Extend OCI Compute Instance with Platform Config and Launch Options

[syrull]

Summary

Extend the existing oci.compute.instance resource with platformConfig, launchOptions, and instanceOptions fields to enable security configuration auditing.

OCI API Reference

• GetInstance - Get instance details including platform config
• LaunchOptions - Launch configuration options
• PlatformConfig - Platform security configuration
• InstanceOptions - Instance runtime options

Proposed MQL Resources

oci.compute.instance (Extend Existing - Currently has: id, name, state, created, region)

Add these fields:

Field	Type	Description
platformConfig	dict	Platform security configuration
launchOptions	dict	Launch configuration options
instanceOptions	dict	Instance runtime options
shapeConfig	dict	Shape configuration (OCPUs, memory)
sourceDetails	dict	Boot volume or image source details
availabilityDomain	string	Availability domain
faultDomain	string	Fault domain
shape	string	Instance shape
metadata	map[string]string	Instance metadata

platformConfig Structure

Field	Type	Description
type	string	Platform type (AMD_MILAN_BM, INTEL_SKYLAKE, etc.)
isSecureBootEnabled	bool	Whether Secure Boot is enabled
isTrustedPlatformModuleEnabled	bool	Whether TPM is enabled
isMeasuredBootEnabled	bool	Whether Measured Boot is enabled
isMemoryEncryptionEnabled	bool	Whether memory encryption is enabled

launchOptions Structure

Field	Type	Description
bootVolumeType	string	Boot volume emulation type
firmware	string	Firmware type (BIOS, UEFI_64)
networkType	string	Network emulation type
isPvEncryptionInTransitEnabled	bool	Whether in-transit encryption is enabled
isConsistentVolumeNamingEnabled	bool	Whether consistent volume naming is enabled

instanceOptions Structure

Field	Type	Description
areLegacyImdsEndpointsDisabled	bool	Whether legacy IMDS endpoints are disabled

Example MQL Queries

# Check Secure Boot is enabled on all instances
oci.compute.instances.all(
  platformConfig["isSecureBootEnabled"] == true
)

# Check in-transit encryption is enabled
oci.compute.instances.all(
  launchOptions["isPvEncryptionInTransitEnabled"] == true
)

# Check legacy metadata endpoints are disabled
oci.compute.instances.all(
  instanceOptions["areLegacyImdsEndpointsDisabled"] == true
)

Use Cases

• Verify Secure Boot is enabled on compute instances
• Audit in-transit encryption configuration
• Ensure legacy Instance Metadata Service (IMDS) endpoints are disabled
• Monitor platform security configuration across fleet