# Ensure Oracle Analytics Cloud instance is deployed within a Virtual Cloud Network or restricts public access to allowed sources

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698525661389-ensure-oracle-analytics-cloud-instance-is-deployed-within-a-virtual-cloud-network-or-restricts-public-access-to-allowed-sources
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every Oracle Analytics Cloud (OAC) instance either uses a private endpoint inside a VCN, or, if it uses a public endpoint, has access control rules that allow only trusted IP addresses, CIDR ranges, VCNs, or Oracle services. The instance should not be reachable from the whole internet.

**Rationale**

An OAC instance with an open public endpoint can be reached by anyone, which exposes its sign-in page and reports to password attacks and vulnerability scanning. Placing it on a private endpoint, or limiting the public endpoint to known sources, reduces the attack surface and keeps business data and dashboards away from untrusted networks.

**Impact**

-   Only trusted networks can reach the instance
    
-   Reduces exposure to password attacks and scanning
    
-   Users outside the allowed networks lose access
    

**Default Value**

When an OAC instance is created with a public endpoint, access is open to the internet unless access control rules are added.

**Pre-Requisites**

-   Permission to manage analytics-instances and read virtual-network-family
    
-   A list of trusted IP ranges or VCNs, or a VCN and subnet for a private endpoint
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Analytics & AI, and select Analytics Cloud. Choose the compartment and select the instance.
    
3.  Check the Network access type (public or private endpoint).
    
4.  For a public endpoint, review the access control rules and confirm they allow only trusted sources and do not include 0.0.0.0/0.
    
5.  If the endpoint is public with no or overly broad rules, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Analytics & AI, and select Analytics Cloud. Select the instance.
    
3.  For a public endpoint, select the option to edit network access (Access control rules), add rules for your trusted IP addresses, CIDR ranges, or VCNs (up to 20 rules), and save.
    
4.  Alternatively, change the network access to a private endpoint and select the VCN and subnet.
    
5.  Confirm that users on trusted networks can still reach the instance.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the instance, edit network access, and restore the previous access control rules or endpoint type, then save.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/analytics-cloud/doc/control-incomingtraffic-public-endpoint-ingress.html](https://docs.oracle.com/en-us/iaas/analytics-cloud/doc/control-incomingtraffic-public-endpoint-ingress.html)
    
-   [https://docs.oracle.com/en/cloud/paas/analytics-cloud/acoci/top-faqs-public-or-private-endpoint-security.html](https://docs.oracle.com/en/cloud/paas/analytics-cloud/acoci/top-faqs-public-or-private-endpoint-security.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.