responder rule in USERACTION mode: a Remediate button appears on each problem and nothing happens until a person clicks it, so a tenancy with hundreds of findings has by default fixed none of them. Sets AUTOACTION per rule and exports the IAM statements each auto-action needs, since one without its policy fails on every execution.
oci-security-zone
The opposite of every other guardrail here: a security zone does not detect or report, it REFUSES - the API call fails. There is no dry-run mode. So the risk inverts too: applied to a compartment that already holds non-compliant resources, the team that owns them discovers they can no longer change them.
oci-network-firewall
An INSPECT rule hands the flow to the threat engine, and inspection decides what happens next: INTRUSION_PREVENTION drops the session, INTRUSION_DETECTION logs it and forwards it, and the rule reads INSPECT either way. Every inspect rule is prevention unless detection is accepted by name; policy and appliance are both created, and the address the route tables must point at is an output.
oci-waf
CHECK is the action that evaluates the rule, logs the match and lets the request through - the console shows the protection rules and every matched attack reached the backend. BLOCK by default, DETECT only by name. The policy and the firewall binding it to a load balancer are separate resources; both are created, and a policy alone has to be asked for.
oci-bastion
Zero-footprint managed bastion with session-managed SSH/port-forward access to private subnets - replaces jump hosts.