From 450275c257138c96794c5fa7b6c16cb47568c4fa Mon Sep 17 00:00:00 2001
From: Josh Hammer <josh.hammer@oracle.com>
Date: Mon, 10 Jun 2024 08:48:52 -0400
Subject: [PATCH] Release 2.8.3 (#145)

* doc: Cleaned up OAG documentation in deployment guide

* bug: Fixed with debug statements for certificates appearing without debugging enabled

* Dict cis_monitoring_checks updated.

* Added repos for network & database admins

* feat:Reduced adb function lines

* feat:Reduced adb function lines

* feat: Added debugging to __ons_read_subscriptions

* fix: Add additional policy to allow auditor group to review CIS and OBP

* fix: Added read for serviceconnectors to support OBP checks

* doc: Updated with the new Auditor Policy to support CIS and OBP checks

* feat: Added error logging for Tag defaults and ADB

* fix: Removed debug statement and reenabled pagination

* doc: Updated Release Version and Tested SDK

* doc: Added date place holder

* doc: Added Cloud Guard Detector and Security Zone Rule Mapping

* doc: Updated release notes for release 2.8.3

* Revert "doc: Added Cloud Guard Detector and Security Zone Rule Mapping"

This reverts commit ee5e9510da8ad0b7b277e300fb3a458f4b51f86d.

* doc: Added Cloud Guard Detector and Security Zones Rule mapping

* doc: Updated release date

---------

Co-authored-by: Andre Correa <andre.correa@oracle.com>
Co-authored-by: Olaf Heimburger <olaf.heimburger@oracle.com>
Co-authored-by: KC Flynn <38958974+flynnkc@users.noreply.github.com>
Co-authored-by: Samratha S P <samratha.s.p@oracle.com>
---
 DEPLOYMENT-GUIDE.md         |    1 -
 cis-architecture-mapping.md |  118 +--
 compliance-script.md        |   29 +-
 config/iam_policies.tf      |   13 +-
 release-notes.md            | 1682 ++++++++++++++++++-----------------
 scripts/cis_reports.py      |  311 +------
 6 files changed, 979 insertions(+), 1175 deletions(-)

diff --git a/DEPLOYMENT-GUIDE.md b/DEPLOYMENT-GUIDE.md
index 46f7592e..65979e81 100644
--- a/DEPLOYMENT-GUIDE.md
+++ b/DEPLOYMENT-GUIDE.md
@@ -472,7 +472,6 @@ After the OAG instance is provisioned follow steps from the [Integrate with Orac
 1. As a user in the <label>-cred-admin-group or the Administrator group go to the **Generate API Keys and Oracle Cloud Identifier (OCID) to configure your Cloud Environment in the Oracle Access Governance Console** section and complete all steps in this section.
 
 1. As a user in the <label>-security-admin-group go to the **Establish Connection by Adding a New Connected System - OCI IAM** and complete all steps in this section.
-1. A user in the securi
 
 ## 4.4 Security Services
 
diff --git a/cis-architecture-mapping.md b/cis-architecture-mapping.md
index 441593b2..b54c7a29 100644
--- a/cis-architecture-mapping.md
+++ b/cis-architecture-mapping.md
@@ -9,62 +9,62 @@ The diagram below shows how the services and resources deployed in a single VCN
 ## Mapping to CIS OCI Benchmark
 The table below documents how the services and resources are configured to meet the CIS OCI Benchmark.
 
-|CIS v8        |Benchmark Recommendation #|Section                       |Level|Title                                                                                                                             |Configured By Quick Start           |Quick Start Terraform                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |Code Source                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-|--------------|--------------------------|------------------------------|-----|----------------------------------------------------------------------------------------------------------------------------------|------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-|              |**1**                         |**Identity and Access Management**|     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|5.4, 6.7      |1.1                       |Identity and Access Management|1    |Ensure service level admins are created to manage resources of particular service                                                 |Yes                                 |The CIS Landing Zone defines the following personas that account for most organization needs: • IAM Administrators: manage IAM services and resources including compartments, groups, dynamic groups, policies, identity providers, authentication policies, network sources, tag defaults. However, this group is not allowed to manage the out-of-box Administrators and Credential Administrators groups. It's also not allowed to touch the out-of-box Tenancy Admin Policy policy. • Credential Administrators: manage users capabilities and users credentials in general, including API keys, authentication tokens and secret keys. • Cost Administrators: manage budgets and usage reports. • Auditors: entitled with read-only access across the tenancy and the ability to use cloud-shell to run the cis_reports.py script. • Announcement Readers: for reading announcements displayed in OCI Console. • Security Administrators: manage security services and resources including Vaults, Keys, Logging, Vulnerability Scanning, Web Application Firewall, Bastion, Service Connector Hub. • Network Administrators: manage OCI network family, including VCNs, Load Balancers, DRGs, VNICs, IP addresses. • Application Administrators: manage application related resources including Compute images, OCI Functions, Kubernetes clusters, Streams, Object Storage, Block Storage, File Storage. • Database Administrators: manage database services, including Oracle VMDB (Virtual Machine), BMDB (Bare Metal), ADB (Autonomous databases), Exadata databases, MySQL, NoSQL, etc. • ExaCS Administrators (only created when ExaCS compartment is created): manage Exadata infrastructure and VM clusters in the ExaCS compartment. • Storage Administrators: the only group allowed to delete storage resources, including buckets, volumes and files. Used as a protection measure against inadvertent deletion of storage resources.|https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_groups.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                              |
-|3.3           |1.2                       |Identity and Access Management|1    |Ensure permissions on all resources are given only to the tenancy administrator group                                             |Yes                                 |The CIS Landing Zone defines the following personas that account for most organization needs: • IAM Administrators: manage IAM services and resources including compartments, groups, dynamic groups, policies, identity providers, authentication policies, network sources, tag defaults. However, this group is not allowed to manage the out-of-box Administrators and Credential Administrators groups. It's also not allowed to touch the out-of-box Tenancy Admin Policy policy. • Credential Administrators: manage users capabilities and users credentials in general, including API keys, authentication tokens and secret keys. • Cost Administrators: manage budgets and usage reports. • Auditors: entitled with read-only access across the tenancy and the ability to use cloud-shell to run the cis_reports.py script. • Announcement Readers: for reading announcements displayed in OCI Console. • Security Administrators: manage security services and resources including Vaults, Keys, Logging, Vulnerability Scanning, Web Application Firewall, Bastion, Service Connector Hub. • Network Administrators: manage OCI network family, including VCNs, Load Balancers, DRGs, VNICs, IP addresses. • Application Administrators: manage application related resources including Compute images, OCI Functions, Kubernetes clusters, Streams, Object Storage, Block Storage, File Storage. • Database Administrators: manage database services, including Oracle VMDB (Virtual Machine), BMDB (Bare Metal), ADB (Autonomous databases), Exadata databases, MySQL, NoSQL, etc. • ExaCS Administrators (only created when ExaCS compartment is created): manage Exadata infrastructure and VM clusters in the ExaCS compartment. • Storage Administrators: the only group allowed to delete storage resources, including buckets, volumes and files. Used as a protection measure against inadvertent deletion of storage resources.|https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_groups.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                              |
-|3.3, 5.4      |1.3                       |Identity and Access Management|1    |Ensure IAM administrators cannot update tenancy Administrators group                                                              |Yes                                 |The CIS Landing Zone defines the following personas that account for most organization needs: • IAM Administrators: manage IAM services and resources including compartments, groups, dynamic groups, policies, identity providers, authentication policies, network sources, tag defaults. However, this group is not allowed to manage the out-of-box Administrators and Credential Administrators groups. It's also not allowed to touch the out-of-box Tenancy Admin Policy policy. • Credential Administrators: manage users capabilities and users credentials in general, including API keys, authentication tokens and secret keys.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_groups.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                              |
-|4.1, 5.2      |1.4                       |Identity and Access Management|1    |Ensure IAM password policy requires minimum length of 14 or greater                                                               |No                                  |The CIS Landing Zone does change authentication settings.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|4.1, 5.2      |1.5                       |Identity and Access Management|1    |Ensure IAM password policy expires passwords within 365 days                                                                      |No                                  |The CIS Landing Zone does change authentication settings.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|5.2           |1.6                       |Identity and Access Management|1    |Ensure IAM password policy prevents password reuse                                                                                |No                                  |The CIS Landing Zone does change authentication settings.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|6.3, 6.5      |1.7                       |Identity and Access Management|1    |Ensure MFA is enabled for all users with a console password                                                                       |No                                  |The CIS Landing Zone does not create of modify OCI IAM users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|4.1, 4.4      |1.8                       |Identity and Access Management|1    |Ensure user API keys rotate within 90 days or less                                                                                |No                                  |The CIS Landing Zone does not create OCI IAM users or API Keys of users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|4.1, 5.2      |1.9                       |Identity and Access Management|1    |Ensure user customer secret keys rotate within 90 days or less                                                                    |No                                  |The CIS Landing Zone does not create OCI IAM users or customer secrets of users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|4.1, 5.2      |1.10                      |Identity and Access Management|1    |Ensure user auth tokens rotate within 90 days or less                                                                             |No                                  |The CIS Landing Zone does not create OCI IAM users or Auth Tokens of users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|4.1, 5.2      |1.11                      |Identity and Access Management|1    |Ensure user IAM Database Passwords rotate within 90 days                                                                          |No                                  |The CIS Landing Zone does not create OCI IAM users or Databse Passwords of users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|5.4           |1.12                      |Identity and Access Management|1    |Ensure API keys are not created for tenancy administrator users                                                                   |No                                  |The CIS Landing Zone does modify existing users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|5.1           |1.13                      |Identity and Access Management|1    |Ensure all OCI IAM user accounts have a valid and current email address                                                           |Yes                                 |The Landing Zone defines four dynamic groups to satisfy common needs of workloads that are eventually deployed: • Security Functions: to be used by functions defined in the Security compartment. The matching rule includes all functions in the Security compartment. An example is a function for rotating secrets kept in a Vault. • AppDev Functions: to be used by functions defined in the AppDev compartment. The matching rule includes all functions in the AppDev compartment. An example is a function for processing of application data and writing it to an Object Storage bucket. • Compute Agent: to be used by Compute's management agent in the AppDev compartment. • Database KMS: to be used by databases in the Database compartment to access keys in the Vault service.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|6.8           |1.14                      |Identity and Access Management|1    |Ensure Instance Principal authentication is used for OCI instances, OCI Cloud Databases and OCI Functions to access OCI resources.|Yes                                 |The CIS Landing Zone restricts adds where conditions to the OCI IAM policies for the Network Admins , Security Admins, App Admin, and Database Admins groups which allows them to create storage services but prevents them from deleting storage services. The CIS Landing Zone also create a Storage Admin policy and group which allows the deletion of storage resources but not their creation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                                                                                                                                 |
-|5.4, 6.8      |1.15                      |Identity and Access Management|2    |Ensure storage service-level admins cannot delete resources they manage                                                           |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|              |**2**                         |**Networking**                    |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|4.4, 12.3     |2.1                       |Networking                    |1    |Ensure no security lists allow ingress from 0.0.0.0/0 to port 22.                                                                 |Yes                                 |The CIS Landing Zone creates a secruity list for each VCN it creates. The security only allows port 22 connections from on-premises CIDRs or the hub network. The on-premises CIDRs variable does not allow 0.0.0.0/0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/net_vcn.tf https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                    |
-|4.4, 12.3     |2.2                       |Networking                    |1    |Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389.                                                               |Yes                                 |The CIS Landing Zone creates a secruity list for each VCN it creates. The security only allows port 22 connections from on-premises CIDRs or the hub network. The on-premises CIDRs variable does not allow 0.0.0.0/0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/net_vcn.tf https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                    |
-|4.4, 12.3     |2.3                       |Networking                    |1    |Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22.                                                        |Yes                                 |The CIS Landing Zone deploys a bastion network security groups (NSG) for each VCN it creates. That NSG allows 22 however the variable for ingress CIDRs does not allow 0.0.0.0/0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                                                                                                                    |
-|4.4, 12.3     |2.4                       |Networking                    |1    |Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389.                                                      |Yes                                 |The CIS Landing Zone deploys a bastion network security groups (NSG) for each VCN it creates. That NSG allows 3389 however the variable for ingress CIDRs does not allow 0.0.0.0/0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                                                                                                                    |
-|12.3          |2.5                       |Networking                    |1    |Ensure the default security list of every VCN restricts all traffic except ICMP.                                                  |Yes                                 |The CIS Landing Zone modifies the default security list for every VCN it creates to restrict all traffic except for ICMP.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                                                                                                                    |
-|4.4, 12.3     |2.6                       |Networking                    |1    |Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources.                                                    |No                                  |The CIS Landing Zone doesn't deploy any Oracle Integration Cloud instances.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|4.4, 12.3     |2.7                       |Networking                    |1    |Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network.           |Enables                             |The CIS Landing Zone doesn't deploy any Oracle Analytics Cloud (OAC) instances. The CIS Landing Zone does deploy VCNs with app subnets which are private that can be used for deploying a OAC instances.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/net_vcn.tf                                                                                                                                                                                                                                                                                                                                                                      |
-|4.4, 12.3     |2.8                       |Networking                    |1    |Ensure Oracle Autonomous Shared Database (ADB) access is restricted or deployed within a VCN.                                     |Enables                             |The CIS Landing Zone doesn't deploy any Autonomous Shared Databases (ADB-S). The CIS Landing Zone does deploy VCNs with database subnets which are private that can be used for deploying a ADB-S                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/net_vcn.tf                                                                                                                                                                                                                                                                                                                                                                      |
-|              |**3**                         |**Compute**                       |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|4.8           |3.1                       |Compute                       |2    |Ensure Compute Instance Legacy Metadata service endpoint is disabled                                                              |Enables - via Secure Workload Module|The CIS Landing Zone doesn't deploy any Compute Instance. The CIS Landing Zone does deploy VCNs which can be used for deploying compute Instances and the Secure Workload Module deploys compute instances with the Legacy Metadata service endpoint disabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |https://github.com/oracle-quickstart/terraform-oci-secure-workloads/blob/main/cis-compute-storage/compute.tf                                                                                                                                                                                                                                                                                                                                                         |
-|4.1           |3.2                       |Compute                       |2    |Ensure Secure Boot is enabled on Compute Instance                                                                                 |Enables - via Secure Workload Module|The CIS Landing Zone doesn't deploy any Compute Instance. The CIS Landing Zone does deploy VCNs which can be used for deploying compute Instances and the Secure Workload Module deploys compute instances with Secure Boot Enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |https://github.com/oracle-quickstart/terraform-oci-secure-workloads/blob/main/cis-compute-storage/compute.tf                                                                                                                                                                                                                                                                                                                                                         |
-|3.10,4.1      |3.3                       |Compute                       |1    |Ensure In-transit Encryption is enabled on Compute Instance                                                                       |Enables - via Secure Workload Module|The CIS Landing Zone doesn't deploy any Compute Instance. The CIS Landing Zone does deploy VCNs which can be used for deploying compute Instances and the Secure Workload Module deploys compute instances with In-Transit Encryption Enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |https://github.com/oracle-quickstart/terraform-oci-secure-workloads/blob/main/cis-compute-storage/compute.tf                                                                                                                                                                                                                                                                                                                                                         |
-|              |**4**                         |**Logging and Monitoring**        |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|1.1           |4.1                       |Logging and Monitoring        |1    |Ensure default tags are used on resources.                                                                                        |Yes                                 |The CIS Landing zone deploys two default tags. The two tags are: • Created By tag which identifies who create the resource. • Created On tag which identifies when the resource was created.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_tags.tf                                                                                                                                                                                                                                                                                                                                                                     |
-|8.2, 8.11     |4.2                       |Logging and Monitoring        |1    |Create at least one notification topic and subscription to receive monitoring alerts.                                             |Yes                                 |The CIS Landing Zone creates at least two topics each with a subscription. The two default topics are: • Security Topic and subscription which is where all IAM related events are sent. • Network Topic and subscription which is where all network related events are sent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_topics.tf                                                                                                                                                                                                                                                                                                                                                                   |
-|4.2           |4.3                       |Logging and Monitoring        |1    |Ensure a notification is configured for Identity Provider changes.                                                                |Yes                                 |The CIS Landing Zone creates an OCI event rule for Identity Provider changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.4                       |Logging and Monitoring        |1    |Ensure a notification is configured for IdP group mapping changes.                                                                |Yes                                 |The CIS Landing Zone creates an OCI event rule for IDP mapping changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.5                       |Logging and Monitoring        |1    |Ensure a notification is configured for IAM group changes.                                                                        |Yes                                 |The CIS Landing Zone creates an OCI event rule for IAM group changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.6                       |Logging and Monitoring        |1    |Ensure a notification is configured for IAM policy changes.                                                                       |Yes                                 |The CIS Landing Zone creates an OCI event rule for IAM policy changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.7                       |Logging and Monitoring        |1    |Ensure a notification is configured for user changes.                                                                             |Yes                                 |The CIS Landing Zone creates an OCI event rule for IAM User changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.8                       |Logging and Monitoring        |1    |Ensure a notification is configured for VCN changes.                                                                              |Yes                                 |The CIS Landing Zone creates an OCI event rule for Virtual Cloud Network (VCN) changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.9                       |Logging and Monitoring        |1    |Ensure a notification is configured for changes to route tables.                                                                  |Yes                                 |The CIS Landing Zone creates an OCI event rule for network route table changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.10                      |Logging and Monitoring        |1    |Ensure a notification is configured for security list changes.                                                                    |Yes                                 |The CIS Landing Zone creates an OCI event rule for network Security List changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.11                      |Logging and Monitoring        |1    |Ensure a notification is configured for network security group changes.                                                           |Yes                                 |The CIS Landing Zone creates an OCI event rule for network security group changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|4.2           |4.12                      |Logging and Monitoring        |1    |Ensure a notification is configured for changes to network gateways.                                                              |Yes                                 |The CIS Landing Zone creates an OCI event rules for network gateway changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|8.2, 8.5, 13.6|4.13                      |Logging and Monitoring        |2    |Ensure VCN flow logging is enabled for all subnets.                                                                               |Yes                                 |The CIS Landing Zone enables VCN flow logs for all subnets it deploys                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_flow_logs.tf                                                                                                                                                                                                                                                                                                                                                                |
-|8.2, 8.5, 8.11|4.14                      |Logging and Monitoring        |1    |Ensure Cloud Guard is enabled in the root compartment of the tenancy.                                                             |Yes                                 |The CIS Landing Zone enables OCI Cloud Guard with all the detectors and responders at the root compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_cloud_guard.tf                                                                                                                                                                                                                                                                                                                                                              |
-|8.2, 8.11     |4.15                      |Logging and Monitoring        |1    |Ensure a notification is configured for Oracle Cloud Guard problems detected                                                      |Yes                                 |The CIS Landing Zone creates an OCI event rules for Cloud Guard Events.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |
-|8.0           |4.16                      |Logging and Monitoring        |1    |Ensure customer created Customer Managed Key (CMK) is rotated at least annually.                                                  |No                                  |No configuration available at this time                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|8.2           |4.17                      |Logging and Monitoring        |2    |Ensure write level Object Storage logging is enabled for all buckets.                                                             |Yes                                 |The CIS Landing Zone deploy an optional Object Storage bucket(s) in the AppDev Compartment. Those bucket(s) are deployed and write logging is enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_oss_logs.tf                                                                                                                                                                                                                                                                                                                                                                 |
-|              |**5**                         |**Storage**         |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|3.3           |5.1.1                     |Storage - Object Storage      |1    |Ensure no Object Storage buckets are publicly visible.                                                                            |Yes                                 |The CIS Landing Zone deploy an optional Object Storage bucket(s) in the AppDev Compartment. Those bucket(s) are deployed as a private bucket.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/modules/object-storage/bucket/main.tf                                                                                                                                                                                                                                                                                                                                                  |
-|3.11          |5.1.2                     |Storage - Object Storage      |2    |Ensure Object Storage Buckets are encrypted with a Customer-Managed Key (CMK).                                                    |Yes                                 |The CIS Landing Zone deploys an optional (Level 2 selected) OCI Vault in the Security Compartment and generates an optional Customer Managed Key (CMK). It also deploys required OCI IAM policies for the Object Storage service and OCI IAM groups to use CMKs in the Security Compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/modules/object-storage/bucket/main.tf https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/keys.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf|
-|3.11          |5.1.3                     |Storage - Object Storage      |2    |Ensure Versioning is Enabled for Object Storage Buckets.                                                                          |Yes                                 |The CIS Landing Zone deploy an optional Object Storage bucket in the AppDev Compartment. That bucket is deployed is deployed with versioning Enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/modules/object-storage/bucket/main.tf                                                                                                                                                                                                                                                                                                                                                  |
-|3.11          |5.2.1                     |Storage - Block Volumes       |2    |Ensure Block Volumes are encrypted with Customer-Managed Keys.                                                                    |Enables                             |The CIS Landing Zone deploys an optional (Level 2 selected) OCI Vault in the Security Compartment and generates an optional Customer Managed Key (CMK). It also deploys required OCI IAM policies for the Block Volume service and OCI IAM groups to use CMKs in the Security Compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/keys.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                                    |
-|3.11          |5.2.2                     |Storage - Block Volumes       |2    |Ensure Boot Volumes are encrypted with Customer-Managed Key.                                                                      |Enables                             |The CIS Landing Zone deploys an optional (Level 2 selected) OCI Vault in the Security Compartment and generates an optional Customer Managed Key (CMK). It also deploys required OCI IAM policies for the Block Volume service and OCI IAM groups to use CMKs in the Security Compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/keys.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                                    |
-|3.11          |5.3.1                     |Storage - File Storage Service|2    |Ensure File Storage Systems are encrypted with Customer-Managed Keys.                                                             |Enables                             |The CIS Landing Zone deploys an optional (Level 2 selected) OCI Vault in the Security Compartment and generates an optional Customer Managed Key (CMK). It also deploys required OCI IAM policies for the File Storage Service (FSS) service and OCI IAM groups to use keys in the Security Compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/keys.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                                    |
-|              |**6**                         |**Asset Management**              |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-|3.1           |6.1                       |Asset Management              |1    |Create at least one compartment in your tenancy to store cloud resources.                                                         |Yes                                 |The CIS Landing Zone provisions the following compartments: • A recommended enclosing compartment containing all compartments above. • A Network compartment for all the networking resources, including the required network gateways. • A Security compartment for the logging, key management, and notifications resources. • An App compartment for the application-related services, including compute, storage, functions, streams, Kubernetes nodes, API gateway, and so on. • A Database compartment for all database resources. • An optional compartment for Oracle Exadata Database Service infrastructure.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_compartments.tf                                                                                                                                                                                                                                                                                                                                                             |
-|3.12          |6.2                       |Asset Management              |1    |Ensure no resources are created in the root compartment.                                                                          |Yes                                 |The CIS Landing Zone creates a • A recommended enclosing compartment is created to contain all of the compartments below. • A Network compartment is used for network and network-related resources. The CIS Landing Zone Quick Start deploys the network-related resources, including VCN, Subnets, gateways, NSG, and Security Lists in the Network Compartment • A Security compartment is used for security and logging related resources. The CIS Landing Zone deploys the logging, key management, and notification resources into the Security Compartment. • An App compartment is used for the application-related services. The CIS Landing Zone deploys an optional Object Storage bucket in this compartment. • A Database compartment for is used for database related resources. • An optional compartment for Oracle Exadata Database Service is used for Exadata infrastructure.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_compartments.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                        |
+|CIS v8        |Benchmark Recommendation #|Section                       |Level|Title                                                                                                                             |Configured By Quick Start           |Quick Start Terraform                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |Code Source                                                                                                                                                                                                                                                                                                                                                                                                                                                          |Cloud Guard Detector                                                                                                                                         |Cloud Guard Detector Coverage|Security Zone Rule                 |
+|--------------|--------------------------|------------------------------|-----|----------------------------------------------------------------------------------------------------------------------------------|------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|-----------------------------------|
+|              |1                         |Identity and Access Management|     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                             |                             |                                   |
+|5.4, 6.7      |1.1                       |Identity and Access Management|1    |Ensure service level admins are created to manage resources of particular service                                                 |Yes                                 |The CIS Landing Zone defines the following personas that account for most organization needs: • IAM Administrators: manage IAM services and resources including compartments, groups, dynamic groups, policies, identity providers, authentication policies, network sources, tag defaults. However, this group is not allowed to manage the out-of-box Administrators and Credential Administrators groups. It's also not allowed to touch the out-of-box Tenancy Admin Policy policy. • Credential Administrators: manage users capabilities and users credentials in general, including API keys, authentication tokens and secret keys. • Cost Administrators: manage budgets and usage reports. • Auditors: entitled with read-only access across the tenancy and the ability to use cloud-shell to run the cis_reports.py script. • Announcement Readers: for reading announcements displayed in OCI Console. • Security Administrators: manage security services and resources including Vaults, Keys, Logging, Vulnerability Scanning, Web Application Firewall, Bastion, Service Connector Hub. • Network Administrators: manage OCI network family, including VCNs, Load Balancers, DRGs, VNICs, IP addresses. • Application Administrators: manage application related resources including Compute images, OCI Functions, Kubernetes clusters, Streams, Object Storage, Block Storage, File Storage. • Database Administrators: manage database services, including Oracle VMDB (Virtual Machine), BMDB (Bare Metal), ADB (Autonomous databases), Exadata databases, MySQL, NoSQL, etc. • ExaCS Administrators (only created when ExaCS compartment is created): manage Exadata infrastructure and VM clusters in the ExaCS compartment. • Storage Administrators: the only group allowed to delete storage resources, including buckets, volumes and files. Used as a protection measure against inadvertent deletion of storage resources.|https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_groups.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                              |POLICY_GIVES_MANY_PRIVILEGES                                                                                                                                 |Partial Coverage             |                                   |
+|3.3           |1.2                       |Identity and Access Management|1    |Ensure permissions on all resources are given only to the tenancy administrator group                                             |Yes                                 |The CIS Landing Zone defines the following personas that account for most organization needs: • IAM Administrators: manage IAM services and resources including compartments, groups, dynamic groups, policies, identity providers, authentication policies, network sources, tag defaults. However, this group is not allowed to manage the out-of-box Administrators and Credential Administrators groups. It's also not allowed to touch the out-of-box Tenancy Admin Policy policy. • Credential Administrators: manage users capabilities and users credentials in general, including API keys, authentication tokens and secret keys. • Cost Administrators: manage budgets and usage reports. • Auditors: entitled with read-only access across the tenancy and the ability to use cloud-shell to run the cis_reports.py script. • Announcement Readers: for reading announcements displayed in OCI Console. • Security Administrators: manage security services and resources including Vaults, Keys, Logging, Vulnerability Scanning, Web Application Firewall, Bastion, Service Connector Hub. • Network Administrators: manage OCI network family, including VCNs, Load Balancers, DRGs, VNICs, IP addresses. • Application Administrators: manage application related resources including Compute images, OCI Functions, Kubernetes clusters, Streams, Object Storage, Block Storage, File Storage. • Database Administrators: manage database services, including Oracle VMDB (Virtual Machine), BMDB (Bare Metal), ADB (Autonomous databases), Exadata databases, MySQL, NoSQL, etc. • ExaCS Administrators (only created when ExaCS compartment is created): manage Exadata infrastructure and VM clusters in the ExaCS compartment. • Storage Administrators: the only group allowed to delete storage resources, including buckets, volumes and files. Used as a protection measure against inadvertent deletion of storage resources.|https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_groups.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                              |POLICY_GIVES_MANY_PRIVILEGES                                                                                                                                 |Partial Coverage             |                                   |
+|3.3, 5.4      |1.3                       |Identity and Access Management|1    |Ensure IAM administrators cannot update tenancy Administrators group                                                              |Yes                                 |The CIS Landing Zone defines the following personas that account for most organization needs: • IAM Administrators: manage IAM services and resources including compartments, groups, dynamic groups, policies, identity providers, authentication policies, network sources, tag defaults. However, this group is not allowed to manage the out-of-box Administrators and Credential Administrators groups. It's also not allowed to touch the out-of-box Tenancy Admin Policy policy. • Credential Administrators: manage users capabilities and users credentials in general, including API keys, authentication tokens and secret keys.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_groups.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                              |POLICY_TENANCY_ADMIN_GROUP_PRIVILEGES                                                                                                                        |Partial Coverage             |                                   |
+|4.1, 5.2      |1.4                       |Identity and Access Management|1    |Ensure IAM password policy requires minimum length of 14 or greater                                                               |No                                  |The CIS Landing Zone does change authentication settings.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |PASSWORD_POLICY_NOT_COMPLEX                                                                                                                                  |                             |                                   |
+|4.1, 5.2      |1.5                       |Identity and Access Management|1    |Ensure IAM password policy expires passwords within 365 days                                                                      |No                                  |The CIS Landing Zone does change authentication settings.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |PASSWORD_TOO_OLD                                                                                                                                             |                             |                                   |
+|5.2           |1.6                       |Identity and Access Management|1    |Ensure IAM password policy prevents password reuse                                                                                |No                                  |The CIS Landing Zone does change authentication settings.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |None                                                                                                                                                         |                             |                                   |
+|6.3, 6.5      |1.7                       |Identity and Access Management|1    |Ensure MFA is enabled for all users with a console password                                                                       |No                                  |The CIS Landing Zone does not create of modify OCI IAM users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |NO_MFA_ENABLED_FOR_USER                                                                                                                                      |                             |                                   |
+|4.1, 4.4      |1.8                       |Identity and Access Management|1    |Ensure user API keys rotate within 90 days or less                                                                                |No                                  |The CIS Landing Zone does not create OCI IAM users or API Keys of users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |API_KEY_TOO_OLD                                                                                                                                              |                             |                                   |
+|4.1, 5.2      |1.9                       |Identity and Access Management|1    |Ensure user customer secret keys rotate within 90 days or less                                                                    |No                                  |The CIS Landing Zone does not create OCI IAM users or customer secrets of users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |SECRET_KEY_TOO_OLD                                                                                                                                           |                             |                                   |
+|4.1, 5.2      |1.10                      |Identity and Access Management|1    |Ensure user auth tokens rotate within 90 days or less                                                                             |No                                  |The CIS Landing Zone does not create OCI IAM users or Auth Tokens of users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |AUTH_TOKEN_TOO_OLD                                                                                                                                           |                             |                                   |
+|4.1, 5.2      |1.11                      |Identity and Access Management|1    |Ensure user IAM Database Passwords rotate within 90 days                                                                          |No                                  |The CIS Landing Zone does not create OCI IAM users or Databse Passwords of users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |None                                                                                                                                                         |                             |                                   |
+|5.4           |1.12                      |Identity and Access Management|1    |Ensure API keys are not created for tenancy administrator users                                                                   |No                                  |The CIS Landing Zone does modify existing users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |USER_HAS_API_KEYS                                                                                                                                            |                             |                                   |
+|5.1           |1.13                      |Identity and Access Management|1    |Ensure all OCI IAM user accounts have a valid and current email address                                                           |Yes                                 |The Landing Zone defines four dynamic groups to satisfy common needs of workloads that are eventually deployed: • Security Functions: to be used by functions defined in the Security compartment. The matching rule includes all functions in the Security compartment. An example is a function for rotating secrets kept in a Vault. • AppDev Functions: to be used by functions defined in the AppDev compartment. The matching rule includes all functions in the AppDev compartment. An example is a function for processing of application data and writing it to an Object Storage bucket. • Compute Agent: to be used by Compute's management agent in the AppDev compartment. • Database KMS: to be used by databases in the Database compartment to access keys in the Vault service.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |None                                                                                                                                                         |                             |                                   |
+|6.8           |1.14                      |Identity and Access Management|1    |Ensure Instance Principal authentication is used for OCI instances, OCI Cloud Databases and OCI Functions to access OCI resources.|Yes                                 |The CIS Landing Zone restricts adds where conditions to the OCI IAM policies for the Network Admins , Security Admins, App Admin, and Database Admins groups which allows them to create storage services but prevents them from deleting storage services. The CIS Landing Zone also create a Storage Admin policy and group which allows the deletion of storage resources but not their creation.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                                                                                                                                 |KEY_NOT_ROTATED                                                                                                                                              |                             |                                   |
+|5.4, 6.8      |1.15                      |Identity and Access Management|2    |Ensure storage service-level admins cannot delete resources they manage                                                           |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |None                                                                                                                                                         |                             |                                   |
+|              |2                         |Networking                    |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                             |                             |                                   |
+|4.4, 12.3     |2.1                       |Networking                    |1    |Ensure no security lists allow ingress from 0.0.0.0/0 to port 22.                                                                 |Yes                                 |The CIS Landing Zone creates a secruity list for each VCN it creates. The security only allows port 22 connections from on-premises CIDRs or the hub network. The on-premises CIDRs variable does not allow 0.0.0.0/0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/net_vcn.tf https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                    |SECURITY_LISTS_OPEN_SOURCE                                                                                                                                   |                             |                                   |
+|4.4, 12.3     |2.2                       |Networking                    |1    |Ensure no security lists allow ingress from 0.0.0.0/0 to port 3389.                                                               |Yes                                 |The CIS Landing Zone creates a secruity list for each VCN it creates. The security only allows port 22 connections from on-premises CIDRs or the hub network. The on-premises CIDRs variable does not allow 0.0.0.0/0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/net_vcn.tf https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                    |SECURITY_LISTS_OPEN_SOURCE                                                                                                                                   |                             |                                   |
+|4.4, 12.3     |2.3                       |Networking                    |1    |Ensure no network security groups allow ingress from 0.0.0.0/0 to port 22.                                                        |Yes                                 |The CIS Landing Zone deploys a bastion network security groups (NSG) for each VCN it creates. That NSG allows 22 however the variable for ingress CIDRs does not allow 0.0.0.0/0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                                                                                                                    |VCN_NSG_EGRESS_RULE_PORTS_CHECK                                                                                                                              |                             |                                   |
+|4.4, 12.3     |2.4                       |Networking                    |1    |Ensure no network security groups allow ingress from 0.0.0.0/0 to port 3389.                                                      |Yes                                 |The CIS Landing Zone deploys a bastion network security groups (NSG) for each VCN it creates. That NSG allows 3389 however the variable for ingress CIDRs does not allow 0.0.0.0/0.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                                                                                                                    |VCN_NSG_EGRESS_RULE_PORTS_CHECK                                                                                                                              |                             |                                   |
+|12.3          |2.5                       |Networking                    |1    |Ensure the default security list of every VCN restricts all traffic except ICMP.                                                  |Yes                                 |The CIS Landing Zone modifies the default security list for every VCN it creates to restrict all traffic except for ICMP.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/variables.tf                                                                                                                                                                                                                                                                                                                                                                    |SECURITY_LISTS_OPEN_PORTS                                                                                                                                    |Partial Coverage             |                                   |
+|4.4, 12.3     |2.6                       |Networking                    |1    |Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources.                                                    |No                                  |The CIS Landing Zone doesn't deploy any Oracle Integration Cloud instances.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |None                                                                                                                                                         |                             |                                   |
+|4.4, 12.3     |2.7                       |Networking                    |1    |Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network.           |Enables                             |The CIS Landing Zone doesn't deploy any Oracle Analytics Cloud (OAC) instances. The CIS Landing Zone does deploy VCNs with app subnets which are private that can be used for deploying a OAC instances.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/net_vcn.tf                                                                                                                                                                                                                                                                                                                                                                      |None                                                                                                                                                         |                             |                                   |
+|4.4, 12.3     |2.8                       |Networking                    |1    |Ensure Oracle Autonomous Shared Database (ADB) access is restricted or deployed within a VCN.                                     |Enables                             |The CIS Landing Zone doesn't deploy any Autonomous Shared Databases (ADB-S). The CIS Landing Zone does deploy VCNs with database subnets which are private that can be used for deploying a ADB-S                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/net_vcn.tf                                                                                                                                                                                                                                                                                                                                                                      |None                                                                                                                                                         |                             |                                   |
+|              |3                         |Compute                       |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                             |                             |                                   |
+|4.8           |3.1                       |Compute                       |2    |Ensure Compute Instance Legacy Metadata service endpoint is disabled                                                              |Enables - via Secure Workload Module|The CIS Landing Zone doesn't deploy any Compute Instance. The CIS Landing Zone does deploy VCNs which can be used for deploying compute Instances and the Secure Workload Module deploys compute instances with the Legacy Metadata service endpoint disabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |https://github.com/oracle-quickstart/terraform-oci-secure-workloads/blob/main/cis-compute-storage/compute.tf                                                                                                                                                                                                                                                                                                                                                         |                                                                                                                                                             |                             |                                   |
+|4.1           |3.2                       |Compute                       |2    |Ensure Secure Boot is enabled on Compute Instance                                                                                 |Enables - via Secure Workload Module|The CIS Landing Zone doesn't deploy any Compute Instance. The CIS Landing Zone does deploy VCNs which can be used for deploying compute Instances and the Secure Workload Module deploys compute instances with Secure Boot Enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |https://github.com/oracle-quickstart/terraform-oci-secure-workloads/blob/main/cis-compute-storage/compute.tf                                                                                                                                                                                                                                                                                                                                                         |                                                                                                                                                             |                             |                                   |
+|3.10,4.1      |3.3                       |Compute                       |1    |Ensure In-transit Encryption is enabled on Compute Instance                                                                       |Enables - via Secure Workload Module|The CIS Landing Zone doesn't deploy any Compute Instance. The CIS Landing Zone does deploy VCNs which can be used for deploying compute Instances and the Secure Workload Module deploys compute instances with In-Transit Encryption Enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |https://github.com/oracle-quickstart/terraform-oci-secure-workloads/blob/main/cis-compute-storage/compute.tf                                                                                                                                                                                                                                                                                                                                                         |                                                                                                                                                             |                             |                                   |
+|              |4                         |Logging and Monitoring        |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                             |                             |                                   |
+|1.1           |4.1                       |Logging and Monitoring        |1    |Ensure default tags are used on resources.                                                                                        |Yes                                 |The CIS Landing zone deploys two default tags. The two tags are: • Created By tag which identifies who create the resource. • Created On tag which identifies when the resource was created.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_tags.tf                                                                                                                                                                                                                                                                                                                                                                     |RESOURCE_NOT_TAGGED                                                                                                                                          |                             |                                   |
+|8.2, 8.11     |4.2                       |Logging and Monitoring        |1    |Create at least one notification topic and subscription to receive monitoring alerts.                                             |Yes                                 |The CIS Landing Zone creates at least two topics each with a subscription. The two default topics are: • Security Topic and subscription which is where all IAM related events are sent. • Network Topic and subscription which is where all network related events are sent.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_topics.tf                                                                                                                                                                                                                                                                                                                                                                   |None                                                                                                                                                         |                             |                                   |
+|4.2           |4.3                       |Logging and Monitoring        |1    |Ensure a notification is configured for Identity Provider changes.                                                                |Yes                                 |The CIS Landing Zone creates an OCI event rule for Identity Provider changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |None                                                                                                                                                         |                             |                                   |
+|4.2           |4.4                       |Logging and Monitoring        |1    |Ensure a notification is configured for IdP group mapping changes.                                                                |Yes                                 |The CIS Landing Zone creates an OCI event rule for IDP mapping changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |None                                                                                                                                                         |                             |                                   |
+|4.2           |4.5                       |Logging and Monitoring        |1    |Ensure a notification is configured for IAM group changes.                                                                        |Yes                                 |The CIS Landing Zone creates an OCI event rule for IAM group changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |IAM_GROUP_DELETED, USER_ADDED_TO_GROUP, IAM_GROUP_CREATED, USER_REMOVED_FROM_GROUP                                                                           |                             |                                   |
+|4.2           |4.6                       |Logging and Monitoring        |1    |Ensure a notification is configured for IAM policy changes.                                                                       |Yes                                 |The CIS Landing Zone creates an OCI event rule for IAM policy changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |SECURITY_POLICY_MODIFIED                                                                                                                                     |Partial Coverage             |                                   |
+|4.2           |4.7                       |Logging and Monitoring        |1    |Ensure a notification is configured for user changes.                                                                             |Yes                                 |The CIS Landing Zone creates an OCI event rule for IAM User changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |USER_ADDED_TO_GROUP                                                                                                                                          |Partial Coverage             |                                   |
+|4.2           |4.8                       |Logging and Monitoring        |1    |Ensure a notification is configured for VCN changes.                                                                              |Yes                                 |The CIS Landing Zone creates an OCI event rule for Virtual Cloud Network (VCN) changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |VCN_CREATE, VCN_DELETED                                                                                                                                      |Partial Coverage             |                                   |
+|4.2           |4.9                       |Logging and Monitoring        |1    |Ensure a notification is configured for changes to route tables.                                                                  |Yes                                 |The CIS Landing Zone creates an OCI event rule for network route table changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |ROUTE_TABLE_CHANGED                                                                                                                                          |Partial Coverage             |                                   |
+|4.2           |4.10                      |Logging and Monitoring        |1    |Ensure a notification is configured for security list changes.                                                                    |Yes                                 |The CIS Landing Zone creates an OCI event rule for network Security List changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |VCN_SECURITY_LIST_DELETED, VCN_SECURITY_LIST_CREATED, VCN_SECURITY_LIST_EGRESS_RULES_CHANGED, VCN_SECURITY_LIST_INGRESS_RULES_CHANGED                        |Partial Coverage             |                                   |
+|4.2           |4.11                      |Logging and Monitoring        |1    |Ensure a notification is configured for network security group changes.                                                           |Yes                                 |The CIS Landing Zone creates an OCI event rule for network security group changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |NSG_DELETE, NSG_EGRESS_RULE_CHANGED, NSG_INGRESS_RULE_CHANGED, VCN_NSG_INGRESS_RULE_PORTS_CHECK, VCN_NSG_EGRESS_RULE_PORTS_CHECK                             |Partial Coverage             |                                   |
+|4.2           |4.12                      |Logging and Monitoring        |1    |Ensure a notification is configured for changes to network gateways.                                                              |Yes                                 |The CIS Landing Zone creates an OCI event rules for network gateway changes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |DRG_DELETED, VCN_LOCAL_PEERING_GATEWAY_CHANGED, DRG_ATTACHED_TO_VCN, INTERNET_GATEWAY_TERMINATED, INTERNET_GATEWAY_CREATED, DRG_DETACHED_FROM_VCN DRG_CREATED|Partial Coverage             |                                   |
+|8.2, 8.5, 13.6|4.13                      |Logging and Monitoring        |2    |Ensure VCN flow logging is enabled for all subnets.                                                                               |Yes                                 |The CIS Landing Zone enables VCN flow logs for all subnets it deploys                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_flow_logs.tf                                                                                                                                                                                                                                                                                                                                                                |None                                                                                                                                                         |                             |                                   |
+|8.2, 8.5, 8.11|4.14                      |Logging and Monitoring        |1    |Ensure Cloud Guard is enabled in the root compartment of the tenancy.                                                             |Yes                                 |The CIS Landing Zone enables OCI Cloud Guard with all the detectors and responders at the root compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_cloud_guard.tf                                                                                                                                                                                                                                                                                                                                                              |None                                                                                                                                                         |                             |                                   |
+|8.2, 8.11     |4.15                      |Logging and Monitoring        |1    |Ensure a notification is configured for Oracle Cloud Guard problems detected                                                      |Yes                                 |The CIS Landing Zone creates an OCI event rules for Cloud Guard Events.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_notifications.tf                                                                                                                                                                                                                                                                                                                                                            |None                                                                                                                                                         |                             |                                   |
+|8.0           |4.16                      |Logging and Monitoring        |1    |Ensure customer created Customer Managed Key (CMK) is rotated at least annually.                                                  |No                                  |No configuration available at this time                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |KEY_NOT_ROTATED                                                                                                                                              |                             |                                   |
+|8.2           |4.17                      |Logging and Monitoring        |2    |Ensure write level Object Storage logging is enabled for all buckets.                                                             |Yes                                 |The CIS Landing Zone deploy an optional Object Storage bucket(s) in the AppDev Compartment. Those bucket(s) are deployed and write logging is enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/mon_oss_logs.tf                                                                                                                                                                                                                                                                                                                                                                 |BUCKET_WRITE_LOG_ACCESS_DISABLED                                                                                                                             |                             |                                   |
+|              |5                         |Storage - Object Storage      |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                             |                             |                                   |
+|3.3           |5.1.1                     |Storage - Object Storage      |1    |Ensure no Object Storage buckets are publicly visible.                                                                            |Yes                                 |The CIS Landing Zone deploy an optional Object Storage bucket(s) in the AppDev Compartment. Those bucket(s) are deployed as a private bucket.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/modules/object-storage/bucket/main.tf                                                                                                                                                                                                                                                                                                                                                  |BUCKET_IS_PUBLIC                                                                                                                                             |                             |deny public_buckets                |
+|3.11          |5.1.2                     |Storage - Object Storage      |2    |Ensure Object Storage Buckets are encrypted with a Customer-Managed Key (CMK).                                                    |Yes                                 |The CIS Landing Zone deploys an optional (Level 2 selected) OCI Vault in the Security Compartment and generates an optional Customer Managed Key (CMK). It also deploys required OCI IAM policies for the Object Storage service and OCI IAM groups to use CMKs in the Security Compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/modules/object-storage/bucket/main.tf https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/keys.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf|BUCKET_ENCRYPTED_WITH_ORACLE_MANAGED_KEY                                                                                                                     |                             |deny buckets_without_vault_key     |
+|3.11          |5.1.3                     |Storage - Object Storage      |2    |Ensure Versioning is Enabled for Object Storage Buckets.                                                                          |Yes                                 |The CIS Landing Zone deploy an optional Object Storage bucket in the AppDev Compartment. That bucket is deployed is deployed with versioning Enabled.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/modules/object-storage/bucket/main.tf                                                                                                                                                                                                                                                                                                                                                  |None                                                                                                                                                         |                             |                                   |
+|3.11          |5.2.1                     |Storage - Block Volumes       |2    |Ensure Block Volumes are encrypted with Customer-Managed Keys.                                                                    |Enables                             |The CIS Landing Zone deploys an optional (Level 2 selected) OCI Vault in the Security Compartment and generates an optional Customer Managed Key (CMK). It also deploys required OCI IAM policies for the Block Volume service and OCI IAM groups to use CMKs in the Security Compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/keys.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                                    |BLOCK_VOLUME_ENCRYPTED_WITH_ORACLE_MANAGED_KEY                                                                                                               |                             |deny block_volume_without_vault_key|
+|3.11          |5.2.2                     |Storage - Block Volumes       |2    |Ensure Boot Volumes are encrypted with Customer-Managed Key.                                                                      |Enables                             |The CIS Landing Zone deploys an optional (Level 2 selected) OCI Vault in the Security Compartment and generates an optional Customer Managed Key (CMK). It also deploys required OCI IAM policies for the Block Volume service and OCI IAM groups to use CMKs in the Security Compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/keys.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                                    |None                                                                                                                                                         |                             |deny boot_volume_without_vault_key |
+|3.11          |5.3.1                     |Storage - File Storage Service|2    |Ensure File Storage Systems are encrypted with Customer-Managed Keys.                                                             |Enables                             |The CIS Landing Zone deploys an optional (Level 2 selected) OCI Vault in the Security Compartment and generates an optional Customer Managed Key (CMK). It also deploys required OCI IAM policies for the File Storage Service (FSS) service and OCI IAM groups to use keys in the Security Compartment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/keys.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                                    |None                                                                                                                                                         |                             |deny file_system_without_vault_key |
+|              |6                         |Asset Management              |     |                                                                                                                                  |                                    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |                                                                                                                                                             |                             |                                   |
+|3.1           |6.1                       |Asset Management              |1    |Create at least one compartment in your tenancy to store cloud resources.                                                         |Yes                                 |The CIS Landing Zone provisions the following compartments: • A recommended enclosing compartment containing all compartments above. • A Network compartment for all the networking resources, including the required network gateways. • A Security compartment for the logging, key management, and notifications resources. • An App compartment for the application-related services, including compute, storage, functions, streams, Kubernetes nodes, API gateway, and so on. • A Database compartment for all database resources. • An optional compartment for Oracle Exadata Database Service infrastructure.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_compartments.tf                                                                                                                                                                                                                                                                                                                                                             |None                                                                                                                                                         |                             |                                   |
+|3.12          |6.2                       |Asset Management              |1    |Ensure no resources are created in the root compartment.                                                                          |Yes                                 |The CIS Landing Zone creates a • A recommended enclosing compartment is created to contain all of the compartments below. • A Network compartment is used for network and network-related resources. The CIS Landing Zone Quick Start deploys the network-related resources, including VCN, Subnets, gateways, NSG, and Security Lists in the Network Compartment • A Security compartment is used for security and logging related resources. The CIS Landing Zone deploys the logging, key management, and notification resources into the Security Compartment. • An App compartment is used for the application-related services. The CIS Landing Zone deploys an optional Object Storage bucket in this compartment. • A Database compartment for is used for database related resources. • An optional compartment for Oracle Exadata Database Service is used for Exadata infrastructure.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_compartments.tf Deployment dependent: - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_service_policies.tf - https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/config/iam_template_policies.tf                                                                                                        |None                                                                                                                                                         |                             |                                   |
diff --git a/compliance-script.md b/compliance-script.md
index 1242dd0f..b35eaf57 100644
--- a/compliance-script.md
+++ b/compliance-script.md
@@ -23,14 +23,27 @@ The **Auditors Group** that is created as part of the CIS Landing Zone Terraform
 **Access to audit retention requires the user to be part of the Administrator group* - the only recommendation affected is CIS recommendation 3.1.
 
 ```
-Allow group Auditor-Group to inspect all-resources in tenancy
-Allow group Auditor-Group to read buckets in tenancy
-Allow group Auditor-Group to read file-family in tenancy
-Allow group Auditor-Group to read network-security-groups in tenancy
-Allow group Auditor-Group to read users in tenancy
-Allow group Auditor-Group to use cloud-shell in tenancy
-Allow group Auditor-Group to read dynamic-groups in tenancy
-Allow group Auditor-Group to read tag-defaults in tenancy
+allow group Auditor-Group to inspect all-resources in tenancy
+allow group Auditor-Group to read instances in tenancy
+allow group Auditor-Group to read load-balancers in tenancy
+allow group Auditor-Group to read buckets in tenancy
+allow group Auditor-Group to read nat-gateways in tenancy
+allow group Auditor-Group to read public-ips in tenancy
+allow group Auditor-Group to read file-family in tenancy
+allow group Auditor-Group to read instance-configurations in tenancy
+allow group Auditor-Group to read network-security-groups in tenancy
+allow group Auditor-Group to read resource-availability in tenancy
+allow group Auditor-Group to read audit-events in tenancy
+allow group Auditor-Group to read users in tenancy	
+allow group Auditor-Group to use cloud-shell in tenancy
+allow group Auditor-Group to read vss-family in tenancy
+allow group Auditor-Group to read usage-budgets in tenancy
+allow group Auditor-Group to read usage-reports in tenancy
+allow group Auditor-Group to read data-safe-family in tenancy
+allow group Auditor-Group to read vaults in tenancy
+allow group Auditor-Group to read keys in tenancy
+allow group Auditor-Group to read tag-namespaces in tenancy
+allow group Auditor-Group to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/}
 ```
 
 ### Setup the script to run on a local machine
diff --git a/config/iam_policies.tf b/config/iam_policies.tf
index f8c48d86..7d205e20 100644
--- a/config/iam_policies.tf
+++ b/config/iam_policies.tf
@@ -175,7 +175,8 @@ locals {
     "allow group ${join(",", local.network_admin_group_name)} to read instance-agent-plugins in compartment ${local.network_compartment_name}",
     "allow group ${join(",", local.network_admin_group_name)} to manage keys in compartment ${local.network_compartment_name}",
     "allow group ${join(",", local.network_admin_group_name)} to use key-delegate in compartment ${local.network_compartment_name}",
-  "allow group ${join(",", local.network_admin_group_name)} to manage secret-family in compartment ${local.network_compartment_name}"]
+    "allow group ${join(",", local.network_admin_group_name)} to manage secret-family in compartment ${local.network_compartment_name}",
+    "allow group ${join(",", local.network_admin_group_name)} to manage repos in compartment ${local.network_compartment_name}"]
 
   ## Network admin grants on Security compartment
   network_admin_grants_on_security_cmp = [
@@ -214,7 +215,8 @@ locals {
     "allow group ${join(",", local.database_admin_group_name)} to use vnics in compartment ${local.database_compartment_name}",
     "allow group ${join(",", local.database_admin_group_name)} to manage keys in compartment ${local.database_compartment_name}",
     "allow group ${join(",", local.database_admin_group_name)} to use key-delegate in compartment ${local.database_compartment_name}",
-  "allow group ${join(",", local.database_admin_group_name)} to manage secret-family in compartment ${local.database_compartment_name}"]
+    "allow group ${join(",", local.database_admin_group_name)} to manage secret-family in compartment ${local.database_compartment_name}",
+  "allow group ${join(",", local.database_admin_group_name)} to manage repos in compartment ${local.database_compartment_name}"]
 
   ## Database admin grants on Network compartment
   database_admin_grants_on_network_cmp = [
@@ -552,7 +554,12 @@ locals {
         "allow group ${join(",", local.auditor_group_name)} to read vss-family in tenancy",
         "allow group ${join(",", local.auditor_group_name)} to read usage-budgets in tenancy",
         "allow group ${join(",", local.auditor_group_name)} to read usage-reports in tenancy",
-        "allow group ${join(",", local.auditor_group_name)} to read data-safe-family in tenancy"
+        "allow group ${join(",", local.auditor_group_name)} to read data-safe-family in tenancy",
+        "allow group ${join(",", local.auditor_group_name)} to read vaults in tenancy",
+        "allow group ${join(",", local.auditor_group_name)} to read keys in tenancy",
+        "allow group ${join(",", local.auditor_group_name)} to read tag-namespaces in tenancy",
+        "allow group ${join(",", local.auditor_group_name)} to read serviceconnectors in tenancy",
+        "allow group ${join(",", local.auditor_group_name)} to use ons-family in tenancy where any {request.operation!=/Create*/, request.operation!=/Update*/, request.operation!=/Delete*/, request.operation!=/Change*/}"
       ]
     },
     (local.announcement_reader_policy_name) = {
diff --git a/release-notes.md b/release-notes.md
index 5745e16c..0aca55c6 100644
--- a/release-notes.md
+++ b/release-notes.md
@@ -1,829 +1,853 @@
-#  April 18, 2024 Release Notes - 2.8.2
-1. [New OBP for Certificate Service Certificate Expiration](#2-8-2-certificate-check)
-1. [OCI CIS Landing Zone Oracle Access Governance Support](#2-8-2-oag-support)
-1. [Updates/Fixes to the Terraform](#2-8-2)
-1. [Updates/Fixes to the CIS Compliance Script](#2-8-2-script-updates)
-
-## <a name="#2-8-2-certificate-check">New OBP for Certificate Service Certificate Expiration</a>
-A new Oracle Best Practice (OBP) check scans certificates stored in the [OCI Certificate Service](https://docs.oracle.com/en-us/iaas/Content/certificates/overview.htm) and finds those that will expire in under 30 days.  This check will help customers prevent unintended outages for OCI Services using certificates stored in the certificate service that expires before causing connectivity errors.
-
-## <a name="#2-8-2-oag-support">OCI CIS Landing Zone Oracle Access Governance Support</a>
-The OCI CIS Landing Zone enables accelerated [Oracle Access Governance (OAG)](https://www.oracle.com/security/cloud-security/access-governance/) deployment.  The policies and groups required for OAG are created and aligned with the OCI CIS Foundations Benchmark.  To deploy OAG using the CIS Landing Zone, review the Oracle Access Governance section under Governance in the [Deployment Guide](./DEPLOYMENT-GUIDE.md).
-
-## <a name="#2-8-2-terraform-updates">Updates/Fixes to the Terraform</a>
-**Fixes**
-- Fixed the issue when deploying the CIS Landing Zone to other [realms](https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm). [Issue 140](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/140)
-
-## <a name="#2-8-2-script-updates">Updates/Fixes to the CIS Compliance Script</a>
-**Updates**
-- Added support to override `https://cloud.oracle.com` in deep link URLs in CSV reports with a customer provided deep link URL using the `--deeplink-url-override` argument.  This provides support for other [realms](https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm).  The following `--deeplink-url-override https://console.us-langley-1.oraclegovcloud.com` will support OC2's Ashburn region.
-- Added new actions attribute to OCI Event records.
-- Added new compliance checking script FAQ item. 
-
-#  March 25, 2024 Release Notes - 2.8.1
-1. [Updates/Fixes to the CIS Compliance Script](#2-8-1-script-updates)
-
-## <a name="#2-8-1-script-updates">Updates/Fixes to the CIS Compliance Script</a>
-**Updates:**
-- Added flag `--report-prefix` to allow unique files for better baseline comparison.
-- Improved performance in querying Identity Domains users’ API keys.
-- Improved Identity Domains checking for federated users by using is_federated flag.
-- Added Deep Link with Identity Domain name to user, group, and dynamic group records.
-- The audit configuration check has been removed because it is no longer in the benchmark.
-- Boot Volume resources were added to the check 6.2 resources in the root compartment.
-
-**Fixes:**
--	Handling KMS keys with date issues.
--	Removed duplication of Identity Groups for Identity Domains.
--	Consistency and commenting updates.
-
-
-#  February 23, 2024 Release Notes - 2.8.0
-1. [Updates for CIS OCI Benchmark 2.0.0](#2-8-0-cis-2-updates)
-1. [Compliance Checker Script Update for Identity Domains](#2-8-0-cis-2-iddomains)
-1. [Updates/Fixes to the CIS Compliance Script](#2-8-0-script-updates)
-1. [Readme Updates](#2-8-0-readme-updates)
-
-
-## <a name="#2-8-0-cis-2-updates">Updates for CIS OCI Benchmark 2.0.0</a>
-On January 4th, 2024 the [CIS Oracle Cloud Infrastructure Foundations Benchmark 2.0.0](https://www.cisecurity.org/benchmark/oracle_cloud) was published.  To align to this new release the compliance checking script has updated the numbering and added the following new checks:
-- Compute checks for secure boot, IMDSv2, and in-transit encryption enabled
-- Logging and Monitoring Check added to ensure there is a notification for Cloud Guard events
-- IAM check for Database Password rotation
-In addition, the CIS OCI Benchmark to CIS Landing Zone Architecture Mapping table and architecture where updated to align to the updated benchmark.
-
-## <a name="#2-8-0-cis-2-iddomains">Compliance Checker Script Update for Identity Domains</a>
-To align with the migration from OCI tenancies to those without Identity Domains to those with Identity Domains.  All IAM checks have been updated to search all Identity Domains in a tenancy.  Checks that were updated are:
-- 1.4   Ensure IAM password policy requires minimum length of 14 or greater
-- 1.5   Ensure IAM password policy expires passwords within 365 days
-- 1.6	Ensure IAM password policy prevents password reuse
-- 1.7   Ensure MFA is enabled for all users with a console password
-- 1.8   Ensure user API keys rotate within 90 days or less
-- 1.9   Ensure user customer secret keys rotate within 90 days or less
-- 1.10  Ensure user auth tokens rotate within 90 days or less
-- 1.11  Ensure user IAM Database Passwords rotate within 90 days
-- 1.12  Ensure API keys are not created for tenancy administrator users
-- 1.13  Ensure all OCI IAM user accounts have a valid and current email address
-- 1.14  Ensure Instance Principal authentication is used for OCI instances, OCI Cloud Databases and OCI Functions to access OCI resources.
-
-## <a name="#2-8-0-script-updates">Updates/Fixes to the CIS Compliance Script</a>
-**Fixes:**
-    - Check *Ensure customer created Customer Managed Key (CMK) is rotated at least annually.* was updated to check current key version instead of key creation date.
-    - Updated checks 1.6, 1.5, 6.2 totals to prevent negative numbers.
-    - Resolved case sensitivity issue relating to policy check for `"PSM-root-policy"`.
-**Updates:**
-    - Added a new item to the FAQ.
-
-## <a name="#2-8-0-readme-updates">Readme Updates</a>
-The README.md was updated to add a click to deploy option for the EU Sovereign regions. Closing [issue 136](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/136)
-
-#   January 5, 2024 Release Notes - 2.7.1
-1. [Links to Deploy in Non-commercial Regions](#2-7-1-deploy-links)
-1. [Terraform Updates](#2-7-1-tf-updates)
-1. [Script Updates](#2-7-1-script-updates)
-
-## <a name="#2-7-1-deploy-links">Links to Deploy in Non-commercial Regions</a>
-Links have been added to [README.md](./README.md) allowing the initiation of Terraform deployments in **non-commercial** regions through OCI Resource Manager service. The existing "Deploy to Oracle Cloud" button is unchanged, initiating deployments to commercial regions only. Use the links when deploying to Gov cloud.
-
-## <a name="2-7-1-tf-updates">Terraform Updates</a>
-**config module**
-* *tenancy_ocid*, *user_ocid* and *region* variables are now hidden in [generic_workload_compartments](./workloads/generic_workload_compartments/) RMS UI.
-* IAM policies have been added to allow OKE clusters deployment with NPN (Native Pod Networking) and split compartment topology (i.e., networking in Network compartment and cluster in AppDev compartment).
-* Tenancy wide audit logs for Service Connector Hub are now collected using "_Audit_Include_Subcompartment" construct instead of explicitly looping through all tenancy compartments. 
-
-**pre-config module**
-* Auditor grants in pre-config module aligned with auditor grants in config module.
-
-## <a name="2-7-1-script-updates">Script Updates</a>
-- Fixes:
-    - Added additional error handling in `__search_resources_in_root_compartment` to resolve [issue 134](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/134).
-
-#   November 17, 2023 Release Notes - 2.7.0
-1. [CIS Compliance Script Gets Network Topology](#2-7-0-script-network-topology)
-1. [CIS Compliance Script Gets All Resources](#2-7-0-script-all-resources)
-1. [Landing Zone Architecture to CIS OCI Benchmark Documentation](#2-7-0-terraform-mapping)
-1. [Terraform Updates](#2-7-0-tf-updates)
-
-## <a name="#2-7-0-script-network-topology">CIS Compliance Script Gets Network Topology</a>
-The CIS compliance Script now queries the [OCI Network Visualizer](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/network_visualizer.htm) to download a text version of the tenancy's network topology in JSON and PKL file format.  This feature is run using the `--obp --raw` flags or the `all-resources` flag. 
-
-## <a name="#2-7-0-script-all-resources">CIS Compliance Script Gets All Resources</a>
-The CIS compliance Script now uses the [Search](https://docs.oracle.com/en-us/iaas/Content/Search/Concepts/queryoverview.htm#Overview_of_Search) service to query all available resources in a tenancy. The data returned is in a JSON file and is limited to resource types supported by Search and the fields for each resource are limited to the additional details available to the Search service.  This feature is run using the `--all-resources` flag.
-
-## <a name="#2-7-0-terraform-mapping">Landing Zone Architecture to CIS OCI Benchmark Documentation</a>
-The [CIS OCI Benchmark to CIS Landing Zone Architecture Mapping](cis-architecture-mapping.md) document details how the OCI CIS Landing Zone configuration aligns with the CIS Benchmark v1.2.
-
-## <a name="2-7-0-tf-updates">Terraform Updates</a>
-**config module**
-* Existing dynamic groups can now be selected in Resource Manager UI.
-* All IAM remote modules have been pinned to version 0.1.7. If you are managing the Landing Zone with terraform CLI, make sure to run *terraform init -upgrade* when adopting this release.
-* **Bug fix**: when extending Landing Zone to another region, groups were being processed and an "invalid index" error generated during *terraform plan*. With this fix, groups are no longer processed when extending the Landing Zone. 
-* **Bug fix**: when running Landing Zone config as a user with limited permissions, service policies were being processed and failing during *terraform apply* due to insufficient permissions. With this fix, service policies are no longer processed when running config as a user with limited permissions.
-
-**pre-config module**
-* Storage admin group has been added.
-* Existing provisioning group can now be selected in Resource Manager UI.
-* Policies for dynamic groups have been removed, as they can be managed in the config module.
-* Ability to use existing dynamic groups has been removed, as the feature is already present in the config module.
-* *deploy_dynamic_groups* variable added, set to true by default. If reusing existing dynamic groups is needed, set this variable to false and select the existing dynamic groups in the config module.
-
-#   October 6, 2023 Release Notes - 2.6.5
-1. [CIS Compliance Script Updates](#2-6-5-script-updates)
-1. [Terraform Quick Start Updates](#2-6-5-quickstart-updates)
-1. [Terraform Workloads Updates](#2-6-5-workload-updates)
-
-## <a name="2-6-5-script-updates">Updates to the CIS Compliance Script</a>
-Updates:
-    - Added debugging Identity Groups collection
-
-## <a name="2-6-5-quickstart-updates">Terraform Quick Start Updates</a>
-Updates:
-- Compartments management has been pinned to Compartments module v0.1.6.
-
-## <a name="2-6-5-workload-updates">Terraform Quick Start Updates</a>
-Updates:
-    - Generic Workloads outputs compartments created
-Fixes:
-- Dynamic Group AppDev
-
-#   September 18, 2023 Release Notes - 2.6.4
-1. [CIS Compliance Script Adds Identity Domains](#2-6-4-identity-domains)
-1. [Updates to the CIS Compliance Script](#2-6-4-script-updates)
-1. [Workload Expansion Terraform for Quick Start](#2-6-4-workload-updates)
-
-## <a name="2-6-4-identity-domains">CIS Compliance Script Adds Identity Domains</a>
-CIS compliance checking scripts adds collection of Identity Domains password policy.  This allows the compliance checking script to access CIS recommendation 1.5 Ensure IAM password policy expires passwords within 365 days and recommendation 1.6 Ensure IAM password policy prevents password reuse.
-
-## <a name="2-6-4-script-updates">Updates to the CIS Compliance Script</a>
-- Updates:
-    - Improved navigation for CIS Summary Report HTML
-    - Added `error_report.csv` for errors when collection OCI resources
-- Fixes:
-    - Improved OCI logging error handling
-    - Fixed compliance for Storage Admin policies for CIS recommendation 1.14 Ensure storage service-level admins cannot delete resources they manage
-
-## <a name="2-6-4-workload-updates">Workload Expansion Terraform for Quick Start</a>
-The terraform code in this folder expands an existing CIS Landing Zone deployment.  It does this by adding one or more workload compartment(s) in the AppDev compartment and, optionally, the associated OCI IAM groups, dynamic groups, and OCI IAM policies to manage OCI resources in the workload compartment. For more information please see the [readme.md](./workloads/generic_workload_compartments/readme.md)
-
-#   September 4, 2023 Release Notes - 2.6.3
-1. [Fixes to the CIS Compliance Script](#2-6-3-script-fixes)
-1. [Updates to the CIS Compliance Script](#2-6-3-script-updates)
-1. [Updates to Terraform Template](#2-6-3-terraform-updates)
-
-## <a name="2-6-3-script-fixes">Fixes to the CIS Compliance Script</a>
-Fixes:
-- Index of out range exception in obp checks for subnets and buckets in some exceptional cases.
-- No budget returned if script executed from non-home region in Cloud Shell. Budgets are now returned in all cases.
-
-## <a name="2-6-3-script-updates">Updates to the CIS Compliance Script</a>
-Updates:
-- Event types added to remediation in HTML report for check 3.13.
-- All OCI groups are now returned in raw output, including groups with no users.
-- Databases in "UNAVAILABLE" state are no longer returned in check 2.8.
-
-## <a name="2-6-3-terraform-updates">Updates to Terraform Template</a>
-Updates:
-- Existing groups can now have spaces in their names. Useful when referring to synchronized groups from external identity providers, where spaces are allowed in group names.
-- Variables for existing groups (*existing_xxxxx_admin_group_name*) can be assigned multiple groups. Feature only available through Terraform CLI. Not available in OCI Resource Manager.
-- *network_admin_email_endpoints* and *security_admin_email_endpoints* variables now enforce non-emptiness in Terrafom CLI.
-
-#   August 8, 2023 Release Notes - 2.6.2
-1. [Fixes to the CIS Compliance Script](#2-6-2-script-fixes)
-1. [Updates to the CIS Compliance Script](#2-6-2-script-updates)
-1. [Updates to the Readme](#2-6-2-readme-updates)
-
-
-## <a name="2-6-2-script-updates">Updates to the CIS Compliance Script</a>
-Updates:
-- Added Service Connector Hub ID and Name to OBP Best practices for VCN Flow Logs and Object Storage Buckets
-- Alert users when the cis_reports.py is not run in home region which can impact budgets collection
-
-## <a name="2-6-2-script-fixes">Fixes to the CIS Compliance Script</a>
-Fixes: 
-- Updated CIS 2.8 check updated to exclude ADB-S that are in a VCN but not attached to Network Security Group.  Closes issue [#105](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/105)
-- Cleaned up 1900+ Flake8 
-
-## <a name="2-6-2-readme-updates">Updates to the Readme</a>
-Updates:
-- Removed team section
-- Added the CIS Terraform Modules Section
-
-
-#   July 26, 2023 Release Notes - 2.6.1
-1. [Updates to Terraform Template](#2-6-1-tf-updates)
-1. [Documentation Updates](#2-6-1-doc-updates)
-1. [Fixes to the CIS Compliance Script](#2-6-1-script-fixes)
-
-## <a name="2-6-1-tf-updates">Updates to Terraform Template</a>
-Fixes:
-- Fixed a defect where missing exainfra admin group name in grants was causing policies creation to fail.
-
-Updates:
-- Set Terraform version upper bound to *< 1.3.0* in [provider.tf](./config/provider.tf).
-
-## <a name="2-6-1-doc-updates">Documentation Updates</a>
-Updates:
-- Added link to CIS Landing Zone Quick Start Live Lab in [README.md](./README.md).
-
-## <a name="2-6-1-script-fixes">Fixes to the CIS Compliance Script</a>
-Fixes:
-- CIS check 2.8 now skips autonomous database in the UNAVAILABLE state
-
-#   July 14, 2023 Release Notes - 2.6.0
-1. [Updates to Terraform Template](#2-6-0-tf-updates)
-
-## <a name="2-6-0-tf-updates">Updates to Terraform Template</a>
-Updates:
-- IAM resources, including compartments, groups, dynamic groups and policies are now managed with new remote modules, available in https://github.com/oracle-quickstart/terraform-oci-cis-landing-zone-iam. The old local IAM modules are still kept in this repository.
-- IAM policies can now be created based on metadata associated to compartments. This is an alternative way of managing policies, enabled by the [new IAM policy module](https://github.com/oracle-quickstart/terraform-oci-cis-landing-zone-iam/tree/main/policies). In this approach, the grants to resources belonging to a specific compartment are combined into a single policy that is attached to the compartment itself. This differs from the existing approach, where grants are combined per grantee and attached to the enclosing compartment. This alternative way is enabled by **Enable template policies?** checkbox (if using OCI Resource Manager) or by the **enable_template_policies** variable (if using Terraform CLI). The existing approach of deploying policies remains the default.
-- Some policy grants have been updated, allowing admin groups to manage keys in their own compartments using the OCI Vault in the Security Compartment and deploy private endpoints in Network compartment. Additionally, some grants have been consolidated into a single grant with a comma-separated list of group principals. Service policies have been consolidated into a single policy with the new name *${var.service_label}-services-policy*.
-- Deploying with an enclosing compartment becomes the default. Users who deploy without an enclosing compartment should unset **Use an enclosing compartment?** checkbox (if using OCI Resource Manager) or set **use_enclosing_compartment** variable to false (if using Terraform CLI).
-- Quick Start release number added to cis-landing-zone freeform tag.
-- Application Information tab is now enabled in OCI Resource Manager, displaying basic information about the stack and outputs of latest Terraform apply.
-
-
-#   June 29, 2023 Release Notes - 2.5.12
-1. [Fixes to the CIS Compliance Script](#2-5-12-script-fixes)
-
-## <a name="2-5-12-script-fixes">Fixes to the CIS Compliance Script</a>
-Fixes:
-- Fixed a logic issue for Security Lists and Network Security Groups with source ports but no destination ports
-- Removed Deeplink from Exception handling when reading object storage buckets
-- OBP check for budgets now verifies that there is budget with an alert for the root compartment
-
-
-#   June 20, 2023 Release Notes - 2.5.11
-1. [Performance update to the CIS Compliance Script](#2-5-11-script-performance)
-1. [Summary Data update to the CIS Compliance Script](#2-5-11-script-updates)
-1. [Fixes to the CIS Compliance Script](#2-5-11-script-fixes)
-
-## <a name="2-5-11-script-performance">Performance update to the CIS Compliance Script</a>
-Migrate the querying of resources to Resource Search (a module within Oracle’s API).  By using Resource Search, compartment iterations for listing items are ignored.  For items that require more detailed information than Resource Search returns, only those compartments are queried.  This migration reduces script execution time by 8 times.
-
-## <a name="#2-5-11-script-updates">Updates to the CIS Compliance Script</a>
-The CIS Summary report CSV adds two new columns **Compliant Items**, which represents the number of resources that are aligned to that recommendation, and **Total** which is the total number of that resource in tenancy. The **Total** column is also in the screen output.
-
-## <a name="#2-5-11-script-fixes">Fixes to the CIS Compliance Script</a>
-Fixes
-- Updated the CIS checks 2.1, 2,2, 2.3, and 2.4 to detect Security Lists and Networks Security Groups that allow egress access to ports 22 or 3389 via allowing all protocols, all ports, or using port ranges.
-- Updated CIS Check 2.5 to only look at Default Security Lists.
-
-
-#   May 12, 2023 Release Notes - 2.5.10
-1. [Support for Security Tokens in the CIS Compliance Script](#2-5-10-script-updates)
-1. [Terraform Template Updates](#2-5-9-tf-updates)
-
-## <a name="2-5-10-script-updates">Support for Security Tokens in the CIS Compliance Script</a>
-New:
-- Added support of Security Tokens for script authentication courtesy of Dave Knot ([dns-prefetch](https://github.com/dns-prefetch)).  For usage example, go to the [compliance-script.md](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/compliance-script.md) and review the **Executing on a local machine via Security Token (oci session authenticate)** example. For more information on security tokens: [https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/clitoken.htm](https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/clitoken.htm)
-
-## <a name="2-5-10-tf-updates">Terraform Template Updates</a>
-Fixes:
-- Security rule added for ICMP in Exadata CS security lists, allowing for the initiation of ICMP requests to hosts in the VCN. Changes in [net_exacs_vcns.tf](./config/net_exacs_vcns.tf).
-- VSS targets are now created when the Landing Zone is extended to a new region. Changes in [vss.tf](./config/vss.tf).
-
-#   April 26, 2023 Release Notes - 2.5.9
-1. [Terraform Template Updates](#2-5-9-tf-updates)
-
-## <a name="2-5-9-tf-updates">Terraform Template Updates</a>
-Updates:
-- Security Zone is enabled only if an enclosing compartment is used. Changes in [security_zones.tf](./config/security_zones.tf).
-- Network event types updated for local peering gateway and service gateway: only event types ending with ".end" are captured. Changes in [mon_notifications.tf](./config/mon_notifications.tf).
-
-#   April 17, 2023 Release Notes - 2.5.8
-1. [Compliance Checking Script Updates](#2-5-8-script-updates)
-1. [Terraform Template Updates](#2-5-8-tf-updates)
-
-## <a name="2-5-8-script-updates">CIS Compliance Script Updates</a>
-Updates:
-- Updated CIS rule 1.7 to exclude OCI IAM Local Users that are service accounts.  A service account is a OCI IAM Local user that does not have *Local Password* as a *User Capabilities.*  
-- Support validated on OCI SDK 2.97.0.
-Fixes:
-- Improved error handling for Event Rules with no conditions.
-
-## <a name="2-5-8-tf-updates">Terraform Template Updates</a>
-- Compartment level service policies no longer created when extending Landing Zone to new region.
-- VSS and Vault resources now dependent on service policies. 
-
-#   April 04, 2023 Release Notes - 2.5.7
-1. [Exadata Events Fix](#2-5-7-exadata-events-fix)
-1. [Compliance Checking Script Updates](#2-5-7-script-updates)
-
-## <a name="2-5-7-exadata-events-fix">Exadata Events Fix</a>
-- Exadata events handled with jsonencode function in [mon_notifications.tf](./config/mon_notifications.tf).
-
-## <a name="2-5-7-script-updates">CIS Compliance Script Updates</a>
-Updates:
-- Added optionality to the NSG deep_link incase the link is less than 254 characters.
-- Updated Release version and date.
-
-Fixes:
-- Fixed console output formatting for CIS Summary report.
-
-
-
-#   March 24, 2023 Release Notes - 2.5.6
-1. [Compliance Checking Script Updates](#2-5-6-script-updates)
-
-## <a name="2-5-6-script-updates">CIS Compliance Script Updates</a>
-Updates:
-- Added egress rules to Security Lists and Network Security Groups.
-- Added DRG Upgrade status as *Upgrade_status* to the `raw_data_network_drgs.csv` file.
-
-Fixes:
-- For CIS Recommendations 1.5 and 1.6 now show *Not Applicable* instead of *Yes* or *No* as this is not yet checked by the script.
-- Removed filenames for findings with zero findings from the `cis_summary_report.csv` and `cis_html_summary_report.html` reports.
-
-#   March 2, 2023 Release Notes - 2.5.5
-1. [OCI IAM Policy Fix for Database Admin Group](#2-5-5-adb-policy-fix)
-1. [OCI IAM Service Policy Update](#2-5-5-oci-iam-service-policy)
-1. [Enhanced HTML CIS Summary Report](#2-5-5-html-cis-summary)
-1. [Compliance Checking Script Updates](#2-5-5-script-updates)
-
-
-## <a name="2-5-5-adb-policy-fix">OCI IAM Policy Fix for Database Admin Group</a>
-Updated OCI IAM policies attached to the Database Admin Group to support deploying ADBs in private subnets. Policy is based on documentation [here](https://docs.oracle.com/en-us/iaas/autonomous-database-shared/doc/iam-private-endpoint-configure-policies.html).
-
-## <a name="2-5-5-oci-iam-service-policy">OCI IAM Service Policy Update</a>
-Added an OCI IAM policy to allow OCI services File Storage Service, Object Storage Service, Oracle Kubernetes Engine, Streaming and Block Storage to encrypt data using keys in the OCI Vault in the Security Compartment. 
-
-## <a name="2-5-5-html-cis-summary">Enhanced HTML CIS Summary Report</a>
-The HTML CIS Summary report from the CIS compliance checking script has a significantly updated look and feel.
-
-## <a name="2-5-5-script-updates">CIS Compliance Script Updates</a>
-- The CIS compliance checking script has added user capabilities to OCI IAM user collection.  These attributes are only available in the `raw_data_identity_users.csv` file.
-- Enhanced exception handling for Oracle Best Practice checks.
-
-
-#   February 10, 2023 Release Notes - 2.5.4
-1. [Improved CIS 3.7 and 3.13 Checks](#2-5-4-cis-logic)
-
-## <a name="2-5-4-cis-logic">Improved CIS 3.7 and 3.13 Checks</a>
-The CIS Compliance checking script checks for Logging and Monitoring 3.7: *Ensure a notification is configured for IAM policy changes* and Logging and Monitoring 3.13: *Ensure a notification is configured for changes to route tables* has been improved to reduce false positives.
-
-#   February 1, 2023 Release Notes - 2.5.3
-1. [HTML CIS Summary Report](#2-5-3-script-html)
-1. [Resource Deep Links in CSV](#2-5-3-deep-link)
-1. [Improved CIS IAM 1.1 Check](#2-5-3-cis-logic)
-
-## <a name="2-5-3-script-html">HTML CIS Summary Report</a>
-The CIS Compliance checking script now outputs an HTML summary report.  The summary report includes additional information from the [CIS OCI Benchmark v1.2](https://www.cisecurity.org/benchmark/oracle_cloud) plus a link to the finding's CSV file.
-
-## <a name="2-5-3-deep-link">Resource Deep Links in CSV</a>
-The CIS Compliance checking script CSV reports have a new field `deep_link` which contains a clickable link to the resource in the OCI Console. 
-
-## <a name="2-5-3-cis-logic">Improved CIS IAM 1.1 Check</a>
-The CIS Compliance checking script check for Identity and Access Management 1.1: *Ensure service level admins are created to manage resources of particular service* has been improved to reduce false positives. 
-
-#  January 26, 2023 Release Notes - 2.5.2
-1. [Service Connector Hub Improvements](#2-5-2-sch-improvements)
-1. [CIS Level Setting Updates](#2-5-2-cis-level)
-
-## <a name="2-5-2-sch-improvements">Service Connector Hub Improvements</a>
-Service Connector Hub functionality has been improved with the following:
-- Audit logs from all tenancy compartments are now captured.
-- Support for Logging Analytics as target. With this update, the following targets are supported: Object Storage, Streaming, Functions and Logging Analytics.
-
-## <a name="2-5-2-cis-level">CIS Level Setting Updates</a>
-Following updates were made regarding the CIS Level setting (*cis_level* variable):
-- Setting *cis_level* variable to "2" is enough for OCI Vault creation. Previously, the OCI Vault creation would also require a bucket and no provided existing vault.
-- Write logs for buckets are only created if *cis_level* variable is set to "2". Previously, bucket write logs were not impacted by CIS Level setting.
-
-
-#  December 16, 2022 Release Notes - 2.5.1
-1. [CIS Compliance Script fixes](#2-5-1-script-update)
-1. [Improved Terraform Windows Support](#2-5-1-terraform-windows)
-
-## <a name="2-5-1-script-update">CIS Compliance Script fixes</a>
-The CIS Compliance Checking script [.cis_reports.py](./scripts/cis_reports.py) has had the following fixes:
-- Fixed consolidated xlsx file generation on Windows command line and Powershell.
-- Converted from positional arguments in OCI API calls to named arguments.
-
-## <a name="2-5-1-terraform-windows">Improved Terraform Windows Support</a>
-Fixed support for deploying terraform via Windows. Closes [Issue](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/61).
-
-#  December 05, 2022 Release Notes - 2.5.0
-1. [OCI Best Practices Checks Added to CIS Compliance Script](#2-5-0-script-update)
-1. [Cloud Guard Improvements](#2-5-0-cloud-guard-improvements)
-
-## <a name="2-5-0-script-update">OCI Best Practices Checks Added to CIS Compliance Script</a>
-The CIS Compliance Checking script [.cis_reports.py](./scripts/cis_reports.py) has had the following enhancements:
-- CIS compliance checking script has added checking for OCI Best Practices (OBP).  The following OCI Best Practices in your tenancy:
-    - Aggregation of OCI Audit compartment logs, Network Flow logs, and Object Storage logs are sent to Service Connector Hub in all regions
-    - A Budget for cost track is created in your tenancy
-    - Network connectivity to on-premises is redundant 
-    - Cloud Guard is configured at the root compartment with detectors and responders 
-    
-- Redaction of OCIDs before data is written to CSVs using the `--redact` flag.  This uses a sha256 hashes of OCID to maintain OCID consistency across files.
-- Reduced script runtime by synchronously reading OCI resources.
-- CSV files will be consolidated into a single XLSX file if the python3 environment has `xlsxwriter` installed.  
-
-See [compliance-script.md](./compliance-script.md#usage) for usage.
-
-## <a name="2-5-0-cloud-guard-improvements">Cloud Guard Improvements</a>
-Cloud Guard module has been updated with the following features:
-- Cloud Guard resources creation made optional, based on *enable_cloud_guard* input variable. Cloud Guard is enabled by default.
-- Support for cloned detector and responder recipes, based on *enable_cloud_guard_cloned_recipes* input variable. By default, for keeping backwards compatibility, the module uses Oracle managed recipes.
-- Support for customer provided reporting region. If reporting region is not provided, the module defaults to home region.
-- Resource Manager user interface reflects above changes.
-
-See [Cloud Guard variables](./VARIABLES.md#cloud-guard-variables) for details.
-
-#  October 28, 2022 Release Notes - 2.4.3
-## Bug Fixes
-- Arch Center tag module conditioned to Landing Zone not being extended. Fix in [mon_tags.tf](./config/mon_tags.tf).
-- CIS Compliance checking script was looking for attributes not available in list analytics and list integrations instances API calls. 
-#  October 14, 2022 Release Notes - 2.4.2
-1. [Compliance Checking Supports Custom OCI Config File Location](#2-4-2-script-config-file)
-1. [Custom Security Zone policies support for all OCI realms](#2-4-2-sz-all-realms)
-1. [Bug fixes](#2-4-2-bug-fixes)
-
-## <a name="2-4-2-script-config-file">Compliance Checking Supports Custom OCI Config File Location</a>
-The Compliance checking script adds a new flag `-c` that takes the location of an OCI config file. This flag allows users to specify which OCI config file to use instead of using the one in the default location (`~/.oci/config`).
-
-## <a name="2-4-2-sz-all-realms">Custom Security Zone policies support for all OCI realms</a>
-Custom Security Zone policies are now supported by CIS Landing Zone in all OCI realms where Custom Security Zones are available.
-
-## <a name="2-4-2-bug-fixes">Bug Fixes</a>
-- Incorrect *backups* resource-type replaced by *db-backups* for database admin grants in [iam_policies.tf](./config/iam_policies.tf).
-- Event types fixed for Exadata Cloud Service in [mon_notifications.tf](./config/mon_notifications.tf).
-
-# September 16, 2022 Release Notes - 2.4.1
-1. [Compliance Checking Report Identity Domain Fix](#2-4-1-script-fix)
-
-## <a name="2-4-1-script-fix">Compliance Checking Report Identity Domain Fix</a>
-Until this update, a user in the CIS Landing Zone Auditor group would not have been able to successfully run the compliance checking script in tenancies with Identity Domains.  The reason is tenancies with Identity Domains require elevated privileges to check the tenancies password policy.  With release 2.4.1 if the user doesn't have permissions to check password policy the script will continue running and just print an alert.
-
-# September 09, 2022 Release Notes - 2.4.0
-1. [Terraform Requirements](#2-4-0-tf-reqs)
-1. [CIS OCI Benchmark Configuration Profiles](#2-4-0-cis-level)
-1. [Custom Security Zones](#2-4-0-csz)
-1. [Service Connector Hub Improved Configuration](#2-4-0-sch-update)
-1. [Vulnerability Scanning Improved Configuration](#2-4-0-vss-update)
-1. [Application Bucket Improved Configuration](#2-4-0-appdev-bucket-update)
-1. [Data Safe Permissions](#2-4-0-datasafe-perms)
-
-## <a name="2-4-0-tf-reqs">Terraform Requirements</a>
-**The Terraform features in this release and future releases of the CIS Landing Zone will require Terraform binary 1.1.0 or higher**, where the *moved* block feature is available. The *moved* block provides a transparent way for preserving backwards compatibility in face of required code changes. We have consolidated all *moved* blocks in [moved.tf](./config/moved.tf). For details on this feature, please see: [Terraform's documentation on refactoring](https://www.terraform.io/language/modules/develop/refactoring).
-
-## <a name="2-4-0-cis-level">CIS OCI Benchmark Configuration Profiles</a>
-CIS Landing Zone introduces the ability to choose the CIS OCI configuration profile defined in the Benchmark. 
-
-When deploying CIS Landing Zone, users can now specify the CIS configuration profile level using the variable *cis_level* and it defines the configuration of some Landing Zone managed resources. For this release, the affected resources are Object Storage Buckets and Security Zones. The *cis_level* setting drives how buckets are encrypted and the minimum set of policies in a Security Zone.
-
-## <a name="2-4-0-csz">Security Zones</a>
-CIS Landing Zone adds to the overall tenancy security posture with the support for [Security Zones](https://docs.oracle.com/en-us/iaas/security-zone/using/security-zones.htm). Landing Zone users can now enable Security Zones for Landing Zone managed compartments and specify which policies to apply. These policies are the preventive controls that make sure a tenancy stays within the defined track as it evolves over time.  
-
-Aligning with the [CIS OCI Benchmark Configuration Profile](#2-4-0-cis-level) feature, if *cis_level* is set to 1, the provided Security Zone policies are aligned to the CIS OCI Benchmark configuration profile Level 1. If *cis_level* is set to 2, the provided Security Zone policies are aligned to the CIS OCI Benchmark configuration profile Level 2. Below are the Security Zone policies to configuration profile level.
-
-| CIS Recommendation | CIS Level | Security Zone Policy Name               | Security Zone Policy Description                                                                                                                                               |
-| ------------------ | --------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| 4.1.1              | 1         | deny public\_buckets                    | Object Storage buckets in a security zone can't be public.                                                                                                                     |
-| 2.8.0              | 1         | deny db\_instance\_public\_access       | Databases in a security zone can't be assigned to public subnets. They must use private subnets.                                                                               |
-| 4.2.1              | 2         | deny block\_volume\_without\_vault\_key | Block volumes in a security zone must use a customer-managed master encryption key in the Vault service. They can't use the default encryption key managed by Oracle.          |
-| 4.2.2              | 2         | deny boot\_volume\_without\_vault\_key  | Boot volumes in a security zone must use a customer-managed master encryption key in the Vault service. They can't use the default encryption key managed by Oracle.           |
-| 4.1.2              | 2         | deny buckets\_without\_vault\_key       | Object Storage buckets in a security zone must use a customer-managed master encryption key in the Vault service. They can't use the default encryption key managed by Oracle. |
-| 4.3.1              | 2         | deny file\_system\_without\_vault\_key  | File systems in the security zone must use a customer-managed master encryption key in the Vault service. They can't use the default encryption key managed by Oracle.         |
-
-## <a name="2-4-0-sch-update">Service Connector Hub Improved Configuration</a>
-The [Service Connector Hub module](./config/mon_service_connector.tf) as announced in [Updated Logging Architecture](#2-3-6-updated-logging) has been updated to optionally deploy Service Connector Hub related resources. As a result, existing users need to set *enable_service_connector* and *activate_service_connector* variables to *true* for Service Connector Hub resources to be created and to activate the service. For details, look at *enable_service_connector* and *activate_service_connector* variables in [VARIABLES.md](./VARIABLES.md#logging_variables).
-
-When deploying an Object Storage bucket as Service Connector target, users can now bring an existing key for bucket encryption. For details, look at *existing_service_connector_bucket_vault_compartment_id*, *existing_service_connector_bucket_vault_id* and *existing_service_connector_bucket_key_id* variables in [VARIABLES.md](./VARIABLES.md#logging_variables). Aligning with the [CIS Profile Levels](#2-4-0-cis-level) feature, if *cis_level* is set to 1, the bucket is encrypted with an Oracle-managed key; if *cis_level* is set to 2, a customer-managed key (either provided or managed by Landing Zone) is used for bucket encryption.
-
-## <a name="2-4-0-vss-update">Vulnerability Scanning Improved Configuration</a>
-Users have more control on Landing Zone Vulnerability Scanning recipes. It is now possible to specify the levels for port scan, agent-based scan and CIS setting for agent-based scans. Additionally, users can enable file scanning for Linux systems and specify the folders to scan. Variables are described in [VARIABLES.md](./VARIABLES.md#vss_variables).
-
-Vulnerability Scanning is now disabled by default in CIS Landing Zone. Moving forward, the intent is enabling by default only those services that are required by CIS Benchmark. Existing users who are managing Vulnerability Scanning resources with Landing Zone should simply enable it back, by setting *vss_create* variable to true.
-
-A bug preventing Vulnerability Scanning target creation in default enclosing compartment has been fixed.
-
-## <a name="2-4-0-appdev-bucket-update">Application Bucket Improved Configuration</a>
-Previous to this release, CIS Landing Zone would manage a sample bucket in the Application compartment (a.k.a AppDev) and encrypt it with a customer-managed key. This has changed. Now the bucket creation is optional, and when deployed, the user has a choice to bring an existing key for encryption. Aligning with the [CIS Profile Levels](#2-4-0-cis-level) feature, if *cis_level* is set to 1, the bucket is encrypted with an Oracle-managed key; if *cis_level* is set to 2, a customer-managed key (either provided or managed by Landing Zone) is used for bucket encryption.
-
-## <a name="2-4-0-datasafe-perms">Data Safe Permissions</a>
-In the config directory, management permission for the Data Safe family has been added to the Database Administrators and Exadata Infrastructure Administrators groups. Read permission for the Data Safe family has been added to the Auditors group.
-
-In the pre-config directory, read permission for the Data Safe family has been added to the Database Administrators and Auditors groups.
-
-##
-
-# July 11, 2022 Release Notes - 2.3.6
-1. [Cloud Guard Events](#2-3-6-cg-events)
-1. [Updated Logging Architecture](#2-3-6-updated-logging)
-1. [Terraform OCI Provider Moved to oracle/oci](#2-3-6-provider-switch)
-1. [Architecture Center Tag](#2-3-6-arch-center-tag)
-1. [CIS Compliance Checking Script Update](#2-3-6-cis-script-update)
-
-## <a name="2-3-6-cg-events">Cloud Guard Events</a>
-Cloud Guard events have been added to Landing Zone notifications framework. Now users can be notified about Cloud Guard problems that exceeds a user provided criticality threshold.  To support this two new variables have been added to the Cloud Guard Section: `cloud_guard_risk_level_threshold` and `cloud_guard_admin_email_endpoints`. The risk_level_threshold determines what problems will trigger the event rule and send an email to the subscription in the new topic. A level of 'High' will include any problems with a risk level of High or above. This would include High and Critical problems. The event rule looks at any of the 3 Cloud Guard events: Problem Detected, Problem Dismissed and Problem Remediated.
-
-## <a name="2-3-6-updated-logging">Updated Logging Architecture</a>
-The [Service Connector Hub module](./config/mon_service_connector.tf) has been updated to align with the [best practice architecture for third-party SIEM tools](https://github.com/oracle-quickstart/oci-arch-logging-splunk).
-Now there is a single Landing Zone Service Connector that ingests three log sources (Audit logs, VCN flow logs and Object Storage logs) into a target resource of choice: Object Storage Bucket, Stream or Function.
-Landing Zone creates the Bucket and can either create the Stream or use an existing one. If a Function is the target, it must be provided as an input.
-
-## <a name="2-3-6-provider-switch">Terraform OCI Provider Moved to oracle/oci</a>
-Landing Zone has been updated with the new home for Terraform OCI provider. It has moved to oracle/oci from hashicorp/oci. 
-- Existing Landing Zone customers who use Terraform CLI are required to replace the provider in the state file. To update the state file, run the command below in the folder where the state file is present:
-
-        > terraform state replace-provider hashicorp/oci oracle/oci
-
-- Existing Landing Zone customers who use OCI Resource Manager do not need to do anything, as Resource Manager will update the state file based on the new Landing Zone configuration. 
-
-As part of this move, we have introduced provider requirements expressed in [provider.tf](./config/provider.tf):
-- Terraform required version >= 1.0.0
-- OCI provider version >= 4.78.0
-
-## <a name="2-3-6-arch-center-tag">Architecture Center Tag</a>
-A [defined tag](./config/mon_tags.tf) to track Landing Zone deployments through [OCI Architecture Center](https://docs.oracle.com/solutions/) has been added.
-
-## <a name="2-3-6-cis-script-update">CIS Compliance Checking Script Update</a>
-The CIS Compliance checking script now consolidates regional output.  There is a single directory which contains the summary report and findings reports in a directory, the name includes the tenancy name and datetime ex. `<tenancy-name>-2022-MM-DD_HH-MM/`.  The findings CSV in that directory now have a region column to tell you which region the resource is located. 
-
-In addition two new flags have been added:
-- `--region` - pass an OCI region name(s) ex. `--region us-ashburn-1,eu-frankfurt-1` and the script will check that region's resources for CIS compliance 
-- `--raw` - will output all OCI resource data collected into CSV files with the OCI Service name 
-
-For more details on these flags [compliance-script.md](./compliance-script.md)
-
-# June 13, 2022 Release Notes - Stable 2.3.5
-1. [CIS Compliance Checking Script 1.2 update](#2-3-5-script-update)
-1. [CIS 1.2 OCI IAM Policy Updates and Storage Admin](#2-3-5-storage_admin)
-1. [Connectivity Section Usability Improvements in Resource Manager](#2-3-5-conn_usage)
-1. [Removed Public RDP Access](#2-3-5-rdp-public-removal)
-
-
-## <a name="2-3-5-script-update">CIS Compliance Checking Script 1.2 update</a>
-The CIS reports script ([cis_reports.py](./scripts/cis_reports.py)) has been updated to check a tenancy’s compliance with the [CIS OCI Foundations Benchmark 1.2.0]( https://www.cisecurity.org/benchmark/oracle_cloud).  In addition to the new compliance checks, we have streamlined the checks in non-home regions to exclude the IAM since it is redundant.  We also added a new flag `--level` which allows you to run all the CIS OCI Foundations Benchmark 1.2 checks or only those checks associated with Level 1.  The [documentation](./compliance-script.md) for the CIS reports script has been updated to reflect this release.
-
-You can learn about what was added to version 1.2 of the benchmark [here](https://www.ateam-oracle.com/post/the-center-for-internet-security-oracle-cloud-infrastructure-foundations-benchmark-12-release-update). 
-
-
-## <a name="2-3-5-storage_admin">CIS 1.2 OCI IAM Policy Updates and Storage Admin</a>
-We have introduced a group for storage management, entitled to delete OCI storage resources across Landing Zone compartments. The feature implements the recommendation 1.14 of CIS OCI Foundations Benchmark v1.2.0 that states *Ensure storage service-level admins cannot delete resources they manage*, ensuring segregation of duties from service-level administrators, who cannot delete resources they are managing.
-
-Our recommendation for using this group is to place users in it when they must delete an OCI storage resource and then remove their access once that resource is deleted.
-
-In addition we reviewed our policy for consistency.
-
-## <a name="2-3-5-conn_usage">Connectivity Section Usability Improvements</a>
-The *Connectivity* variables group in [schema.yml](./config/schema.yml) for OCI Resource Manager UI have been split for improved usability. Now we have separate sections for Hub/Spoke, Public Connectivity, Connectivity to on-premises and DRG. Some section titles and variables descriptions have also been updated.
-
-## <a name="2-3-5-rdp-public-removal">Removed Public RDP Access</a>
-We no longer grant RDP access to the bastion NSGs for `public_src_bastion_cidrs` CIDR addresses thus preventing public access to RDP.
-
-# May 11, 2022 Release Notes - Stable 2.3.4
-1. [Configurable Cloud Guard Alerting](#cg_alerting)
-1. [Advanced Options Check Preservation in Resource Manager](#orm_adv_options)
-1. [Notification Endpoints not Required by CIS Not Shown By Default](#hidden_endpoints)
-1. [ExaCS VCN Route Table Fix](#exacs_vcn_rt_fix)
-
-## <a name="cg_alerting">Configurable Cloud Guard Alerting based on Problem Risk Level</a>
-Cloud Guard Alerting can optionally be configured by the Landing Zone. Two new variables have been added to the Cloud Guard Section: cloud_guard_risk_level_threshold and cloud_guard_admin_email_endpoints. A new topic and new Event rule will be created only if a valid Email Endpoint is provided. The risk_level_threshold determines what problems will trigger the event rule and send an email to the subscription in the new topic. A level of 'High' will include any problems with a risk level of High or above. This would include High and Critical problems. The event rule looks at any of the 3 Cloud Guard events: Problem Detected, Problem Dismissed and Problem Remediated.
-
-## <a name="orm_adv_options">Advanced Options Check Preservation for Resource Manager</a>
-CIS Landing Zone interface for Resource Manager has check boxes allowing for advanced input options, hiding or showing groups of variables. The state of these options used to be reset when users needed to update the variables in the UI, hiding options chosen previously. Now the state is saved and no longer reset. Changes made in [config/variables.tf](./config/variables.tf).
-
-## <a name="hidden_endpoints">Notification Endpoints not Required by CIS Not Displayed By Default</a>
-Except for Security and Network notifications, all other endpoints are no longer displayed by default in [config/schema.yml](./config/schema.yml) for OCI Resource Manager. A new _Additional Notification Endpoints_ check box displays them when checked. 
-
-## <a name="exacs_vcn_rt_fix">ExaCS VCN Route Table Fix</a>
-A fix in the [route table of the Client subnet](./config/net_exacs_vcns.tf) allows for proper on-premises routing with or without a DMZ VCN. If a DMZ VCN is deployed, traffic to an on-premises IP address goes through the VCN. Otherwise, traffic goes to on-premises directly through the DRG.
-
-# April 6, 2022 Release Notes - Stable 2.3.3
-1. [Cloud Guard Updates](#cg_updates)
-1. [VSS Policy Update](#vss_update)
-1. [Code Examples Aligned with Deployment Guide](#code_examples)
-
-## <a name="cg_updates">Cloud Guard Updates</a>
-- [Cloud Guard policy](./config/iam_service_policies.tf) has been simplified with *Allow service cloudguard to read all-resources in tenancy*. This way no policy changes are needed as new services are integrated with Cloud Guard.
-- [Cloud Guard enablement](./config/mon_cloud_guard.tf) and [target creation logic](./modules/monitoring/cloud-guard/main.tf) have been updated, but still based on *cloud_guard_configuration_status* variable. When the variable is set to 'ENABLE', Cloud Guard is enabled and a target is created for the Root compartment. **Customers need to make sure there is no pre-existing Cloud Guard target for the Root compartment or target creation will fail**. If there is a **pre-existing** Cloud Guard target for the Root compartment, set the variable to 'DISABLE'. In this case, any **pre-existing** Cloud Guard Root target is left intact. However, keep in mind that once you set the variable to 'ENABLE', Cloud Guard Root target becomes managed by Landing Zone. If later on you switch to 'DISABLE', Cloud Guard remains enabled but the Root target is deleted.
-
-## <a name="vss_update">VSS Policy Update</a>
-[Policy update](./config/iam_service_policies.tf) allowing Vulnerability Scanning Service (VSS) to scan containers in OCI Registry: *Allow service vulnerability-scanning-service to read repos in tenancy*.
-
-## <a name="code_examples">Code Examples Aligned with Deployment Guide</a>
-An [examples](./examples/) folder has been added showcasing input variables for the various deployment samples provided in the [deployment guide](DEPLOYMENT-GUIDE.md). The examples follow Oracle documentation guidelines for acceptable company name.
-
-# March 18, 2022 Release Notes - Stable 2.3.2
-1. [Deployment Guide](#deployment_guide)
-1. [Reviewed IAM Admin Policies](#iam_policies_review)
-
-## <a name="deployment_guide">Deployment Guide</a>
-A compreehensive [deployment guide](DEPLOYMENT-GUIDE.md) for CIS Landing Zone is now available. It covers key deployment considerations, the architecture, major deployment scenarios, customization guidance, detailed steps how to deploy using Terraform CLI and with Resource Manager UI/CLI as well as various deployment configuration samples.
-
-## <a name="iam_policies_review">Reviewed IAM Admin Policies</a>
-IAM admin policy has been updated to not allow IAM administrators to manage compartments and policies at the Root compartment, thus avoiding privilege escalation.
-
-# February 25, 2022 Release Notes - Stable 2.3.1
-1. [Configurable Spoke Subnet Names and Subnet Sizes](#spoke_config)
-1. [Updated Compute Dynamic Group to support OS Management](#dg_osms)
-1. [Fixed Internet Gateway Creation in ExaCS VCN](#exacs_fix)
-1. [Updated Bastion NSG to include RDP](#rdp_update)
-1. [Tagging Support](#tagging)
-
-## <a name="spoke_config">Configurable Spoke Subnet Names and Subnet Sizes</a>
-The names and the size of subnets created in spoke VCN(s) can now be configured using the variables: **subnets_names** and **subnets_sizes**. Ex. `["front", "middle", "back"]` and `["12","8","10"]`.  Additional customization of spoke VCNs can be done in net_vcn.tf or with  using [Terraform Override Files](https://www.terraform.io/language/files/override).
-Check [Known Issues](README.md#know-issues) section for an issue affecting custom subnets sizes in Resource Manager UI.
-
-## <a name="dg_osms">Updated Compute Dynamic Group to support OS Management</a>
-Added IAM policy statements to the compute agent dynamic group policy to include support for OS Management.
-
-## <a name="exacs_fix">Fixed Internet Gateway Creation in ExaCS VCN</a>
-Disabled creation of Internet Gateway in ExaCS VCNs.
-
-## <a name="rdp_update">Updated Bastion NSG to include RDP</a>
-Added port 3389 to the Bastion Network Security Group (NSG) to support Remote Desktop Protocol (RDP) for Windows based instances.
-
-## <a name="tagging">Tagging Support</a>
-The Landing Zone fully supports definition and usage of defined_tags and freeform_tags for all resources. In this release there is no additional variable to be set in the quickstart-input.tfvars. Tag definition and usage can be set using [Terraform Override Files](https://www.terraform.io/language/files/override).
-
-Usage Overview:
-- Defined tags - At the moment, using Defined Tags is a two step process.
-  1. Create the defined tags.
-  1. Use the defined tags.
-- Freeform tags - Freeform tags can be used at any time. You simply assign a map of freeform tags, to a predefined local variable in an override file, for example ```all_keys_freeform_tags = {"cis-landing-zone" : "${var.service_label}-quickstart"}```.
-
-Please note that space characters (' ') in the tag names are not supported by OCI.
-
-# February 02, 2022 Release Notes - Stable 2.3.0
-1. [Cross Region Landing Zone](#cross_region_lz_2_3_0)
-1. [Bring Existing Dynamic Groups](#byodg_2_3_0)
-1. [CCCS Guard Rails](#script_2_3_0)
-1. [Landing Zone Logo](#lz_logo_2_3_0)
-1. [Customized VCN and Subnet deployment option](#lz_vcn_2_3_0)
-
-## <a name="cross_region_lz_2_3_0">Cross Region Landing Zone</a>
-When you run Landing Zone's Terraform, some resources are created in the home region, while others are created in a region of choice. Among home region resources are compartments, groups, dynamic groups, policies, tag defaults and an infrastructure for IAM related notifications (including events, topics and subscriptions). Among resources created in the region of choice are VCNs, Log Groups, and those pertaining to security services like Vault Service, Vulnerability Scanning, Service Connector Hub, Bastion. The home region resources are automatically made available by OCI in all subscribed regions.
-
-Some customers want to extend their Landing Zone to more than one region of choice, while reusing the home region resources. One typical use case is setting up a second region of choice for disaster recovery, reusing the same home region Landing Zone resources. A more broad use case is implementing a single global Landing Zone across all subscribed regions. These use cases are now supported via the newly introduced *extend_landing_zone_to_new_region*. When set to true, compartments, groups, dynamic groups, policies and resources pertaining to home region are not provisioned, but reused instead.
-
-## <a name="byodg_2_3_0">Bring Existing Dynamic Groups</a>
-As with groups, Landing Zone now supports reusing existing *dynamic* groups. These dynamic groups are thought to be used by OCI Functions, Compute's management agent and databases for calling out other services. 
-
-## <a name="script_2_3_0">CCCS Guard Rails</a>
-The Compliance Checking script's summary report now includes a column for CCCS Guard Rails.
-
-## <a name="lz_logo_2_3_0">Landing Zone Logo</a>
-Landing Zone has been gifted with a logo. A courtesy from our colleague [Chris Johnson](https://github.com/therealcmj).   
-
-## <a name="lz_vcn_2_3_0">Customized VCN and Subnet deployment option</a>
-This release provides the option to easily customize your VCNs and Subnets in terms of cidr ranges and naming using a map resource called custom_vcns_map.
-Please note as part of this release we have also updated the default Database subnet to include a routing rule for sending traffic destined for 0.0.0.0/0 to the NAT Gateway.
-However the default Network Security Group will still prevent any egress to the internet until it is changed by you.
-
-
-# December 02, 2021 Release Notes - Stable 2.2.0
-1. [Updated Topics and Subscription Module (Impacts existing deployments)](#topics_2_2_0)
-1. [Enablement of Operational Events and Alarms Specific to Compute, Storage, Database and Governance](#events_and_alarms_2_2_0)
-1. [Compliance Checking Script Runs in All Regions](#script_update_2_2_0)
-1. [Click to Deploy button](#click_to_deploy_2_2_0)
-1. [Added SVG versions of Core Architecture Files](#svg_architecture_files)
-1. [Added an optional Budget and Budget Alert Rule](#budget_2_2_0)
-
-
-## <a name="topics_2_2_0">Updated Topics and Subscription Module (Impacts existing deployments)</a>
-In previous versions of the Landing Zone Topics and Subscriptions were a single module.  Going forward there will be a [Topics Module](modules/topics-v2/toopics/README.md) and a [Subscription Module](modules/topics-v2/subscriptions/README.md). **Due to this change upgrading an existing Landing Zone deployment will cause the Security Topic and Subscriptions as well as the Network Topic and Subscriptions to be deleted and recreated.** This will require users receiving these email notifications to re-accept their subscriptions.
-
-## <a name="events_and_alarms_2_2_0">Enablement of Operational Events and Alarms Specific to Compute, Storage, Database and Governance</a>
-Customers can now deploy events and alarms specific to operational areas including Compute, Storage, Database and Governance as part of the default Landing Zone deployment. Operational alarms and events can be enabled by entering an email address in. This includes following alarms:
-- AppDev Compartment
-    - Instance based monitoring and alerting of high cpu and high memory usage for instances deployed in the AppDev compartment.
-    - Bare metal unhealthy and VM maintenance alarms are also part of the new core compute alarm set.
-- Database Compartment 
-    - Databases deployed in the Database compartment operational events and alerts have been enabled for for high ADB CPU and high ADB Storage usage.
-    - Autonomous Database Critical Events and ExaData CS Infrastructure events are now tracked in this release.
-- Network Compartment
-    - Up/Down status for VPN and FastConnect services in the Network compartment of the Landing Zone.
-
-## <a name="script_update_2_2_0">Compliance Checking Script Runs in All Regions</a>
-The compliance checking script now runs checks on all available regions in the tenancy and has improved handling of Oracle PSM policy statements.
-
-## <a name="click_to_deploy_2_2_0">Click to Deploy button</a>
-Resource Manager stack can be created directly from GitHub repository through a single button click. The zip file with the source code is passed directly to Resource Manager Create Stack API. 
-
-## <a name="svg_architecture_files">Added SVG versions of Core Architecture Files</a>
-Added SVG versions of Core Architecture Files so users can modify the architectures using Draw.io.
-
-## <a name="budget_2_2_0">Added an optional Budget and Budget Alert Rule</a>
-Customers can now choose to deploy a budget at the root or enclosing compartment level to track monthly spending and be alerted if a forcasted spending breaches a defined threshold. 
-
-A Cost Managment Admin group is also created that grants permission to Create,Update,Delete budgets and also review Cost Data in the UI or by downloading the detailed Cost Reports.
-Cost Data View Only permissions have been added to the policies for: Auditor, Database Admin, AppDev Admin, Network Admin and Security Admin allowing members of these groups to review spending. 
-  
-# October 13, 2021 Release Notes - Stable 2.1.1
-1. [CIS Compliance Checking Script Updates](#cis_script_2_1_1)
-1. [Bastion Service Enabled by public_src_bastion_cidrs](#bastion_service_update)
-
-## <a name="cis_script_2_1_1">CIS Compliance Checking Script Updates</a>
-CIS Compliance checking script will now prepend the OCI tenancy's display name to the output directory it creates if no directory is specified.  An example output directory `tenancy_display_name-20211013`.
-
-## <a name="bastion_service_update">Bastion Service Enabled by public_src_bastion_cidrs</a>
-Now [OCI Bastion service] (https://docs.oracle.com/en-us/iaas/Content/Bastion/Concepts/bastionoverview.htm) is enabled when one or more *public_src_bastion_cidrs* are provided **and** a single VCN deployment is selected.  In the previous version it was enabled by default in a single VCN deployment.
-
-# September 24, 2021 Release Notes - Stable 2.1.0
-1. [Ability to Provision Infrastructure for Exadata Cloud Service Deployments](#exadata_2_1_0)
-1. [OCI Bastion Service Integration](#bastion_2_1_0)
-1. [Individual Security Lists for Subnets](#sec_lists_2_1_0)
-1. [Ability to Rename Compartments](#cmp_renaming_2_1_0)
-1. [Updates to NSGs and Route Rules Descriptions](#rules_descriptions_update_2_1_0)
-1. [Input Variable for SSH Connectivity from On-premises Network](#on_prem_ssh_cidrs_2_1_0)
-1. [Updates to Resource Manager Interface](#orm_update_2_1_0)
-
-## <a name="exadata_2_1_0">Ability to Provision Infrastructure for Exadata Cloud Service Deployments</a>
-Landing Zone can now provision VCNs, compartment, group and policies for Exadata Cloud Service (ExaCS) deployments. The provisioned resources are deployed in tandem with the overall Landing Zone configuration. VCNs are provisioned with client and backup subnets. If a Hub & Spoke network architecture is being deployed, the ExaCS VCNs are configured as spoke VCNs. A compartment is by default created for the ExaCS infrastructure and an extra group and policies are configured accordingly. Optionally, users may opt for deploying ExaCS infrastructure in the database compartment with appropriate permissions granted to database administrators.
-
-## <a name="bastion_2_1_0">OCI Bastion Service Integration</a>
-Customers can now leverage OCI Bastion Service in Landing Zone. A Bastion resource is provisioned into a VCN if a single VCN or a single ExaCS VCN is being deployed. Customers can later on create a Bastion session using the provisioned Bastion resource. The Bastion resource is not provisioned for Hub & Spoke architecture or if the Landing Zone VCNs are connected to an on-premises network. In these cases, SSH inbound access is expected to be provided by Bastion servers in the DMZ (Hub) or hosts in the on-premises network.
-
-## <a name="sec_lists_2_1_0">Individual Security Lists for Subnets</a>
-Individual security lists are now created for all subnets. This is useful for customers planning on deploying services that require Security Lists instead of Network Security Groups.
-
-## <a name="cmp_renaming_2_1_0">Ability to Rename Compartments</a>
-Landing Zone creates compartments with auto-generated names, prefixed by the service_label variable value. Landing Zone compartments can be renamed at any point in time with all policies adjusted accordingly. 
-
-## <a name="rules_descriptions_update_2_1_0">Updates to NSGs and Route Rules Descriptions</a>
-The descriptions of rules in NSGs and route tables have been updated aiming at more clarity and verbiage standardization.
-
-## <a name="on_prem_ssh_cidrs_2_1_0">Input Variable for SSH Connectivity from On-premises Network</a>
-Variable *onprem_src_ssh_cidrs* is introduced. It is a list of on-premises CIDR blocks allowed to connect to Landing Zone over SSH. It is added to network security rules for ingress connectivity to Landing Zone networks. The *on_prem_ssh_cidrs* must be a subset of the *onprem_cidrs* variable, which are used for routing between on-premises and Landing Zone networks.
-
-## <a name="orm_update_2_1_0">Updates to Resource Manager Interface</a>
-With the introduction of Exadata Cloud Service support, Landing Zone schema.yaml has been updated for better usability in OCI Resource Manager. A new variable group named 'Connectivity' has been introduced, containing variables for defining properties that control the sources and destinations for Landing Zone connectivity. 
-
-
-# August 12, 2021 Release Notes - Stable 2.0.3
-1. [Ability to use existing Dynamic Routing Gateway (DRG) v2 with the Landing Zone](#existing_drg_2_0_3)
-1. [Consolidated Network and IAM Notifications](#notifications_consolidation_2_0_3)
-1. [Database Customer Managed Key Support](#database_key_support_2_0_3)
-1. [Compliance Checking supports free tier tenancy](#cis_report_update_2_0_3)
-
-
-## <a name="existing_drg_2_0_3"></a>1. Ability to use existing Dynamic Routing Gateway (DRG) with the Landing Zone
-Customers that have an existing DRG v2 (a DRG created after April 15, 2021) can now use that existing DRG v2 instead of having the Landing Zone create a new DRG v2. This is useful for customers that have connected a FastConnect to an existing DRG.
-
-## <a name="notifications_consolidation_2_0_3"></a>2. Consolidated Network and IAM Notifications
-In previous versions of the Landing Zone notification event rules were created for each CIS benchmark monitoring recommendation.  To help reduce the number of event rules created all the IAM recommendations are combined into a single event rule and all the network recommendations are combined into another event rule. 
-
-## <a name="database_key_support_2_0_3"></a>3. Autonomous Database Customer Managed Key Support
-Database Administrators now have the ability to use keys from OCI Vaults in the security compartment to encrypt databases in the database compartment.
-
-## <a name="cis_report_update_2_0_3"></a>4. Compliance Checking supports free tier tenancy
-Compliance Checking script can now be run free tier OCI tenancy.
-
-# July 2021 Release Notes - Stable 2.0.0
-1. [Ability to provision the Landing Zone with narrower permissions](#narrower_permissions)
-1. [Ability to provision Landing Zone within an enclosing compartment at any level in the compartment hierarchy](#enclosing_compartment)
-1. [Ability to reuse existing groups when provisioning the Landing Zone](#existing_groups)
-1. [Hub and Spoke Network Architecture plus networking enhancements](#hub_spoke_network)
-
-
-## <a name="narrower_permissions"></a>1. Ability to provision the Landing Zone with narrower permissions
-Before this release, the Landing Zone required a user with wide permissions in the tenancy in order to be provisioned. Typically, but not necessarily, this user was a member of the *Administrators* group. That has changed. Now the Landing Zone can be provisioned by a user with narrower permissions. However, some pre-requisites need to be satisfied. Specifically, the Landing Zone requires policies created at the tenancy level and broad permissions at the compartment where it is going to be provisioned. 
-
-The Landing Zone handles these requirements with a new Terraform root module that's expected to be executed by a user with wide permissions (typically a member of the *Administrators* group). The module is available in the *pre-config* folder and provisions the following:
-	
-1. An enclosing compartment for the Landing Zone compartments. 
-2. Optionally, a group with the required permissions to provision the Landing Zone in the enclosing compartment.
-3. Optionally, Landing Zone required groups for segregation of duties. These groups can then simply be reused when provisioning the Landing Zone.
-4. Optionally, required permissions at the tenancy level granted to Landing Zone groups, like permissions granted to Security and IAM administrators.
-
-The variables controlling the pre-config module behavior are described in [Pre-Config Module Variables section](VARIABLES.md#pre_config_input_variables).
-	
-## <a name="enclosing_compartment"></a>2. Ability to provision Landing Zone within an enclosing compartment at any level in the compartment hierarchy
-This can be done by a *wide-permissioned* user or a *narrower-permissioned* user. If done by the *wide-permissioned* user, the steps described in the previous section MUST be skipped. If done by a *narrower-permissioned* user, the steps in the previous section are required. **A _narrower-permissioned_ user is only allowed to provision the Landing Zone in a enclosing compartment previously designated by a _wide-permissioned_ user.**
-	
-The existing Landing Zone config module has been extended to support this use case. The module keeps backwards compatibility, i.e., the new variables default values keeps the module current behavior unchanged. In other words, if you execute the config module as-is, the four Landing Zone compartments are created directly under the root compartment with all policies created at the root compartment. 
-
-The module behavior is controlled by variables described in the [Enclosing Compartment Variables section](VARIABLES.md#enc_cmp_variables).
-	
-## <a name="existing_groups"></a>3. Ability to reuse existing groups when provisioning the Landing Zone
-Previously, every Landing Zone execution would create groups. However, it's acknowledged that a customer may want to create multiple Landing Zones but only one set of groups, reusing them across the Landing Zones. 
-
-The module behavior is controlled by variables described in the [Existing Groups Reuse Variables section](VARIABLES.md#existing_groups_variables).
-
-## <a name="hub_spoke_network"></a>4. Hub and Spoke Network Architecture plus networking enhancements
-
-Before this release, the Landing Zone would deploy a single VCN with three subnets designed for a 3-tier application with DRG if on-premises connectivity was required.  In this new release we enhanced the networking and network security modules to can support the creation of multiple VCNs (spokes or stand-alone) and the following Hub and Spoke network architectures:
-- **Access to multiple VCNs in the same region:** This scenario enables communication between an on-premises network and multiple VCNs in the same region over a single FastConnect private virtual circuit or Site-to-Site VPN and uses a DRG as the hub.
-- **Access between multiple networks through a single DRG with a firewall between networks:** This scenario connects several VCNs to a single DRG, with all routing configured to send packets through a firewall in a hub VCN before they can be sent to another network.
-
-In addition to the above architectures, you can choose if want to allow the creation of Internet Gateways and NAT Gateways to provide a more isolated network. Lastly, we have also added support for various network variables to take lists of CIDR ranges instead of a single CIDR. 
-
-The module behavior is controlled by variables described in the [Networking Variables section](VARIABLES.md#networking-variables).
-
-
-# June 2021 Release Notes - Stable 1.1.1
-1. [Logging Consolidation with Service Connector Hub](#logging_consolidation)
-1. [Vulnerability Scanning](#vulnerability_scanning)
-
-	
-## <a name="logging_consolidations"></a>1. Logging Consolidation with Service Connector Hub
-The Landing Zone enables/collects logs for a few services, like VCN and Audit services. From a governance perspective, it's interesting that these logs get consolidated and made available to security management tools. This capability is now availabe in the Landing Zone with the Service Connector Hub, that reads logs from different sources and sends them to a target that the user chooses. By default, this target is a bucket in the Object Storage service, but functions and streams can also be configured as targets. As the usage of a bucket, function or stream may incur in costs to our customers, Landing Zone users must explicitly activate Service Connector Hub by setting variables in the Terraform configuration, as described in [Logging Variables](terraform.md#logging_variables) section.
-
-To delete or change a Service Connector that has an Object Storage bucket as a target, you must manually remove the target from the Service Connector and manually delete the bucket. A bucket with objects cannot be deleted via Terraform.
-
-## <a name="vulnerability_scanning"></a>2. Vulnerability Scanning
-The Landing Zone now enables scanning through the Vulnerability Scanning Service (VSS), creating a scan recipe and scan targets by default. The recipe is set to run every week on sundays and the targets are set to all four Landing Zone compartments. Running the Landing Zone as is, weekly scans are automatically executed for any instances deployed in any of the Landing Zone compartments. The scan results are made available in the Security compartment and can be verified in the OCI Console. 
-
-Scanning can be disabled in the Landing Zone, and the scan frequency and targets can be changed as well. Disabling scanning and changing the frequency are controlled by setting variables in the Terraform configuration, as described in [Scanning Variables](terraform.md#vss_variables) section, while targets can be changed in the vss.tf file. The Vulnerability Scanning Service is free.
+#  June 7, 2024 Release Notes - 2.8.3
+1. [Cloud Guard Detector and Security Zones Rules Mapped to CIS OCI Benchmark 2.0.0](#2-8-3-mapping-updates)
+1. [Updates/Fixes to the CIS Compliance Script](#2-8-3-script-updates)
+1. [Updates/Fixes to the Terraform](#2-8-3-terraform-updates)
+
+
+## <a name="#2-8-3-mapping-updates">Cloud Guard Detector and Security Zones Rules Mapped to CIS OCI Benchmark 2.0.0</a>
+The CIS OCI Benchmark mapping in the [compliance-script.md](./compliance-script.md) now maps to Cloud Guard Detectors and Security Zone Rules.
+
+## <a name="#2-8-3-script-updates">Updates/Fixes to the CIS Compliance Script</a>
+**Fixes**
+- Fixed numbering issue for Logging and Monitoring checks 4.3 - 4.12.
+- Fixed to Auditor policy documented in the [compliance-script.md](./compliance-script.md) to support running OBP checks.
+- Fixed language for observations and error messages.
+
+**Updates**
+- Reduced code associated with ADB collection function.
+- Added additional debugging statements.
+
+## <a name="#2-8-3-terraform-updates">Updates/Fixes to the Terraform</a>
+**Updates**
+- Updated to Auditor policy to align with the [compliance-script.md](./compliance-script.md) update.
+- Updated Network and Database Admins with permissions to include repo management.
+
+#  April 18, 2024 Release Notes - 2.8.2
+1. [New OBP for Certificate Service Certificate Expiration](#2-8-2-certificate-check)
+1. [OCI CIS Landing Zone Oracle Access Governance Support](#2-8-2-oag-support)
+1. [Updates/Fixes to the Terraform](#2-8-2-terraform-updates)
+1. [Updates/Fixes to the CIS Compliance Script](#2-8-2-script-updates)
+
+## <a name="#2-8-2-certificate-check">New OBP for Certificate Service Certificate Expiration</a>
+A new Oracle Best Practice (OBP) check scans certificates stored in the [OCI Certificate Service](https://docs.oracle.com/en-us/iaas/Content/certificates/overview.htm) and finds those that will expire in under 30 days.  This check will help customers prevent unintended outages for OCI Services using certificates stored in the certificate service that expires before causing connectivity errors.
+
+## <a name="#2-8-2-oag-support">OCI CIS Landing Zone Oracle Access Governance Support</a>
+The OCI CIS Landing Zone enables accelerated [Oracle Access Governance (OAG)](https://www.oracle.com/security/cloud-security/access-governance/) deployment.  The policies and groups required for OAG are created and aligned with the OCI CIS Foundations Benchmark.  To deploy OAG using the CIS Landing Zone, review the Oracle Access Governance section under Governance in the [Deployment Guide](./DEPLOYMENT-GUIDE.md).
+
+## <a name="#2-8-2-terraform-updates">Updates/Fixes to the Terraform</a>
+**Fixes**
+- Fixed the issue when deploying the CIS Landing Zone to other [realms](https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm). [Issue 140](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/140)
+
+## <a name="#2-8-2-script-updates">Updates/Fixes to the CIS Compliance Script</a>
+**Updates**
+- Added support to override `https://cloud.oracle.com` in deep link URLs in CSV reports with a customer provided deep link URL using the `--deeplink-url-override` argument.  This provides support for other [realms](https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm).  The following `--deeplink-url-override https://console.us-langley-1.oraclegovcloud.com` will support OC2's Ashburn region.
+- Added new actions attribute to OCI Event records.
+- Added new compliance checking script FAQ item. 
+
+#  March 25, 2024 Release Notes - 2.8.1
+1. [Updates/Fixes to the CIS Compliance Script](#2-8-1-script-updates)
+
+## <a name="#2-8-1-script-updates">Updates/Fixes to the CIS Compliance Script</a>
+**Updates:**
+- Added flag `--report-prefix` to allow unique files for better baseline comparison.
+- Improved performance in querying Identity Domains users’ API keys.
+- Improved Identity Domains checking for federated users by using is_federated flag.
+- Added Deep Link with Identity Domain name to user, group, and dynamic group records.
+- The audit configuration check has been removed because it is no longer in the benchmark.
+- Boot Volume resources were added to the check 6.2 resources in the root compartment.
+
+**Fixes:**
+-	Handling KMS keys with date issues.
+-	Removed duplication of Identity Groups for Identity Domains.
+-	Consistency and commenting updates.
+
+
+#  February 23, 2024 Release Notes - 2.8.0
+1. [Updates for CIS OCI Benchmark 2.0.0](#2-8-0-cis-2-updates)
+1. [Compliance Checker Script Update for Identity Domains](#2-8-0-cis-2-iddomains)
+1. [Updates/Fixes to the CIS Compliance Script](#2-8-0-script-updates)
+1. [Readme Updates](#2-8-0-readme-updates)
+
+
+## <a name="#2-8-0-cis-2-updates">Updates for CIS OCI Benchmark 2.0.0</a>
+On January 4th, 2024 the [CIS Oracle Cloud Infrastructure Foundations Benchmark 2.0.0](https://www.cisecurity.org/benchmark/oracle_cloud) was published.  To align to this new release the compliance checking script has updated the numbering and added the following new checks:
+- Compute checks for secure boot, IMDSv2, and in-transit encryption enabled
+- Logging and Monitoring Check added to ensure there is a notification for Cloud Guard events
+- IAM check for Database Password rotation
+In addition, the CIS OCI Benchmark to CIS Landing Zone Architecture Mapping table and architecture where updated to align to the updated benchmark.
+
+## <a name="#2-8-0-cis-2-iddomains">Compliance Checker Script Update for Identity Domains</a>
+To align with the migration from OCI tenancies to those without Identity Domains to those with Identity Domains.  All IAM checks have been updated to search all Identity Domains in a tenancy.  Checks that were updated are:
+- 1.4   Ensure IAM password policy requires minimum length of 14 or greater
+- 1.5   Ensure IAM password policy expires passwords within 365 days
+- 1.6	Ensure IAM password policy prevents password reuse
+- 1.7   Ensure MFA is enabled for all users with a console password
+- 1.8   Ensure user API keys rotate within 90 days or less
+- 1.9   Ensure user customer secret keys rotate within 90 days or less
+- 1.10  Ensure user auth tokens rotate within 90 days or less
+- 1.11  Ensure user IAM Database Passwords rotate within 90 days
+- 1.12  Ensure API keys are not created for tenancy administrator users
+- 1.13  Ensure all OCI IAM user accounts have a valid and current email address
+- 1.14  Ensure Instance Principal authentication is used for OCI instances, OCI Cloud Databases and OCI Functions to access OCI resources.
+
+## <a name="#2-8-0-script-updates">Updates/Fixes to the CIS Compliance Script</a>
+**Fixes:**
+    - Check *Ensure customer created Customer Managed Key (CMK) is rotated at least annually.* was updated to check current key version instead of key creation date.
+    - Updated checks 1.6, 1.5, 6.2 totals to prevent negative numbers.
+    - Resolved case sensitivity issue relating to policy check for `"PSM-root-policy"`.
+**Updates:**
+    - Added a new item to the FAQ.
+
+## <a name="#2-8-0-readme-updates">Readme Updates</a>
+The README.md was updated to add a click to deploy option for the EU Sovereign regions. Closing [issue 136](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/136)
+
+#   January 5, 2024 Release Notes - 2.7.1
+1. [Links to Deploy in Non-commercial Regions](#2-7-1-deploy-links)
+1. [Terraform Updates](#2-7-1-tf-updates)
+1. [Script Updates](#2-7-1-script-updates)
+
+## <a name="#2-7-1-deploy-links">Links to Deploy in Non-commercial Regions</a>
+Links have been added to [README.md](./README.md) allowing the initiation of Terraform deployments in **non-commercial** regions through OCI Resource Manager service. The existing "Deploy to Oracle Cloud" button is unchanged, initiating deployments to commercial regions only. Use the links when deploying to Gov cloud.
+
+## <a name="2-7-1-tf-updates">Terraform Updates</a>
+**config module**
+* *tenancy_ocid*, *user_ocid* and *region* variables are now hidden in [generic_workload_compartments](./workloads/generic_workload_compartments/) RMS UI.
+* IAM policies have been added to allow OKE clusters deployment with NPN (Native Pod Networking) and split compartment topology (i.e., networking in Network compartment and cluster in AppDev compartment).
+* Tenancy wide audit logs for Service Connector Hub are now collected using "_Audit_Include_Subcompartment" construct instead of explicitly looping through all tenancy compartments. 
+
+**pre-config module**
+* Auditor grants in pre-config module aligned with auditor grants in config module.
+
+## <a name="2-7-1-script-updates">Script Updates</a>
+- Fixes:
+    - Added additional error handling in `__search_resources_in_root_compartment` to resolve [issue 134](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/134).
+
+#   November 17, 2023 Release Notes - 2.7.0
+1. [CIS Compliance Script Gets Network Topology](#2-7-0-script-network-topology)
+1. [CIS Compliance Script Gets All Resources](#2-7-0-script-all-resources)
+1. [Landing Zone Architecture to CIS OCI Benchmark Documentation](#2-7-0-terraform-mapping)
+1. [Terraform Updates](#2-7-0-tf-updates)
+
+## <a name="#2-7-0-script-network-topology">CIS Compliance Script Gets Network Topology</a>
+The CIS compliance Script now queries the [OCI Network Visualizer](https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/network_visualizer.htm) to download a text version of the tenancy's network topology in JSON and PKL file format.  This feature is run using the `--obp --raw` flags or the `all-resources` flag. 
+
+## <a name="#2-7-0-script-all-resources">CIS Compliance Script Gets All Resources</a>
+The CIS compliance Script now uses the [Search](https://docs.oracle.com/en-us/iaas/Content/Search/Concepts/queryoverview.htm#Overview_of_Search) service to query all available resources in a tenancy. The data returned is in a JSON file and is limited to resource types supported by Search and the fields for each resource are limited to the additional details available to the Search service.  This feature is run using the `--all-resources` flag.
+
+## <a name="#2-7-0-terraform-mapping">Landing Zone Architecture to CIS OCI Benchmark Documentation</a>
+The [CIS OCI Benchmark to CIS Landing Zone Architecture Mapping](cis-architecture-mapping.md) document details how the OCI CIS Landing Zone configuration aligns with the CIS Benchmark v1.2.
+
+## <a name="2-7-0-tf-updates">Terraform Updates</a>
+**config module**
+* Existing dynamic groups can now be selected in Resource Manager UI.
+* All IAM remote modules have been pinned to version 0.1.7. If you are managing the Landing Zone with terraform CLI, make sure to run *terraform init -upgrade* when adopting this release.
+* **Bug fix**: when extending Landing Zone to another region, groups were being processed and an "invalid index" error generated during *terraform plan*. With this fix, groups are no longer processed when extending the Landing Zone. 
+* **Bug fix**: when running Landing Zone config as a user with limited permissions, service policies were being processed and failing during *terraform apply* due to insufficient permissions. With this fix, service policies are no longer processed when running config as a user with limited permissions.
+
+**pre-config module**
+* Storage admin group has been added.
+* Existing provisioning group can now be selected in Resource Manager UI.
+* Policies for dynamic groups have been removed, as they can be managed in the config module.
+* Ability to use existing dynamic groups has been removed, as the feature is already present in the config module.
+* *deploy_dynamic_groups* variable added, set to true by default. If reusing existing dynamic groups is needed, set this variable to false and select the existing dynamic groups in the config module.
+
+#   October 6, 2023 Release Notes - 2.6.5
+1. [CIS Compliance Script Updates](#2-6-5-script-updates)
+1. [Terraform Quick Start Updates](#2-6-5-quickstart-updates)
+1. [Terraform Workloads Updates](#2-6-5-workload-updates)
+
+## <a name="2-6-5-script-updates">Updates to the CIS Compliance Script</a>
+Updates:
+    - Added debugging Identity Groups collection
+
+## <a name="2-6-5-quickstart-updates">Terraform Quick Start Updates</a>
+Updates:
+- Compartments management has been pinned to Compartments module v0.1.6.
+
+## <a name="2-6-5-workload-updates">Terraform Quick Start Updates</a>
+Updates:
+    - Generic Workloads outputs compartments created
+Fixes:
+- Dynamic Group AppDev
+
+#   September 18, 2023 Release Notes - 2.6.4
+1. [CIS Compliance Script Adds Identity Domains](#2-6-4-identity-domains)
+1. [Updates to the CIS Compliance Script](#2-6-4-script-updates)
+1. [Workload Expansion Terraform for Quick Start](#2-6-4-workload-updates)
+
+## <a name="2-6-4-identity-domains">CIS Compliance Script Adds Identity Domains</a>
+CIS compliance checking scripts adds collection of Identity Domains password policy.  This allows the compliance checking script to access CIS recommendation 1.5 Ensure IAM password policy expires passwords within 365 days and recommendation 1.6 Ensure IAM password policy prevents password reuse.
+
+## <a name="2-6-4-script-updates">Updates to the CIS Compliance Script</a>
+- Updates:
+    - Improved navigation for CIS Summary Report HTML
+    - Added `error_report.csv` for errors when collection OCI resources
+- Fixes:
+    - Improved OCI logging error handling
+    - Fixed compliance for Storage Admin policies for CIS recommendation 1.14 Ensure storage service-level admins cannot delete resources they manage
+
+## <a name="2-6-4-workload-updates">Workload Expansion Terraform for Quick Start</a>
+The terraform code in this folder expands an existing CIS Landing Zone deployment.  It does this by adding one or more workload compartment(s) in the AppDev compartment and, optionally, the associated OCI IAM groups, dynamic groups, and OCI IAM policies to manage OCI resources in the workload compartment. For more information please see the [readme.md](./workloads/generic_workload_compartments/readme.md)
+
+#   September 4, 2023 Release Notes - 2.6.3
+1. [Fixes to the CIS Compliance Script](#2-6-3-script-fixes)
+1. [Updates to the CIS Compliance Script](#2-6-3-script-updates)
+1. [Updates to Terraform Template](#2-6-3-terraform-updates)
+
+## <a name="2-6-3-script-fixes">Fixes to the CIS Compliance Script</a>
+Fixes:
+- Index of out range exception in obp checks for subnets and buckets in some exceptional cases.
+- No budget returned if script executed from non-home region in Cloud Shell. Budgets are now returned in all cases.
+
+## <a name="2-6-3-script-updates">Updates to the CIS Compliance Script</a>
+Updates:
+- Event types added to remediation in HTML report for check 3.13.
+- All OCI groups are now returned in raw output, including groups with no users.
+- Databases in "UNAVAILABLE" state are no longer returned in check 2.8.
+
+## <a name="2-6-3-terraform-updates">Updates to Terraform Template</a>
+Updates:
+- Existing groups can now have spaces in their names. Useful when referring to synchronized groups from external identity providers, where spaces are allowed in group names.
+- Variables for existing groups (*existing_xxxxx_admin_group_name*) can be assigned multiple groups. Feature only available through Terraform CLI. Not available in OCI Resource Manager.
+- *network_admin_email_endpoints* and *security_admin_email_endpoints* variables now enforce non-emptiness in Terrafom CLI.
+
+#   August 8, 2023 Release Notes - 2.6.2
+1. [Fixes to the CIS Compliance Script](#2-6-2-script-fixes)
+1. [Updates to the CIS Compliance Script](#2-6-2-script-updates)
+1. [Updates to the Readme](#2-6-2-readme-updates)
+
+
+## <a name="2-6-2-script-updates">Updates to the CIS Compliance Script</a>
+Updates:
+- Added Service Connector Hub ID and Name to OBP Best practices for VCN Flow Logs and Object Storage Buckets
+- Alert users when the cis_reports.py is not run in home region which can impact budgets collection
+
+## <a name="2-6-2-script-fixes">Fixes to the CIS Compliance Script</a>
+Fixes: 
+- Updated CIS 2.8 check updated to exclude ADB-S that are in a VCN but not attached to Network Security Group.  Closes issue [#105](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/105)
+- Cleaned up 1900+ Flake8 
+
+## <a name="2-6-2-readme-updates">Updates to the Readme</a>
+Updates:
+- Removed team section
+- Added the CIS Terraform Modules Section
+
+
+#   July 26, 2023 Release Notes - 2.6.1
+1. [Updates to Terraform Template](#2-6-1-tf-updates)
+1. [Documentation Updates](#2-6-1-doc-updates)
+1. [Fixes to the CIS Compliance Script](#2-6-1-script-fixes)
+
+## <a name="2-6-1-tf-updates">Updates to Terraform Template</a>
+Fixes:
+- Fixed a defect where missing exainfra admin group name in grants was causing policies creation to fail.
+
+Updates:
+- Set Terraform version upper bound to *< 1.3.0* in [provider.tf](./config/provider.tf).
+
+## <a name="2-6-1-doc-updates">Documentation Updates</a>
+Updates:
+- Added link to CIS Landing Zone Quick Start Live Lab in [README.md](./README.md).
+
+## <a name="2-6-1-script-fixes">Fixes to the CIS Compliance Script</a>
+Fixes:
+- CIS check 2.8 now skips autonomous database in the UNAVAILABLE state
+
+#   July 14, 2023 Release Notes - 2.6.0
+1. [Updates to Terraform Template](#2-6-0-tf-updates)
+
+## <a name="2-6-0-tf-updates">Updates to Terraform Template</a>
+Updates:
+- IAM resources, including compartments, groups, dynamic groups and policies are now managed with new remote modules, available in https://github.com/oracle-quickstart/terraform-oci-cis-landing-zone-iam. The old local IAM modules are still kept in this repository.
+- IAM policies can now be created based on metadata associated to compartments. This is an alternative way of managing policies, enabled by the [new IAM policy module](https://github.com/oracle-quickstart/terraform-oci-cis-landing-zone-iam/tree/main/policies). In this approach, the grants to resources belonging to a specific compartment are combined into a single policy that is attached to the compartment itself. This differs from the existing approach, where grants are combined per grantee and attached to the enclosing compartment. This alternative way is enabled by **Enable template policies?** checkbox (if using OCI Resource Manager) or by the **enable_template_policies** variable (if using Terraform CLI). The existing approach of deploying policies remains the default.
+- Some policy grants have been updated, allowing admin groups to manage keys in their own compartments using the OCI Vault in the Security Compartment and deploy private endpoints in Network compartment. Additionally, some grants have been consolidated into a single grant with a comma-separated list of group principals. Service policies have been consolidated into a single policy with the new name *${var.service_label}-services-policy*.
+- Deploying with an enclosing compartment becomes the default. Users who deploy without an enclosing compartment should unset **Use an enclosing compartment?** checkbox (if using OCI Resource Manager) or set **use_enclosing_compartment** variable to false (if using Terraform CLI).
+- Quick Start release number added to cis-landing-zone freeform tag.
+- Application Information tab is now enabled in OCI Resource Manager, displaying basic information about the stack and outputs of latest Terraform apply.
+
+
+#   June 29, 2023 Release Notes - 2.5.12
+1. [Fixes to the CIS Compliance Script](#2-5-12-script-fixes)
+
+## <a name="2-5-12-script-fixes">Fixes to the CIS Compliance Script</a>
+Fixes:
+- Fixed a logic issue for Security Lists and Network Security Groups with source ports but no destination ports
+- Removed Deeplink from Exception handling when reading object storage buckets
+- OBP check for budgets now verifies that there is budget with an alert for the root compartment
+
+
+#   June 20, 2023 Release Notes - 2.5.11
+1. [Performance update to the CIS Compliance Script](#2-5-11-script-performance)
+1. [Summary Data update to the CIS Compliance Script](#2-5-11-script-updates)
+1. [Fixes to the CIS Compliance Script](#2-5-11-script-fixes)
+
+## <a name="2-5-11-script-performance">Performance update to the CIS Compliance Script</a>
+Migrate the querying of resources to Resource Search (a module within Oracle’s API).  By using Resource Search, compartment iterations for listing items are ignored.  For items that require more detailed information than Resource Search returns, only those compartments are queried.  This migration reduces script execution time by 8 times.
+
+## <a name="#2-5-11-script-updates">Updates to the CIS Compliance Script</a>
+The CIS Summary report CSV adds two new columns **Compliant Items**, which represents the number of resources that are aligned to that recommendation, and **Total** which is the total number of that resource in tenancy. The **Total** column is also in the screen output.
+
+## <a name="#2-5-11-script-fixes">Fixes to the CIS Compliance Script</a>
+Fixes
+- Updated the CIS checks 2.1, 2,2, 2.3, and 2.4 to detect Security Lists and Networks Security Groups that allow egress access to ports 22 or 3389 via allowing all protocols, all ports, or using port ranges.
+- Updated CIS Check 2.5 to only look at Default Security Lists.
+
+
+#   May 12, 2023 Release Notes - 2.5.10
+1. [Support for Security Tokens in the CIS Compliance Script](#2-5-10-script-updates)
+1. [Terraform Template Updates](#2-5-9-tf-updates)
+
+## <a name="2-5-10-script-updates">Support for Security Tokens in the CIS Compliance Script</a>
+New:
+- Added support of Security Tokens for script authentication courtesy of Dave Knot ([dns-prefetch](https://github.com/dns-prefetch)).  For usage example, go to the [compliance-script.md](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/blob/main/compliance-script.md) and review the **Executing on a local machine via Security Token (oci session authenticate)** example. For more information on security tokens: [https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/clitoken.htm](https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/clitoken.htm)
+
+## <a name="2-5-10-tf-updates">Terraform Template Updates</a>
+Fixes:
+- Security rule added for ICMP in Exadata CS security lists, allowing for the initiation of ICMP requests to hosts in the VCN. Changes in [net_exacs_vcns.tf](./config/net_exacs_vcns.tf).
+- VSS targets are now created when the Landing Zone is extended to a new region. Changes in [vss.tf](./config/vss.tf).
+
+#   April 26, 2023 Release Notes - 2.5.9
+1. [Terraform Template Updates](#2-5-9-tf-updates)
+
+## <a name="2-5-9-tf-updates">Terraform Template Updates</a>
+Updates:
+- Security Zone is enabled only if an enclosing compartment is used. Changes in [security_zones.tf](./config/security_zones.tf).
+- Network event types updated for local peering gateway and service gateway: only event types ending with ".end" are captured. Changes in [mon_notifications.tf](./config/mon_notifications.tf).
+
+#   April 17, 2023 Release Notes - 2.5.8
+1. [Compliance Checking Script Updates](#2-5-8-script-updates)
+1. [Terraform Template Updates](#2-5-8-tf-updates)
+
+## <a name="2-5-8-script-updates">CIS Compliance Script Updates</a>
+Updates:
+- Updated CIS rule 1.7 to exclude OCI IAM Local Users that are service accounts.  A service account is a OCI IAM Local user that does not have *Local Password* as a *User Capabilities.*  
+- Support validated on OCI SDK 2.97.0.
+Fixes:
+- Improved error handling for Event Rules with no conditions.
+
+## <a name="2-5-8-tf-updates">Terraform Template Updates</a>
+- Compartment level service policies no longer created when extending Landing Zone to new region.
+- VSS and Vault resources now dependent on service policies. 
+
+#   April 04, 2023 Release Notes - 2.5.7
+1. [Exadata Events Fix](#2-5-7-exadata-events-fix)
+1. [Compliance Checking Script Updates](#2-5-7-script-updates)
+
+## <a name="2-5-7-exadata-events-fix">Exadata Events Fix</a>
+- Exadata events handled with jsonencode function in [mon_notifications.tf](./config/mon_notifications.tf).
+
+## <a name="2-5-7-script-updates">CIS Compliance Script Updates</a>
+Updates:
+- Added optionality to the NSG deep_link incase the link is less than 254 characters.
+- Updated Release version and date.
+
+Fixes:
+- Fixed console output formatting for CIS Summary report.
+
+
+
+#   March 24, 2023 Release Notes - 2.5.6
+1. [Compliance Checking Script Updates](#2-5-6-script-updates)
+
+## <a name="2-5-6-script-updates">CIS Compliance Script Updates</a>
+Updates:
+- Added egress rules to Security Lists and Network Security Groups.
+- Added DRG Upgrade status as *Upgrade_status* to the `raw_data_network_drgs.csv` file.
+
+Fixes:
+- For CIS Recommendations 1.5 and 1.6 now show *Not Applicable* instead of *Yes* or *No* as this is not yet checked by the script.
+- Removed filenames for findings with zero findings from the `cis_summary_report.csv` and `cis_html_summary_report.html` reports.
+
+#   March 2, 2023 Release Notes - 2.5.5
+1. [OCI IAM Policy Fix for Database Admin Group](#2-5-5-adb-policy-fix)
+1. [OCI IAM Service Policy Update](#2-5-5-oci-iam-service-policy)
+1. [Enhanced HTML CIS Summary Report](#2-5-5-html-cis-summary)
+1. [Compliance Checking Script Updates](#2-5-5-script-updates)
+
+
+## <a name="2-5-5-adb-policy-fix">OCI IAM Policy Fix for Database Admin Group</a>
+Updated OCI IAM policies attached to the Database Admin Group to support deploying ADBs in private subnets. Policy is based on documentation [here](https://docs.oracle.com/en-us/iaas/autonomous-database-shared/doc/iam-private-endpoint-configure-policies.html).
+
+## <a name="2-5-5-oci-iam-service-policy">OCI IAM Service Policy Update</a>
+Added an OCI IAM policy to allow OCI services File Storage Service, Object Storage Service, Oracle Kubernetes Engine, Streaming and Block Storage to encrypt data using keys in the OCI Vault in the Security Compartment. 
+
+## <a name="2-5-5-html-cis-summary">Enhanced HTML CIS Summary Report</a>
+The HTML CIS Summary report from the CIS compliance checking script has a significantly updated look and feel.
+
+## <a name="2-5-5-script-updates">CIS Compliance Script Updates</a>
+- The CIS compliance checking script has added user capabilities to OCI IAM user collection.  These attributes are only available in the `raw_data_identity_users.csv` file.
+- Enhanced exception handling for Oracle Best Practice checks.
+
+
+#   February 10, 2023 Release Notes - 2.5.4
+1. [Improved CIS 3.7 and 3.13 Checks](#2-5-4-cis-logic)
+
+## <a name="2-5-4-cis-logic">Improved CIS 3.7 and 3.13 Checks</a>
+The CIS Compliance checking script checks for Logging and Monitoring 3.7: *Ensure a notification is configured for IAM policy changes* and Logging and Monitoring 3.13: *Ensure a notification is configured for changes to route tables* has been improved to reduce false positives.
+
+#   February 1, 2023 Release Notes - 2.5.3
+1. [HTML CIS Summary Report](#2-5-3-script-html)
+1. [Resource Deep Links in CSV](#2-5-3-deep-link)
+1. [Improved CIS IAM 1.1 Check](#2-5-3-cis-logic)
+
+## <a name="2-5-3-script-html">HTML CIS Summary Report</a>
+The CIS Compliance checking script now outputs an HTML summary report.  The summary report includes additional information from the [CIS OCI Benchmark v1.2](https://www.cisecurity.org/benchmark/oracle_cloud) plus a link to the finding's CSV file.
+
+## <a name="2-5-3-deep-link">Resource Deep Links in CSV</a>
+The CIS Compliance checking script CSV reports have a new field `deep_link` which contains a clickable link to the resource in the OCI Console. 
+
+## <a name="2-5-3-cis-logic">Improved CIS IAM 1.1 Check</a>
+The CIS Compliance checking script check for Identity and Access Management 1.1: *Ensure service level admins are created to manage resources of particular service* has been improved to reduce false positives. 
+
+#  January 26, 2023 Release Notes - 2.5.2
+1. [Service Connector Hub Improvements](#2-5-2-sch-improvements)
+1. [CIS Level Setting Updates](#2-5-2-cis-level)
+
+## <a name="2-5-2-sch-improvements">Service Connector Hub Improvements</a>
+Service Connector Hub functionality has been improved with the following:
+- Audit logs from all tenancy compartments are now captured.
+- Support for Logging Analytics as target. With this update, the following targets are supported: Object Storage, Streaming, Functions and Logging Analytics.
+
+## <a name="2-5-2-cis-level">CIS Level Setting Updates</a>
+Following updates were made regarding the CIS Level setting (*cis_level* variable):
+- Setting *cis_level* variable to "2" is enough for OCI Vault creation. Previously, the OCI Vault creation would also require a bucket and no provided existing vault.
+- Write logs for buckets are only created if *cis_level* variable is set to "2". Previously, bucket write logs were not impacted by CIS Level setting.
+
+
+#  December 16, 2022 Release Notes - 2.5.1
+1. [CIS Compliance Script fixes](#2-5-1-script-update)
+1. [Improved Terraform Windows Support](#2-5-1-terraform-windows)
+
+## <a name="2-5-1-script-update">CIS Compliance Script fixes</a>
+The CIS Compliance Checking script [.cis_reports.py](./scripts/cis_reports.py) has had the following fixes:
+- Fixed consolidated xlsx file generation on Windows command line and Powershell.
+- Converted from positional arguments in OCI API calls to named arguments.
+
+## <a name="2-5-1-terraform-windows">Improved Terraform Windows Support</a>
+Fixed support for deploying terraform via Windows. Closes [Issue](https://github.com/oracle-quickstart/oci-cis-landingzone-quickstart/issues/61).
+
+#  December 05, 2022 Release Notes - 2.5.0
+1. [OCI Best Practices Checks Added to CIS Compliance Script](#2-5-0-script-update)
+1. [Cloud Guard Improvements](#2-5-0-cloud-guard-improvements)
+
+## <a name="2-5-0-script-update">OCI Best Practices Checks Added to CIS Compliance Script</a>
+The CIS Compliance Checking script [.cis_reports.py](./scripts/cis_reports.py) has had the following enhancements:
+- CIS compliance checking script has added checking for OCI Best Practices (OBP).  The following OCI Best Practices in your tenancy:
+    - Aggregation of OCI Audit compartment logs, Network Flow logs, and Object Storage logs are sent to Service Connector Hub in all regions
+    - A Budget for cost track is created in your tenancy
+    - Network connectivity to on-premises is redundant 
+    - Cloud Guard is configured at the root compartment with detectors and responders 
+    
+- Redaction of OCIDs before data is written to CSVs using the `--redact` flag.  This uses a sha256 hashes of OCID to maintain OCID consistency across files.
+- Reduced script runtime by synchronously reading OCI resources.
+- CSV files will be consolidated into a single XLSX file if the python3 environment has `xlsxwriter` installed.  
+
+See [compliance-script.md](./compliance-script.md#usage) for usage.
+
+## <a name="2-5-0-cloud-guard-improvements">Cloud Guard Improvements</a>
+Cloud Guard module has been updated with the following features:
+- Cloud Guard resources creation made optional, based on *enable_cloud_guard* input variable. Cloud Guard is enabled by default.
+- Support for cloned detector and responder recipes, based on *enable_cloud_guard_cloned_recipes* input variable. By default, for keeping backwards compatibility, the module uses Oracle managed recipes.
+- Support for customer provided reporting region. If reporting region is not provided, the module defaults to home region.
+- Resource Manager user interface reflects above changes.
+
+See [Cloud Guard variables](./VARIABLES.md#cloud-guard-variables) for details.
+
+#  October 28, 2022 Release Notes - 2.4.3
+## Bug Fixes
+- Arch Center tag module conditioned to Landing Zone not being extended. Fix in [mon_tags.tf](./config/mon_tags.tf).
+- CIS Compliance checking script was looking for attributes not available in list analytics and list integrations instances API calls. 
+#  October 14, 2022 Release Notes - 2.4.2
+1. [Compliance Checking Supports Custom OCI Config File Location](#2-4-2-script-config-file)
+1. [Custom Security Zone policies support for all OCI realms](#2-4-2-sz-all-realms)
+1. [Bug fixes](#2-4-2-bug-fixes)
+
+## <a name="2-4-2-script-config-file">Compliance Checking Supports Custom OCI Config File Location</a>
+The Compliance checking script adds a new flag `-c` that takes the location of an OCI config file. This flag allows users to specify which OCI config file to use instead of using the one in the default location (`~/.oci/config`).
+
+## <a name="2-4-2-sz-all-realms">Custom Security Zone policies support for all OCI realms</a>
+Custom Security Zone policies are now supported by CIS Landing Zone in all OCI realms where Custom Security Zones are available.
+
+## <a name="2-4-2-bug-fixes">Bug Fixes</a>
+- Incorrect *backups* resource-type replaced by *db-backups* for database admin grants in [iam_policies.tf](./config/iam_policies.tf).
+- Event types fixed for Exadata Cloud Service in [mon_notifications.tf](./config/mon_notifications.tf).
+
+# September 16, 2022 Release Notes - 2.4.1
+1. [Compliance Checking Report Identity Domain Fix](#2-4-1-script-fix)
+
+## <a name="2-4-1-script-fix">Compliance Checking Report Identity Domain Fix</a>
+Until this update, a user in the CIS Landing Zone Auditor group would not have been able to successfully run the compliance checking script in tenancies with Identity Domains.  The reason is tenancies with Identity Domains require elevated privileges to check the tenancies password policy.  With release 2.4.1 if the user doesn't have permissions to check password policy the script will continue running and just print an alert.
+
+# September 09, 2022 Release Notes - 2.4.0
+1. [Terraform Requirements](#2-4-0-tf-reqs)
+1. [CIS OCI Benchmark Configuration Profiles](#2-4-0-cis-level)
+1. [Custom Security Zones](#2-4-0-csz)
+1. [Service Connector Hub Improved Configuration](#2-4-0-sch-update)
+1. [Vulnerability Scanning Improved Configuration](#2-4-0-vss-update)
+1. [Application Bucket Improved Configuration](#2-4-0-appdev-bucket-update)
+1. [Data Safe Permissions](#2-4-0-datasafe-perms)
+
+## <a name="2-4-0-tf-reqs">Terraform Requirements</a>
+**The Terraform features in this release and future releases of the CIS Landing Zone will require Terraform binary 1.1.0 or higher**, where the *moved* block feature is available. The *moved* block provides a transparent way for preserving backwards compatibility in face of required code changes. We have consolidated all *moved* blocks in [moved.tf](./config/moved.tf). For details on this feature, please see: [Terraform's documentation on refactoring](https://www.terraform.io/language/modules/develop/refactoring).
+
+## <a name="2-4-0-cis-level">CIS OCI Benchmark Configuration Profiles</a>
+CIS Landing Zone introduces the ability to choose the CIS OCI configuration profile defined in the Benchmark. 
+
+When deploying CIS Landing Zone, users can now specify the CIS configuration profile level using the variable *cis_level* and it defines the configuration of some Landing Zone managed resources. For this release, the affected resources are Object Storage Buckets and Security Zones. The *cis_level* setting drives how buckets are encrypted and the minimum set of policies in a Security Zone.
+
+## <a name="2-4-0-csz">Security Zones</a>
+CIS Landing Zone adds to the overall tenancy security posture with the support for [Security Zones](https://docs.oracle.com/en-us/iaas/security-zone/using/security-zones.htm). Landing Zone users can now enable Security Zones for Landing Zone managed compartments and specify which policies to apply. These policies are the preventive controls that make sure a tenancy stays within the defined track as it evolves over time.  
+
+Aligning with the [CIS OCI Benchmark Configuration Profile](#2-4-0-cis-level) feature, if *cis_level* is set to 1, the provided Security Zone policies are aligned to the CIS OCI Benchmark configuration profile Level 1. If *cis_level* is set to 2, the provided Security Zone policies are aligned to the CIS OCI Benchmark configuration profile Level 2. Below are the Security Zone policies to configuration profile level.
+
+| CIS Recommendation | CIS Level | Security Zone Policy Name               | Security Zone Policy Description                                                                                                                                               |
+| ------------------ | --------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| 4.1.1              | 1         | deny public\_buckets                    | Object Storage buckets in a security zone can't be public.                                                                                                                     |
+| 2.8.0              | 1         | deny db\_instance\_public\_access       | Databases in a security zone can't be assigned to public subnets. They must use private subnets.                                                                               |
+| 4.2.1              | 2         | deny block\_volume\_without\_vault\_key | Block volumes in a security zone must use a customer-managed master encryption key in the Vault service. They can't use the default encryption key managed by Oracle.          |
+| 4.2.2              | 2         | deny boot\_volume\_without\_vault\_key  | Boot volumes in a security zone must use a customer-managed master encryption key in the Vault service. They can't use the default encryption key managed by Oracle.           |
+| 4.1.2              | 2         | deny buckets\_without\_vault\_key       | Object Storage buckets in a security zone must use a customer-managed master encryption key in the Vault service. They can't use the default encryption key managed by Oracle. |
+| 4.3.1              | 2         | deny file\_system\_without\_vault\_key  | File systems in the security zone must use a customer-managed master encryption key in the Vault service. They can't use the default encryption key managed by Oracle.         |
+
+## <a name="2-4-0-sch-update">Service Connector Hub Improved Configuration</a>
+The [Service Connector Hub module](./config/mon_service_connector.tf) as announced in [Updated Logging Architecture](#2-3-6-updated-logging) has been updated to optionally deploy Service Connector Hub related resources. As a result, existing users need to set *enable_service_connector* and *activate_service_connector* variables to *true* for Service Connector Hub resources to be created and to activate the service. For details, look at *enable_service_connector* and *activate_service_connector* variables in [VARIABLES.md](./VARIABLES.md#logging_variables).
+
+When deploying an Object Storage bucket as Service Connector target, users can now bring an existing key for bucket encryption. For details, look at *existing_service_connector_bucket_vault_compartment_id*, *existing_service_connector_bucket_vault_id* and *existing_service_connector_bucket_key_id* variables in [VARIABLES.md](./VARIABLES.md#logging_variables). Aligning with the [CIS Profile Levels](#2-4-0-cis-level) feature, if *cis_level* is set to 1, the bucket is encrypted with an Oracle-managed key; if *cis_level* is set to 2, a customer-managed key (either provided or managed by Landing Zone) is used for bucket encryption.
+
+## <a name="2-4-0-vss-update">Vulnerability Scanning Improved Configuration</a>
+Users have more control on Landing Zone Vulnerability Scanning recipes. It is now possible to specify the levels for port scan, agent-based scan and CIS setting for agent-based scans. Additionally, users can enable file scanning for Linux systems and specify the folders to scan. Variables are described in [VARIABLES.md](./VARIABLES.md#vss_variables).
+
+Vulnerability Scanning is now disabled by default in CIS Landing Zone. Moving forward, the intent is enabling by default only those services that are required by CIS Benchmark. Existing users who are managing Vulnerability Scanning resources with Landing Zone should simply enable it back, by setting *vss_create* variable to true.
+
+A bug preventing Vulnerability Scanning target creation in default enclosing compartment has been fixed.
+
+## <a name="2-4-0-appdev-bucket-update">Application Bucket Improved Configuration</a>
+Previous to this release, CIS Landing Zone would manage a sample bucket in the Application compartment (a.k.a AppDev) and encrypt it with a customer-managed key. This has changed. Now the bucket creation is optional, and when deployed, the user has a choice to bring an existing key for encryption. Aligning with the [CIS Profile Levels](#2-4-0-cis-level) feature, if *cis_level* is set to 1, the bucket is encrypted with an Oracle-managed key; if *cis_level* is set to 2, a customer-managed key (either provided or managed by Landing Zone) is used for bucket encryption.
+
+## <a name="2-4-0-datasafe-perms">Data Safe Permissions</a>
+In the config directory, management permission for the Data Safe family has been added to the Database Administrators and Exadata Infrastructure Administrators groups. Read permission for the Data Safe family has been added to the Auditors group.
+
+In the pre-config directory, read permission for the Data Safe family has been added to the Database Administrators and Auditors groups.
+
+##
+
+# July 11, 2022 Release Notes - 2.3.6
+1. [Cloud Guard Events](#2-3-6-cg-events)
+1. [Updated Logging Architecture](#2-3-6-updated-logging)
+1. [Terraform OCI Provider Moved to oracle/oci](#2-3-6-provider-switch)
+1. [Architecture Center Tag](#2-3-6-arch-center-tag)
+1. [CIS Compliance Checking Script Update](#2-3-6-cis-script-update)
+
+## <a name="2-3-6-cg-events">Cloud Guard Events</a>
+Cloud Guard events have been added to Landing Zone notifications framework. Now users can be notified about Cloud Guard problems that exceeds a user provided criticality threshold.  To support this two new variables have been added to the Cloud Guard Section: `cloud_guard_risk_level_threshold` and `cloud_guard_admin_email_endpoints`. The risk_level_threshold determines what problems will trigger the event rule and send an email to the subscription in the new topic. A level of 'High' will include any problems with a risk level of High or above. This would include High and Critical problems. The event rule looks at any of the 3 Cloud Guard events: Problem Detected, Problem Dismissed and Problem Remediated.
+
+## <a name="2-3-6-updated-logging">Updated Logging Architecture</a>
+The [Service Connector Hub module](./config/mon_service_connector.tf) has been updated to align with the [best practice architecture for third-party SIEM tools](https://github.com/oracle-quickstart/oci-arch-logging-splunk).
+Now there is a single Landing Zone Service Connector that ingests three log sources (Audit logs, VCN flow logs and Object Storage logs) into a target resource of choice: Object Storage Bucket, Stream or Function.
+Landing Zone creates the Bucket and can either create the Stream or use an existing one. If a Function is the target, it must be provided as an input.
+
+## <a name="2-3-6-provider-switch">Terraform OCI Provider Moved to oracle/oci</a>
+Landing Zone has been updated with the new home for Terraform OCI provider. It has moved to oracle/oci from hashicorp/oci. 
+- Existing Landing Zone customers who use Terraform CLI are required to replace the provider in the state file. To update the state file, run the command below in the folder where the state file is present:
+
+        > terraform state replace-provider hashicorp/oci oracle/oci
+
+- Existing Landing Zone customers who use OCI Resource Manager do not need to do anything, as Resource Manager will update the state file based on the new Landing Zone configuration. 
+
+As part of this move, we have introduced provider requirements expressed in [provider.tf](./config/provider.tf):
+- Terraform required version >= 1.0.0
+- OCI provider version >= 4.78.0
+
+## <a name="2-3-6-arch-center-tag">Architecture Center Tag</a>
+A [defined tag](./config/mon_tags.tf) to track Landing Zone deployments through [OCI Architecture Center](https://docs.oracle.com/solutions/) has been added.
+
+## <a name="2-3-6-cis-script-update">CIS Compliance Checking Script Update</a>
+The CIS Compliance checking script now consolidates regional output.  There is a single directory which contains the summary report and findings reports in a directory, the name includes the tenancy name and datetime ex. `<tenancy-name>-2022-MM-DD_HH-MM/`.  The findings CSV in that directory now have a region column to tell you which region the resource is located. 
+
+In addition two new flags have been added:
+- `--region` - pass an OCI region name(s) ex. `--region us-ashburn-1,eu-frankfurt-1` and the script will check that region's resources for CIS compliance 
+- `--raw` - will output all OCI resource data collected into CSV files with the OCI Service name 
+
+For more details on these flags [compliance-script.md](./compliance-script.md)
+
+# June 13, 2022 Release Notes - Stable 2.3.5
+1. [CIS Compliance Checking Script 1.2 update](#2-3-5-script-update)
+1. [CIS 1.2 OCI IAM Policy Updates and Storage Admin](#2-3-5-storage_admin)
+1. [Connectivity Section Usability Improvements in Resource Manager](#2-3-5-conn_usage)
+1. [Removed Public RDP Access](#2-3-5-rdp-public-removal)
+
+
+## <a name="2-3-5-script-update">CIS Compliance Checking Script 1.2 update</a>
+The CIS reports script ([cis_reports.py](./scripts/cis_reports.py)) has been updated to check a tenancy’s compliance with the [CIS OCI Foundations Benchmark 1.2.0]( https://www.cisecurity.org/benchmark/oracle_cloud).  In addition to the new compliance checks, we have streamlined the checks in non-home regions to exclude the IAM since it is redundant.  We also added a new flag `--level` which allows you to run all the CIS OCI Foundations Benchmark 1.2 checks or only those checks associated with Level 1.  The [documentation](./compliance-script.md) for the CIS reports script has been updated to reflect this release.
+
+You can learn about what was added to version 1.2 of the benchmark [here](https://www.ateam-oracle.com/post/the-center-for-internet-security-oracle-cloud-infrastructure-foundations-benchmark-12-release-update). 
+
+
+## <a name="2-3-5-storage_admin">CIS 1.2 OCI IAM Policy Updates and Storage Admin</a>
+We have introduced a group for storage management, entitled to delete OCI storage resources across Landing Zone compartments. The feature implements the recommendation 1.14 of CIS OCI Foundations Benchmark v1.2.0 that states *Ensure storage service-level admins cannot delete resources they manage*, ensuring segregation of duties from service-level administrators, who cannot delete resources they are managing.
+
+Our recommendation for using this group is to place users in it when they must delete an OCI storage resource and then remove their access once that resource is deleted.
+
+In addition we reviewed our policy for consistency.
+
+## <a name="2-3-5-conn_usage">Connectivity Section Usability Improvements</a>
+The *Connectivity* variables group in [schema.yml](./config/schema.yml) for OCI Resource Manager UI have been split for improved usability. Now we have separate sections for Hub/Spoke, Public Connectivity, Connectivity to on-premises and DRG. Some section titles and variables descriptions have also been updated.
+
+## <a name="2-3-5-rdp-public-removal">Removed Public RDP Access</a>
+We no longer grant RDP access to the bastion NSGs for `public_src_bastion_cidrs` CIDR addresses thus preventing public access to RDP.
+
+# May 11, 2022 Release Notes - Stable 2.3.4
+1. [Configurable Cloud Guard Alerting](#cg_alerting)
+1. [Advanced Options Check Preservation in Resource Manager](#orm_adv_options)
+1. [Notification Endpoints not Required by CIS Not Shown By Default](#hidden_endpoints)
+1. [ExaCS VCN Route Table Fix](#exacs_vcn_rt_fix)
+
+## <a name="cg_alerting">Configurable Cloud Guard Alerting based on Problem Risk Level</a>
+Cloud Guard Alerting can optionally be configured by the Landing Zone. Two new variables have been added to the Cloud Guard Section: cloud_guard_risk_level_threshold and cloud_guard_admin_email_endpoints. A new topic and new Event rule will be created only if a valid Email Endpoint is provided. The risk_level_threshold determines what problems will trigger the event rule and send an email to the subscription in the new topic. A level of 'High' will include any problems with a risk level of High or above. This would include High and Critical problems. The event rule looks at any of the 3 Cloud Guard events: Problem Detected, Problem Dismissed and Problem Remediated.
+
+## <a name="orm_adv_options">Advanced Options Check Preservation for Resource Manager</a>
+CIS Landing Zone interface for Resource Manager has check boxes allowing for advanced input options, hiding or showing groups of variables. The state of these options used to be reset when users needed to update the variables in the UI, hiding options chosen previously. Now the state is saved and no longer reset. Changes made in [config/variables.tf](./config/variables.tf).
+
+## <a name="hidden_endpoints">Notification Endpoints not Required by CIS Not Displayed By Default</a>
+Except for Security and Network notifications, all other endpoints are no longer displayed by default in [config/schema.yml](./config/schema.yml) for OCI Resource Manager. A new _Additional Notification Endpoints_ check box displays them when checked. 
+
+## <a name="exacs_vcn_rt_fix">ExaCS VCN Route Table Fix</a>
+A fix in the [route table of the Client subnet](./config/net_exacs_vcns.tf) allows for proper on-premises routing with or without a DMZ VCN. If a DMZ VCN is deployed, traffic to an on-premises IP address goes through the VCN. Otherwise, traffic goes to on-premises directly through the DRG.
+
+# April 6, 2022 Release Notes - Stable 2.3.3
+1. [Cloud Guard Updates](#cg_updates)
+1. [VSS Policy Update](#vss_update)
+1. [Code Examples Aligned with Deployment Guide](#code_examples)
+
+## <a name="cg_updates">Cloud Guard Updates</a>
+- [Cloud Guard policy](./config/iam_service_policies.tf) has been simplified with *Allow service cloudguard to read all-resources in tenancy*. This way no policy changes are needed as new services are integrated with Cloud Guard.
+- [Cloud Guard enablement](./config/mon_cloud_guard.tf) and [target creation logic](./modules/monitoring/cloud-guard/main.tf) have been updated, but still based on *cloud_guard_configuration_status* variable. When the variable is set to 'ENABLE', Cloud Guard is enabled and a target is created for the Root compartment. **Customers need to make sure there is no pre-existing Cloud Guard target for the Root compartment or target creation will fail**. If there is a **pre-existing** Cloud Guard target for the Root compartment, set the variable to 'DISABLE'. In this case, any **pre-existing** Cloud Guard Root target is left intact. However, keep in mind that once you set the variable to 'ENABLE', Cloud Guard Root target becomes managed by Landing Zone. If later on you switch to 'DISABLE', Cloud Guard remains enabled but the Root target is deleted.
+
+## <a name="vss_update">VSS Policy Update</a>
+[Policy update](./config/iam_service_policies.tf) allowing Vulnerability Scanning Service (VSS) to scan containers in OCI Registry: *Allow service vulnerability-scanning-service to read repos in tenancy*.
+
+## <a name="code_examples">Code Examples Aligned with Deployment Guide</a>
+An [examples](./examples/) folder has been added showcasing input variables for the various deployment samples provided in the [deployment guide](DEPLOYMENT-GUIDE.md). The examples follow Oracle documentation guidelines for acceptable company name.
+
+# March 18, 2022 Release Notes - Stable 2.3.2
+1. [Deployment Guide](#deployment_guide)
+1. [Reviewed IAM Admin Policies](#iam_policies_review)
+
+## <a name="deployment_guide">Deployment Guide</a>
+A compreehensive [deployment guide](DEPLOYMENT-GUIDE.md) for CIS Landing Zone is now available. It covers key deployment considerations, the architecture, major deployment scenarios, customization guidance, detailed steps how to deploy using Terraform CLI and with Resource Manager UI/CLI as well as various deployment configuration samples.
+
+## <a name="iam_policies_review">Reviewed IAM Admin Policies</a>
+IAM admin policy has been updated to not allow IAM administrators to manage compartments and policies at the Root compartment, thus avoiding privilege escalation.
+
+# February 25, 2022 Release Notes - Stable 2.3.1
+1. [Configurable Spoke Subnet Names and Subnet Sizes](#spoke_config)
+1. [Updated Compute Dynamic Group to support OS Management](#dg_osms)
+1. [Fixed Internet Gateway Creation in ExaCS VCN](#exacs_fix)
+1. [Updated Bastion NSG to include RDP](#rdp_update)
+1. [Tagging Support](#tagging)
+
+## <a name="spoke_config">Configurable Spoke Subnet Names and Subnet Sizes</a>
+The names and the size of subnets created in spoke VCN(s) can now be configured using the variables: **subnets_names** and **subnets_sizes**. Ex. `["front", "middle", "back"]` and `["12","8","10"]`.  Additional customization of spoke VCNs can be done in net_vcn.tf or with  using [Terraform Override Files](https://www.terraform.io/language/files/override).
+Check [Known Issues](README.md#know-issues) section for an issue affecting custom subnets sizes in Resource Manager UI.
+
+## <a name="dg_osms">Updated Compute Dynamic Group to support OS Management</a>
+Added IAM policy statements to the compute agent dynamic group policy to include support for OS Management.
+
+## <a name="exacs_fix">Fixed Internet Gateway Creation in ExaCS VCN</a>
+Disabled creation of Internet Gateway in ExaCS VCNs.
+
+## <a name="rdp_update">Updated Bastion NSG to include RDP</a>
+Added port 3389 to the Bastion Network Security Group (NSG) to support Remote Desktop Protocol (RDP) for Windows based instances.
+
+## <a name="tagging">Tagging Support</a>
+The Landing Zone fully supports definition and usage of defined_tags and freeform_tags for all resources. In this release there is no additional variable to be set in the quickstart-input.tfvars. Tag definition and usage can be set using [Terraform Override Files](https://www.terraform.io/language/files/override).
+
+Usage Overview:
+- Defined tags - At the moment, using Defined Tags is a two step process.
+  1. Create the defined tags.
+  1. Use the defined tags.
+- Freeform tags - Freeform tags can be used at any time. You simply assign a map of freeform tags, to a predefined local variable in an override file, for example ```all_keys_freeform_tags = {"cis-landing-zone" : "${var.service_label}-quickstart"}```.
+
+Please note that space characters (' ') in the tag names are not supported by OCI.
+
+# February 02, 2022 Release Notes - Stable 2.3.0
+1. [Cross Region Landing Zone](#cross_region_lz_2_3_0)
+1. [Bring Existing Dynamic Groups](#byodg_2_3_0)
+1. [CCCS Guard Rails](#script_2_3_0)
+1. [Landing Zone Logo](#lz_logo_2_3_0)
+1. [Customized VCN and Subnet deployment option](#lz_vcn_2_3_0)
+
+## <a name="cross_region_lz_2_3_0">Cross Region Landing Zone</a>
+When you run Landing Zone's Terraform, some resources are created in the home region, while others are created in a region of choice. Among home region resources are compartments, groups, dynamic groups, policies, tag defaults and an infrastructure for IAM related notifications (including events, topics and subscriptions). Among resources created in the region of choice are VCNs, Log Groups, and those pertaining to security services like Vault Service, Vulnerability Scanning, Service Connector Hub, Bastion. The home region resources are automatically made available by OCI in all subscribed regions.
+
+Some customers want to extend their Landing Zone to more than one region of choice, while reusing the home region resources. One typical use case is setting up a second region of choice for disaster recovery, reusing the same home region Landing Zone resources. A more broad use case is implementing a single global Landing Zone across all subscribed regions. These use cases are now supported via the newly introduced *extend_landing_zone_to_new_region*. When set to true, compartments, groups, dynamic groups, policies and resources pertaining to home region are not provisioned, but reused instead.
+
+## <a name="byodg_2_3_0">Bring Existing Dynamic Groups</a>
+As with groups, Landing Zone now supports reusing existing *dynamic* groups. These dynamic groups are thought to be used by OCI Functions, Compute's management agent and databases for calling out other services. 
+
+## <a name="script_2_3_0">CCCS Guard Rails</a>
+The Compliance Checking script's summary report now includes a column for CCCS Guard Rails.
+
+## <a name="lz_logo_2_3_0">Landing Zone Logo</a>
+Landing Zone has been gifted with a logo. A courtesy from our colleague [Chris Johnson](https://github.com/therealcmj).   
+
+## <a name="lz_vcn_2_3_0">Customized VCN and Subnet deployment option</a>
+This release provides the option to easily customize your VCNs and Subnets in terms of cidr ranges and naming using a map resource called custom_vcns_map.
+Please note as part of this release we have also updated the default Database subnet to include a routing rule for sending traffic destined for 0.0.0.0/0 to the NAT Gateway.
+However the default Network Security Group will still prevent any egress to the internet until it is changed by you.
+
+
+# December 02, 2021 Release Notes - Stable 2.2.0
+1. [Updated Topics and Subscription Module (Impacts existing deployments)](#topics_2_2_0)
+1. [Enablement of Operational Events and Alarms Specific to Compute, Storage, Database and Governance](#events_and_alarms_2_2_0)
+1. [Compliance Checking Script Runs in All Regions](#script_update_2_2_0)
+1. [Click to Deploy button](#click_to_deploy_2_2_0)
+1. [Added SVG versions of Core Architecture Files](#svg_architecture_files)
+1. [Added an optional Budget and Budget Alert Rule](#budget_2_2_0)
+
+
+## <a name="topics_2_2_0">Updated Topics and Subscription Module (Impacts existing deployments)</a>
+In previous versions of the Landing Zone Topics and Subscriptions were a single module.  Going forward there will be a [Topics Module](modules/topics-v2/toopics/README.md) and a [Subscription Module](modules/topics-v2/subscriptions/README.md). **Due to this change upgrading an existing Landing Zone deployment will cause the Security Topic and Subscriptions as well as the Network Topic and Subscriptions to be deleted and recreated.** This will require users receiving these email notifications to re-accept their subscriptions.
+
+## <a name="events_and_alarms_2_2_0">Enablement of Operational Events and Alarms Specific to Compute, Storage, Database and Governance</a>
+Customers can now deploy events and alarms specific to operational areas including Compute, Storage, Database and Governance as part of the default Landing Zone deployment. Operational alarms and events can be enabled by entering an email address in. This includes following alarms:
+- AppDev Compartment
+    - Instance based monitoring and alerting of high cpu and high memory usage for instances deployed in the AppDev compartment.
+    - Bare metal unhealthy and VM maintenance alarms are also part of the new core compute alarm set.
+- Database Compartment 
+    - Databases deployed in the Database compartment operational events and alerts have been enabled for for high ADB CPU and high ADB Storage usage.
+    - Autonomous Database Critical Events and ExaData CS Infrastructure events are now tracked in this release.
+- Network Compartment
+    - Up/Down status for VPN and FastConnect services in the Network compartment of the Landing Zone.
+
+## <a name="script_update_2_2_0">Compliance Checking Script Runs in All Regions</a>
+The compliance checking script now runs checks on all available regions in the tenancy and has improved handling of Oracle PSM policy statements.
+
+## <a name="click_to_deploy_2_2_0">Click to Deploy button</a>
+Resource Manager stack can be created directly from GitHub repository through a single button click. The zip file with the source code is passed directly to Resource Manager Create Stack API. 
+
+## <a name="svg_architecture_files">Added SVG versions of Core Architecture Files</a>
+Added SVG versions of Core Architecture Files so users can modify the architectures using Draw.io.
+
+## <a name="budget_2_2_0">Added an optional Budget and Budget Alert Rule</a>
+Customers can now choose to deploy a budget at the root or enclosing compartment level to track monthly spending and be alerted if a forcasted spending breaches a defined threshold. 
+
+A Cost Managment Admin group is also created that grants permission to Create,Update,Delete budgets and also review Cost Data in the UI or by downloading the detailed Cost Reports.
+Cost Data View Only permissions have been added to the policies for: Auditor, Database Admin, AppDev Admin, Network Admin and Security Admin allowing members of these groups to review spending. 
+  
+# October 13, 2021 Release Notes - Stable 2.1.1
+1. [CIS Compliance Checking Script Updates](#cis_script_2_1_1)
+1. [Bastion Service Enabled by public_src_bastion_cidrs](#bastion_service_update)
+
+## <a name="cis_script_2_1_1">CIS Compliance Checking Script Updates</a>
+CIS Compliance checking script will now prepend the OCI tenancy's display name to the output directory it creates if no directory is specified.  An example output directory `tenancy_display_name-20211013`.
+
+## <a name="bastion_service_update">Bastion Service Enabled by public_src_bastion_cidrs</a>
+Now [OCI Bastion service] (https://docs.oracle.com/en-us/iaas/Content/Bastion/Concepts/bastionoverview.htm) is enabled when one or more *public_src_bastion_cidrs* are provided **and** a single VCN deployment is selected.  In the previous version it was enabled by default in a single VCN deployment.
+
+# September 24, 2021 Release Notes - Stable 2.1.0
+1. [Ability to Provision Infrastructure for Exadata Cloud Service Deployments](#exadata_2_1_0)
+1. [OCI Bastion Service Integration](#bastion_2_1_0)
+1. [Individual Security Lists for Subnets](#sec_lists_2_1_0)
+1. [Ability to Rename Compartments](#cmp_renaming_2_1_0)
+1. [Updates to NSGs and Route Rules Descriptions](#rules_descriptions_update_2_1_0)
+1. [Input Variable for SSH Connectivity from On-premises Network](#on_prem_ssh_cidrs_2_1_0)
+1. [Updates to Resource Manager Interface](#orm_update_2_1_0)
+
+## <a name="exadata_2_1_0">Ability to Provision Infrastructure for Exadata Cloud Service Deployments</a>
+Landing Zone can now provision VCNs, compartment, group and policies for Exadata Cloud Service (ExaCS) deployments. The provisioned resources are deployed in tandem with the overall Landing Zone configuration. VCNs are provisioned with client and backup subnets. If a Hub & Spoke network architecture is being deployed, the ExaCS VCNs are configured as spoke VCNs. A compartment is by default created for the ExaCS infrastructure and an extra group and policies are configured accordingly. Optionally, users may opt for deploying ExaCS infrastructure in the database compartment with appropriate permissions granted to database administrators.
+
+## <a name="bastion_2_1_0">OCI Bastion Service Integration</a>
+Customers can now leverage OCI Bastion Service in Landing Zone. A Bastion resource is provisioned into a VCN if a single VCN or a single ExaCS VCN is being deployed. Customers can later on create a Bastion session using the provisioned Bastion resource. The Bastion resource is not provisioned for Hub & Spoke architecture or if the Landing Zone VCNs are connected to an on-premises network. In these cases, SSH inbound access is expected to be provided by Bastion servers in the DMZ (Hub) or hosts in the on-premises network.
+
+## <a name="sec_lists_2_1_0">Individual Security Lists for Subnets</a>
+Individual security lists are now created for all subnets. This is useful for customers planning on deploying services that require Security Lists instead of Network Security Groups.
+
+## <a name="cmp_renaming_2_1_0">Ability to Rename Compartments</a>
+Landing Zone creates compartments with auto-generated names, prefixed by the service_label variable value. Landing Zone compartments can be renamed at any point in time with all policies adjusted accordingly. 
+
+## <a name="rules_descriptions_update_2_1_0">Updates to NSGs and Route Rules Descriptions</a>
+The descriptions of rules in NSGs and route tables have been updated aiming at more clarity and verbiage standardization.
+
+## <a name="on_prem_ssh_cidrs_2_1_0">Input Variable for SSH Connectivity from On-premises Network</a>
+Variable *onprem_src_ssh_cidrs* is introduced. It is a list of on-premises CIDR blocks allowed to connect to Landing Zone over SSH. It is added to network security rules for ingress connectivity to Landing Zone networks. The *on_prem_ssh_cidrs* must be a subset of the *onprem_cidrs* variable, which are used for routing between on-premises and Landing Zone networks.
+
+## <a name="orm_update_2_1_0">Updates to Resource Manager Interface</a>
+With the introduction of Exadata Cloud Service support, Landing Zone schema.yaml has been updated for better usability in OCI Resource Manager. A new variable group named 'Connectivity' has been introduced, containing variables for defining properties that control the sources and destinations for Landing Zone connectivity. 
+
+
+# August 12, 2021 Release Notes - Stable 2.0.3
+1. [Ability to use existing Dynamic Routing Gateway (DRG) v2 with the Landing Zone](#existing_drg_2_0_3)
+1. [Consolidated Network and IAM Notifications](#notifications_consolidation_2_0_3)
+1. [Database Customer Managed Key Support](#database_key_support_2_0_3)
+1. [Compliance Checking supports free tier tenancy](#cis_report_update_2_0_3)
+
+
+## <a name="existing_drg_2_0_3"></a>1. Ability to use existing Dynamic Routing Gateway (DRG) with the Landing Zone
+Customers that have an existing DRG v2 (a DRG created after April 15, 2021) can now use that existing DRG v2 instead of having the Landing Zone create a new DRG v2. This is useful for customers that have connected a FastConnect to an existing DRG.
+
+## <a name="notifications_consolidation_2_0_3"></a>2. Consolidated Network and IAM Notifications
+In previous versions of the Landing Zone notification event rules were created for each CIS benchmark monitoring recommendation.  To help reduce the number of event rules created all the IAM recommendations are combined into a single event rule and all the network recommendations are combined into another event rule. 
+
+## <a name="database_key_support_2_0_3"></a>3. Autonomous Database Customer Managed Key Support
+Database Administrators now have the ability to use keys from OCI Vaults in the security compartment to encrypt databases in the database compartment.
+
+## <a name="cis_report_update_2_0_3"></a>4. Compliance Checking supports free tier tenancy
+Compliance Checking script can now be run free tier OCI tenancy.
+
+# July 2021 Release Notes - Stable 2.0.0
+1. [Ability to provision the Landing Zone with narrower permissions](#narrower_permissions)
+1. [Ability to provision Landing Zone within an enclosing compartment at any level in the compartment hierarchy](#enclosing_compartment)
+1. [Ability to reuse existing groups when provisioning the Landing Zone](#existing_groups)
+1. [Hub and Spoke Network Architecture plus networking enhancements](#hub_spoke_network)
+
+
+## <a name="narrower_permissions"></a>1. Ability to provision the Landing Zone with narrower permissions
+Before this release, the Landing Zone required a user with wide permissions in the tenancy in order to be provisioned. Typically, but not necessarily, this user was a member of the *Administrators* group. That has changed. Now the Landing Zone can be provisioned by a user with narrower permissions. However, some pre-requisites need to be satisfied. Specifically, the Landing Zone requires policies created at the tenancy level and broad permissions at the compartment where it is going to be provisioned. 
+
+The Landing Zone handles these requirements with a new Terraform root module that's expected to be executed by a user with wide permissions (typically a member of the *Administrators* group). The module is available in the *pre-config* folder and provisions the following:
+	
+1. An enclosing compartment for the Landing Zone compartments. 
+2. Optionally, a group with the required permissions to provision the Landing Zone in the enclosing compartment.
+3. Optionally, Landing Zone required groups for segregation of duties. These groups can then simply be reused when provisioning the Landing Zone.
+4. Optionally, required permissions at the tenancy level granted to Landing Zone groups, like permissions granted to Security and IAM administrators.
+
+The variables controlling the pre-config module behavior are described in [Pre-Config Module Variables section](VARIABLES.md#pre_config_input_variables).
+	
+## <a name="enclosing_compartment"></a>2. Ability to provision Landing Zone within an enclosing compartment at any level in the compartment hierarchy
+This can be done by a *wide-permissioned* user or a *narrower-permissioned* user. If done by the *wide-permissioned* user, the steps described in the previous section MUST be skipped. If done by a *narrower-permissioned* user, the steps in the previous section are required. **A _narrower-permissioned_ user is only allowed to provision the Landing Zone in a enclosing compartment previously designated by a _wide-permissioned_ user.**
+	
+The existing Landing Zone config module has been extended to support this use case. The module keeps backwards compatibility, i.e., the new variables default values keeps the module current behavior unchanged. In other words, if you execute the config module as-is, the four Landing Zone compartments are created directly under the root compartment with all policies created at the root compartment. 
+
+The module behavior is controlled by variables described in the [Enclosing Compartment Variables section](VARIABLES.md#enc_cmp_variables).
+	
+## <a name="existing_groups"></a>3. Ability to reuse existing groups when provisioning the Landing Zone
+Previously, every Landing Zone execution would create groups. However, it's acknowledged that a customer may want to create multiple Landing Zones but only one set of groups, reusing them across the Landing Zones. 
+
+The module behavior is controlled by variables described in the [Existing Groups Reuse Variables section](VARIABLES.md#existing_groups_variables).
+
+## <a name="hub_spoke_network"></a>4. Hub and Spoke Network Architecture plus networking enhancements
+
+Before this release, the Landing Zone would deploy a single VCN with three subnets designed for a 3-tier application with DRG if on-premises connectivity was required.  In this new release we enhanced the networking and network security modules to can support the creation of multiple VCNs (spokes or stand-alone) and the following Hub and Spoke network architectures:
+- **Access to multiple VCNs in the same region:** This scenario enables communication between an on-premises network and multiple VCNs in the same region over a single FastConnect private virtual circuit or Site-to-Site VPN and uses a DRG as the hub.
+- **Access between multiple networks through a single DRG with a firewall between networks:** This scenario connects several VCNs to a single DRG, with all routing configured to send packets through a firewall in a hub VCN before they can be sent to another network.
+
+In addition to the above architectures, you can choose if want to allow the creation of Internet Gateways and NAT Gateways to provide a more isolated network. Lastly, we have also added support for various network variables to take lists of CIDR ranges instead of a single CIDR. 
+
+The module behavior is controlled by variables described in the [Networking Variables section](VARIABLES.md#networking-variables).
+
+
+# June 2021 Release Notes - Stable 1.1.1
+1. [Logging Consolidation with Service Connector Hub](#logging_consolidation)
+1. [Vulnerability Scanning](#vulnerability_scanning)
+
+	
+## <a name="logging_consolidations"></a>1. Logging Consolidation with Service Connector Hub
+The Landing Zone enables/collects logs for a few services, like VCN and Audit services. From a governance perspective, it's interesting that these logs get consolidated and made available to security management tools. This capability is now availabe in the Landing Zone with the Service Connector Hub, that reads logs from different sources and sends them to a target that the user chooses. By default, this target is a bucket in the Object Storage service, but functions and streams can also be configured as targets. As the usage of a bucket, function or stream may incur in costs to our customers, Landing Zone users must explicitly activate Service Connector Hub by setting variables in the Terraform configuration, as described in [Logging Variables](terraform.md#logging_variables) section.
+
+To delete or change a Service Connector that has an Object Storage bucket as a target, you must manually remove the target from the Service Connector and manually delete the bucket. A bucket with objects cannot be deleted via Terraform.
+
+## <a name="vulnerability_scanning"></a>2. Vulnerability Scanning
+The Landing Zone now enables scanning through the Vulnerability Scanning Service (VSS), creating a scan recipe and scan targets by default. The recipe is set to run every week on sundays and the targets are set to all four Landing Zone compartments. Running the Landing Zone as is, weekly scans are automatically executed for any instances deployed in any of the Landing Zone compartments. The scan results are made available in the Security compartment and can be verified in the OCI Console. 
+
+Scanning can be disabled in the Landing Zone, and the scan frequency and targets can be changed as well. Disabling scanning and changing the frequency are controlled by setting variables in the Terraform configuration, as described in [Scanning Variables](terraform.md#vss_variables) section, while targets can be changed in the vss.tf file. The Vulnerability Scanning Service is free.
diff --git a/scripts/cis_reports.py b/scripts/cis_reports.py
index f5c0df79..a288c9d7 100644
--- a/scripts/cis_reports.py
+++ b/scripts/cis_reports.py
@@ -35,9 +35,9 @@
 except Exception:
     OUTPUT_TO_XLSX = False
 
-RELEASE_VERSION = "2.8.2"
-PYTHON_SDK_VERSION = "2.125.3"
-UPDATED_DATE = "April 18, 2024"
+RELEASE_VERSION = "2.8.3"
+PYTHON_SDK_VERSION = "2.127.0"
+UPDATED_DATE = "June 7, 2024"
 
 
 ##########################################################################
@@ -605,57 +605,57 @@ def __init__(self, config, signer, proxy, output_bucket, report_directory, repor
 
         # CIS monitoring notifications check
         self.cis_monitoring_checks = {
-            "4.4": [
+            "4.3": [
                 'com.oraclecloud.identitycontrolplane.createidentityprovider',
                 'com.oraclecloud.identitycontrolplane.deleteidentityprovider',
                 'com.oraclecloud.identitycontrolplane.updateidentityprovider'
             ],
-            "4.5": [
+            "4.4": [
                 'com.oraclecloud.identitycontrolplane.createidpgroupmapping',
                 'com.oraclecloud.identitycontrolplane.deleteidpgroupmapping',
                 'com.oraclecloud.identitycontrolplane.updateidpgroupmapping'
             ],
-            "4.6": [
+            "4.5": [
                 'com.oraclecloud.identitycontrolplane.creategroup',
                 'com.oraclecloud.identitycontrolplane.deletegroup',
                 'com.oraclecloud.identitycontrolplane.updategroup'
             ],
-            "4.7": [
+            "4.6": [
                 'com.oraclecloud.identitycontrolplane.createpolicy',
                 'com.oraclecloud.identitycontrolplane.deletepolicy',
                 'com.oraclecloud.identitycontrolplane.updatepolicy'
             ],
-            "4.8": [
+            "4.7": [
                 'com.oraclecloud.identitycontrolplane.createuser',
                 'com.oraclecloud.identitycontrolplane.deleteuser',
                 'com.oraclecloud.identitycontrolplane.updateuser',
                 'com.oraclecloud.identitycontrolplane.updateusercapabilities',
                 'com.oraclecloud.identitycontrolplane.updateuserstate'
             ],
-            "4.9": [
+            "4.8": [
                 'com.oraclecloud.virtualnetwork.createvcn',
                 'com.oraclecloud.virtualnetwork.deletevcn',
                 'com.oraclecloud.virtualnetwork.updatevcn'
             ],
-            "4.10": [
+            "4.9": [
                 'com.oraclecloud.virtualnetwork.changeroutetablecompartment',
                 'com.oraclecloud.virtualnetwork.createroutetable',
                 'com.oraclecloud.virtualnetwork.deleteroutetable',
                 'com.oraclecloud.virtualnetwork.updateroutetable'
             ],
-            "4.11": [
+            "4.10": [
                 'com.oraclecloud.virtualnetwork.changesecuritylistcompartment',
                 'com.oraclecloud.virtualnetwork.createsecuritylist',
                 'com.oraclecloud.virtualnetwork.deletesecuritylist',
                 'com.oraclecloud.virtualnetwork.updatesecuritylist'
             ],
-            "4.12": [
+            "4.11": [
                 'com.oraclecloud.virtualnetwork.changenetworksecuritygroupcompartment',
                 'com.oraclecloud.virtualnetwork.createnetworksecuritygroup',
                 'com.oraclecloud.virtualnetwork.deletenetworksecuritygroup',
                 'com.oraclecloud.virtualnetwork.updatenetworksecuritygroup'
             ],
-            "4.13": [
+            "4.12": [
                 'com.oraclecloud.virtualnetwork.createdrg',
                 'com.oraclecloud.virtualnetwork.deletedrg',
                 'com.oraclecloud.virtualnetwork.updatedrg',
@@ -2714,6 +2714,7 @@ def __adb_read_adbs(self):
         try:
             for region_key, region_values in self.__regions.items():
                 # UPDATED JB
+                #adb_query_resources = self.__search_query_resource_type("AutonomousDatabase", region_values['search_client'])
                 adb_query_resources = oci.pagination.list_call_get_all_results(
                     region_values['search_client'].search_resources,
                     search_details=oci.resource_search.models.StructuredSearchDetails(
@@ -2721,7 +2722,6 @@ def __adb_read_adbs(self):
                 ).data
 
                 compartments = set()
-
                 for adb in adb_query_resources:
                     compartments.add(adb.compartment_id)
 
@@ -2730,268 +2730,33 @@ def __adb_read_adbs(self):
                         region_values['adb_client'].list_autonomous_databases,
                         compartment_id=compartment
                     ).data
+                    # autonomous_databases = region_values['adb_client'].list_autonomous_databases(
+                    #         compartment_id=compartment
+                    #         ).data
                     for adb in autonomous_databases:
                         try:
                             deep_link = self.__oci_adb_uri + adb.id + '?region=' + region_key
                             # Issue 295 fixed
                             if adb.lifecycle_state not in [ oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_TERMINATED, oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_TERMINATING, oci.database.models.AutonomousDatabaseSummary.LIFECYCLE_STATE_UNAVAILABLE ]:
-                                record = {
-                                    "id": adb.id,
-                                    "display_name": adb.display_name,
-                                    "deep_link": self.__generate_csv_hyperlink(deep_link, adb.display_name),
-                                    "apex_details": adb.apex_details,
-                                    "are_primary_whitelisted_ips_used": adb.are_primary_whitelisted_ips_used,
-                                    "autonomous_container_database_id": adb.autonomous_container_database_id,
-                                    "autonomous_maintenance_schedule_type": adb.autonomous_maintenance_schedule_type,
-                                    "available_upgrade_versions": adb.available_upgrade_versions,
-                                    "backup_config": adb.backup_config,
-                                    "compartment_id": adb.compartment_id,
-                                    "connection_strings": adb.connection_strings,
-                                    "connection_urls": adb.connection_urls,
-                                    "cpu_core_count": adb.cpu_core_count,
-                                    "customer_contacts": adb.cpu_core_count,
-                                    "data_safe_status": adb.data_safe_status,
-                                    "data_storage_size_in_gbs": adb.data_storage_size_in_gbs,
-                                    "data_storage_size_in_tbs": adb.data_storage_size_in_tbs,
-                                    "database_management_status": adb.database_management_status,
-                                    "dataguard_region_type": adb.dataguard_region_type,
-                                    "db_name": adb.db_name,
-                                    "db_version": adb.db_version,
-                                    "db_workload": adb.db_workload,
-                                    "defined_tags": adb.defined_tags,
-                                    "failed_data_recovery_in_seconds": adb.failed_data_recovery_in_seconds,
-                                    "freeform_tags": adb.freeform_tags,
-                                    "infrastructure_type": adb.infrastructure_type,
-                                    "is_access_control_enabled": adb.is_access_control_enabled,
-                                    "is_auto_scaling_enabled": adb.is_auto_scaling_enabled,
-                                    "is_data_guard_enabled": adb.is_data_guard_enabled,
-                                    "is_dedicated": adb.is_dedicated,
-                                    "is_free_tier": adb.is_free_tier,
-                                    "is_mtls_connection_required": adb.is_mtls_connection_required,
-                                    "is_preview": adb.is_preview,
-                                    "is_reconnect_clone_enabled": adb.is_reconnect_clone_enabled,
-                                    "is_refreshable_clone": adb.is_refreshable_clone,
-                                    "key_history_entry": adb.key_history_entry,
-                                    "key_store_id": adb.key_store_id,
-                                    "key_store_wallet_name": adb.key_store_wallet_name,
-                                    "kms_key_id": adb.kms_key_id,
-                                    "kms_key_lifecycle_details": adb.kms_key_lifecycle_details,
-                                    "kms_key_version_id": adb.kms_key_version_id,
-                                    "license_model": adb.license_model,
-                                    "lifecycle_details": adb.lifecycle_details,
-                                    "lifecycle_state": adb.lifecycle_state,
-                                    "nsg_ids": adb.nsg_ids,
-                                    "ocpu_count": adb.ocpu_count,
-                                    "open_mode": adb.open_mode,
-                                    "operations_insights_status": adb.operations_insights_status,
-                                    "peer_db_ids": adb.peer_db_ids,
-                                    "permission_level": adb.permission_level,
-                                    "private_endpoint": adb.private_endpoint,
-                                    "private_endpoint_ip": adb.private_endpoint_ip,
-                                    "private_endpoint_label": adb.private_endpoint_label,
-                                    "refreshable_mode": adb.refreshable_mode,
-                                    "refreshable_status": adb.refreshable_status,
-                                    "role": adb.role,
-                                    "scheduled_operations": adb.scheduled_operations,
-                                    "service_console_url": adb.service_console_url,
-                                    "source_id": adb.source_id,
-                                    "standby_whitelisted_ips": adb.standby_whitelisted_ips,
-                                    "subnet_id": adb.subnet_id,
-                                    "supported_regions_to_clone_to": adb.supported_regions_to_clone_to,
-                                    "system_tags": adb.system_tags,
-                                    "time_created": adb.time_created.strftime(self.__iso_time_format),
-                                    "time_data_guard_role_changed": str(adb.time_data_guard_role_changed),
-                                    "time_deletion_of_free_autonomous_database": str(adb.time_deletion_of_free_autonomous_database),
-                                    "time_local_data_guard_enabled": str(adb.time_local_data_guard_enabled),
-                                    "time_maintenance_begin": str(adb.time_maintenance_begin),
-                                    "time_maintenance_end": str(adb.time_maintenance_end),
-                                    "time_of_last_failover": str(adb.time_of_last_failover),
-                                    "time_of_last_refresh": str(adb.time_of_last_refresh),
-                                    "time_of_last_refresh_point": str(adb.time_of_last_refresh_point),
-                                    "time_of_last_switchover": str(adb.time_of_last_switchover),
-                                    "time_of_next_refresh": str(adb.time_of_next_refresh),
-                                    "time_reclamation_of_free_autonomous_database": str(adb.time_reclamation_of_free_autonomous_database),
-                                    "time_until_reconnect_clone_enabled": str(adb.time_until_reconnect_clone_enabled),
-                                    "used_data_storage_size_in_tbs": str(adb.used_data_storage_size_in_tbs),
-                                    "vault_id": adb.vault_id,
-                                    "whitelisted_ips": adb.whitelisted_ips,
-                                    "region": region_key,
-                                    "notes": ""
-                                }
+                                record = oci.util.to_dict(adb)
+                                record['deep_link'] = self.__generate_csv_hyperlink(deep_link, adb.display_name)
+                                record['error'] = ""
+                                self.__autonomous_databases.append(record)
                             else:
-                                record = {
-                                    "id": adb.id,
-                                    "display_name": adb.display_name,
-                                    "deep_link": self.__generate_csv_hyperlink(deep_link, adb.display_name),
-                                    "apex_details": "",
-                                    "are_primary_whitelisted_ips_used": "",
-                                    "autonomous_container_database_id": "",
-                                    "autonomous_maintenance_schedule_type": "",
-                                    "available_upgrade_versions": "",
-                                    "backup_config": "",
-                                    "compartment_id": adb.compartment_id,
-                                    "connection_strings": "",
-                                    "connection_urls": "",
-                                    "cpu_core_count": "",
-                                    "customer_contacts": "",
-                                    "data_safe_status": "",
-                                    "data_storage_size_in_gbs": "",
-                                    "data_storage_size_in_tbs": "",
-                                    "database_management_status": "",
-                                    "dataguard_region_type": "",
-                                    "db_name": "",
-                                    "db_version": "",
-                                    "db_workload": "",
-                                    "defined_tags": "",
-                                    "failed_data_recovery_in_seconds": "",
-                                    "freeform_tags": "",
-                                    "infrastructure_type": "",
-                                    "is_access_control_enabled": "",
-                                    "is_auto_scaling_enabled": "",
-                                    "is_data_guard_enabled": "",
-                                    "is_dedicated": "",
-                                    "is_free_tier": "",
-                                    "is_mtls_connection_required": "",
-                                    "is_preview": "",
-                                    "is_reconnect_clone_enabled": "",
-                                    "is_refreshable_clone": "",
-                                    "key_history_entry": "",
-                                    "key_store_id": "",
-                                    "key_store_wallet_name": "",
-                                    "kms_key_id": "",
-                                    "kms_key_lifecycle_details": "",
-                                    "kms_key_version_id": "",
-                                    "license_model": "",
-                                    "lifecycle_details": "",
-                                    "lifecycle_state": adb.lifecycle_state,
-                                    "nsg_ids": "",
-                                    "ocpu_count": "",
-                                    "open_mode": "",
-                                    "operations_insights_status": "",
-                                    "peer_db_ids": "",
-                                    "permission_level": "",
-                                    "private_endpoint": "",
-                                    "private_endpoint_ip": "",
-                                    "private_endpoint_label": "",
-                                    "refreshable_mode": "",
-                                    "refreshable_status": "",
-                                    "role": "",
-                                    "scheduled_operations": "",
-                                    "service_console_url": "",
-                                    "source_id": "",
-                                    "standby_whitelisted_ips": "",
-                                    "subnet_id": "",
-                                    "supported_regions_to_clone_to": "",
-                                    "system_tags": "",
-                                    "time_created": "",
-                                    "time_data_guard_role_changed": "",
-                                    "time_deletion_of_free_autonomous_database": "",
-                                    "time_local_data_guard_enabled": "",
-                                    "time_maintenance_begin": "",
-                                    "time_maintenance_end": "",
-                                    "time_of_last_failover": "",
-                                    "time_of_last_refresh": "",
-                                    "time_of_last_refresh_point": "",
-                                    "time_of_last_switchover": "",
-                                    "time_of_next_refresh": "",
-                                    "time_reclamation_of_free_autonomous_database": "",
-                                    "time_until_reconnect_clone_enabled": "",
-                                    "used_data_storage_size_in_tbs": "",
-                                    "vault_id": "",
-                                    "whitelisted_ips": "",
-                                    "region": region_key,
-                                    "notes": ""
-                                }
+                                record = record = oci.util.to_dict(adb)
+                                record['deep_link'] = self.__generate_csv_hyperlink(deep_link, adb.display_name)
+                                record['error'] = ""
+                                self.__autonomous_databases.append(record)
                         except Exception as e:
-                            record = {
-                                "id": "",
-                                "display_name": "",
-                                "deep_link": "",
-                                "apex_details": "",
-                                "are_primary_whitelisted_ips_used": "",
-                                "autonomous_container_database_id": "",
-                                "autonomous_maintenance_schedule_type": "",
-                                "available_upgrade_versions": "",
-                                "backup_config": "",
-                                "compartment_id": "",
-                                "connection_strings": "",
-                                "connection_urls": "",
-                                "cpu_core_count": "",
-                                "customer_contacts": "",
-                                "data_safe_status": "",
-                                "data_storage_size_in_gbs": "",
-                                "data_storage_size_in_tbs": "",
-                                "database_management_status": "",
-                                "dataguard_region_type": "",
-                                "db_name": "",
-                                "db_version": "",
-                                "db_workload": "",
-                                "defined_tags": "",
-                                "failed_data_recovery_in_seconds": "",
-                                "freeform_tags": "",
-                                "infrastructure_type": "",
-                                "is_access_control_enabled": "",
-                                "is_auto_scaling_enabled": "",
-                                "is_data_guard_enabled": "",
-                                "is_dedicated": "",
-                                "is_free_tier": "",
-                                "is_mtls_connection_required": "",
-                                "is_preview": "",
-                                "is_reconnect_clone_enabled": "",
-                                "is_refreshable_clone": "",
-                                "key_history_entry": "",
-                                "key_store_id": "",
-                                "key_store_wallet_name": "",
-                                "kms_key_id": "",
-                                "kms_key_lifecycle_details": "",
-                                "kms_key_version_id": "",
-                                "license_model": "",
-                                "lifecycle_details": "",
-                                "lifecycle_state": "",
-                                "nsg_ids": "",
-                                "ocpu_count": "",
-                                "open_mode": "",
-                                "operations_insights_status": "",
-                                "peer_db_ids": "",
-                                "permission_level": "",
-                                "private_endpoint": "",
-                                "private_endpoint_ip": "",
-                                "private_endpoint_label": "",
-                                "refreshable_mode": "",
-                                "refreshable_status": "",
-                                "role": "",
-                                "scheduled_operations": "",
-                                "service_console_url": "",
-                                "source_id": "",
-                                "standby_whitelisted_ips": "",
-                                "subnet_id": "",
-                                "supported_regions_to_clone_to": "",
-                                "system_tags": "",
-                                "time_created": "",
-                                "time_data_guard_role_changed": "",
-                                "time_deletion_of_free_autonomous_database": "",
-                                "time_local_data_guard_enabled": "",
-                                "time_maintenance_begin": "",
-                                "time_maintenance_end": "",
-                                "time_of_last_failover": "",
-                                "time_of_last_refresh": "",
-                                "time_of_last_refresh_point": "",
-                                "time_of_last_switchover": "",
-                                "time_of_next_refresh": "",
-                                "time_reclamation_of_free_autonomous_database": "",
-                                "time_until_reconnect_clone_enabled": "",
-                                "used_data_storage_size_in_tbs": "",
-                                "vault_id": "",
-                                "whitelisted_ips": "",
-                                "region": region_key,
-                                "notes": str(e)
-                            }
-                        self.__autonomous_databases.append(record)
+                            record = record['deep_link'] = self.__generate_csv_hyperlink(deep_link, adb.display_name)
+                            record['error'] = str(e)
+                            self.__autonomous_databases.append(record)
 
             print("\tProcessed " + str(len(self.__autonomous_databases)) + " Autonomous Databases")
             return self.__autonomous_databases
         except Exception as e:
-            raise RuntimeError("Error in __adb_read_adbs " + str(e.args))
+            print("Error in __adb_read_adbs " + str(e.args))
+            self.__errors.append({'id' : '__adb_read_adbs', 'error' : str(e)})
 
     ############################################
     # Load Oracle Integration Cloud
@@ -3526,6 +3291,7 @@ def __identity_read_tenancy_password_policy(self):
     # Oracle Notifications Services for Subscriptions
     ##########################################################################
     def __ons_read_subscriptions(self):
+        debug("__ons_read_subscriptions: Starting: ")
         try:
             for region_key, region_values in self.__regions.items():
                 # Iterate through compartments to get all subscriptions
@@ -3534,7 +3300,7 @@ def __ons_read_subscriptions(self):
                     search_details=oci.resource_search.models.StructuredSearchDetails(
                         query="query OnsSubscription resources return allAdditionalFields where compartmentId != '" + self.__managed_paas_compartment_id + "'")
                 ).data
-
+                debug("\t__ons_read_subscriptions: Recieved " + str(len(subs_data)) + " subscriptions in region " + str(region_key))
                 for sub in subs_data:
                     deep_link = self.__oci_onssub_uri + sub.identifier + '?region=' + region_key
                     record = {
@@ -3590,9 +3356,8 @@ def __identity_read_tag_defaults(self):
             return self.__tag_defaults
 
         except Exception as e:
-            raise RuntimeError(
-                "Error in __identity_read_tag_defaults " + str(e.args))
-
+            print("Error in __identity_read_tag_defaults " + str(e.args))
+            self.__errors.append({'id' : '__identity_read_tag_defaults', 'error' : str(e)})
     ##########################################################################
     # Get Service Connectors
     ##########################################################################
@@ -4935,20 +4700,16 @@ def __obp_analyze_tenancy_data(self):
         #######################################
         
         for cert in self.__raw_oci_certificates:
-            print("\t__obp_analyze_tenancy_data: Iterating through certificates")
+            debug("\t__obp_analyze_tenancy_data: Iterating through certificates")
             
             try:
                 if cert['current_version_summary']['validity'] and \
                 datetime.datetime.strptime(self.get_date_iso_format(cert['current_version_summary']['validity']['time_of_validity_not_after']), self.__iso_time_format) >= self.cert_key_time_max_datetime:
-                    print("Good: " + cert['name'])
                     self.obp_foundations_checks['Certificates_Near_Expiry']['OBP'].append(cert)
                 else:
-                    print("Bad: " + cert['name'])
-
                     self.obp_foundations_checks['Certificates_Near_Expiry']['Findings'].append(cert)
             except Exception as e:
-                print("\t__obp_analyze_tenancy_data: Certificate is missing time of validity not after")
-                print("Horrible: " + cert['name'])
+                debug("\t__obp_analyze_tenancy_data: Certificate is missing time of validity not after" + cert['name'])
                 self.obp_foundations_checks['Certificates_Near_Expiry']['Findings'].append(cert)
 
         if self.obp_foundations_checks['Certificates_Near_Expiry']['Findings']: