Description

Ensure every Oracle Integration instance either uses a private endpoint, or restricts its public endpoint with a network access allowlist of trusted IP addresses, CIDR ranges, or VCN OCIDs. The instance should not be reachable from the whole internet without restriction.

Rationale

Oracle Integration connects to business applications and often holds credentials and sensitive data flows. An unrestricted public endpoint exposes its sign-in pages and APIs to password attacks and scanning from anywhere. Limiting access to known networks greatly reduces the attack surface while keeping integrations working.

Impact

  • Only trusted networks can reach the instance

  • Reduces exposure to password attacks and scanning

  • Every system that calls the instance must be included in the allowlist

Default Value

By default, Oracle Integration instances have unrestricted network access unless an allowlist or private endpoint is configured.

Pre-Requisites

  • Permission to manage integration-instances in the compartment

  • A list of all IP addresses and VCNs that need access, including SaaS applications that call the instance

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Developer Services, and under Application Integration select Integration. Choose the compartment and select the instance.

  3. In the Integration instance information, check the Network access value.

  4. If it is not Restricted and the instance does not use a private endpoint, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Developer Services, and under Application Integration select Integration. Select the instance.

  3. Under Resources, select Network access.

  4. Add allowlist rules for each trusted IP address, CIDR range, or VCN OCID, and save.

  5. Confirm that Network access now shows Restricted and that required systems can still connect.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the instance, select Network access, remove the allowlist rules, and save.

Reference