MEDIUM
Source
CloudSploit
ID
instance-max-count

Instance Max Count

Ensures the total number of VM instances does not exceed a set threshold.

The number of running VM instances should be carefully audited, especially in unused regions, to ensure only approved applications are consuming compute resources. Many compromised Oracle accounts see large numbers of VM instances launched.

Ensure that the number of running VM instances matches the expected count. If instances are launched above the threshold, investigate to ensure they are legitimate.