# Ensure Integration Cloud instance uses a private endpoint or a public endpoint with IP or VCN allowlists

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698529463144-ensure-integration-cloud-instance-uses-a-private-endpoint-or-a-public-endpoint-with-ip-or-vcn-allowlists
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every Oracle Integration instance either uses a private endpoint, or restricts its public endpoint with a network access allowlist of trusted IP addresses, CIDR ranges, or VCN OCIDs. The instance should not be reachable from the whole internet without restriction.

**Rationale**

Oracle Integration connects to business applications and often holds credentials and sensitive data flows. An unrestricted public endpoint exposes its sign-in pages and APIs to password attacks and scanning from anywhere. Limiting access to known networks greatly reduces the attack surface while keeping integrations working.

**Impact**

-   Only trusted networks can reach the instance
    
-   Reduces exposure to password attacks and scanning
    
-   Every system that calls the instance must be included in the allowlist
    

**Default Value**

By default, Oracle Integration instances have unrestricted network access unless an allowlist or private endpoint is configured.

**Pre-Requisites**

-   Permission to manage integration-instances in the compartment
    
-   A list of all IP addresses and VCNs that need access, including SaaS applications that call the instance
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Developer Services, and under Application Integration select Integration. Choose the compartment and select the instance.
    
3.  In the Integration instance information, check the Network access value.
    
4.  If it is not Restricted and the instance does not use a private endpoint, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Developer Services, and under Application Integration select Integration. Select the instance.
    
3.  Under Resources, select Network access.
    
4.  Add allowlist rules for each trusted IP address, CIDR range, or VCN OCID, and save.
    
5.  Confirm that Network access now shows Restricted and that required systems can still connect.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the instance, select Network access, remove the allowlist rules, and save.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/integration/doc/restrict-access-instance.html](https://docs.oracle.com/en-us/iaas/integration/doc/restrict-access-instance.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.