Description

Ensure every Oracle Analytics Cloud (OAC) instance either uses a private endpoint inside a VCN, or, if it uses a public endpoint, has access control rules that allow only trusted IP addresses, CIDR ranges, VCNs, or Oracle services. The instance should not be reachable from the whole internet.

Rationale

An OAC instance with an open public endpoint can be reached by anyone, which exposes its sign-in page and reports to password attacks and vulnerability scanning. Placing it on a private endpoint, or limiting the public endpoint to known sources, reduces the attack surface and keeps business data and dashboards away from untrusted networks.

Impact

  • Only trusted networks can reach the instance

  • Reduces exposure to password attacks and scanning

  • Users outside the allowed networks lose access

Default Value

When an OAC instance is created with a public endpoint, access is open to the internet unless access control rules are added.

Pre-Requisites

  • Permission to manage analytics-instances and read virtual-network-family

  • A list of trusted IP ranges or VCNs, or a VCN and subnet for a private endpoint

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Analytics & AI, and select Analytics Cloud. Choose the compartment and select the instance.

  3. Check the Network access type (public or private endpoint).

  4. For a public endpoint, review the access control rules and confirm they allow only trusted sources and do not include 0.0.0.0/0.

  5. If the endpoint is public with no or overly broad rules, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Analytics & AI, and select Analytics Cloud. Select the instance.

  3. For a public endpoint, select the option to edit network access (Access control rules), add rules for your trusted IP addresses, CIDR ranges, or VCNs (up to 20 rules), and save.

  4. Alternatively, change the network access to a private endpoint and select the VCN and subnet.

  5. Confirm that users on trusted networks can still reach the instance.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the instance, edit network access, and restore the previous access control rules or endpoint type, then save.

Reference