OCI Autonomous Database Should Have Network Access Restrictions

Using Console

To restrict network access on an OCI Autonomous Database (ADB) while still allowing it to be used for OCI Database Monitoring, you generally want to:

Disable public access (or avoid “Allow secure access from everywhere”)
Use private endpoints where possible
Define explicit access control rules (ACLs / VCN security lists / NSGs)
Ensure the OCI Database Management/Monitoring service endpoints can still reach the database

Below are step‑by‑step instructions using the OCI Console.

1. Locate the Autonomous Database

Sign in to the OCI Console.
Open the navigation menu → Oracle Database → Autonomous Transaction Processing or Autonomous Data Warehouse (or Autonomous Database, depending on your tenancy UI).
Click on the Autonomous Database you are using for OCI Database Monitoring.

2. Check and Adjust Network Access Type

On the database details page:

In the Overview section, look for Network or Access Type:
- It may show Secure access from everywhere, Virtual cloud network, Private endpoint, or similar.
If it is Secure access from everywhere (public, no restrictions), you should restrict it.

If the DB is public (secure access from everywhere)

You cannot directly “convert” all aspects in some cases, so depending on allowed operations:

Click More Actions (or Actions) → look for:
- Update Network Access or Modify private endpoint access.
If available, change the access to:
- Restrict access using:
  - Access control rules (IP whitelisting); or
  - Virtual Cloud Network / Private Endpoint.
Save the changes.

If the console doesn’t allow switching from public to private in place, you may need to:

Create a new Autonomous Database with a VCN/private endpoint configuration and migrate data; then point monitoring to the new instance.

3. Configure Private Endpoint / VCN Access (Recommended)

If you are able to configure Private Endpoint:

On the Autonomous Database details page, click More Actions → Set Private Endpoint (or Update / Edit network).
Choose:
- Virtual cloud network (VCN): Select the VCN where the private endpoint will live.
- Subnet: Choose a private subnet (no public IPs, with access to OCI services as needed).
Ensure that:
- The subnet has appropriate route rules (e.g., to Service Gateway for OCI services or NAT if needed).
- Security Lists or Network Security Groups (NSGs) associated with the subnet allow traffic to database port (typically 1522 / 1521 depending on configuration) from:
  - OCI Database Management/Monitoring service IP ranges (usually via Service Gateway / OCI Services CIDR); and
  - Any approved application subnets.
Click Save changes / Update.

4. Configure Access Control Rules (If Using Public Endpoint)

If you must keep a public endpoint but restrict it:

On the Autonomous Database page, look for the Access Control List (ACL) or Access control section.
Click Edit / Manage Access Control List.
Add only the specific IP addresses or CIDR blocks that should connect:
- Your corporate IP ranges.
- IPs of any jump hosts / bastion.
Remove 0.0.0.0/0 or any broad range that effectively allows open access.
Save the ACL.

Ensure that OCI Database Management/Monitoring still works:

If monitoring is configured via an agent or from within the same VCN, ensure those IPs/subnets are included.
If the service uses Oracle-managed ranges exposed via Service Gateway, prefer private endpoint/VCN over public ACL.

5. Validate OCI Database Monitoring Still Works

In the console, open the navigation menu → Oracle Database → Database Management or Database Monitoring.
Select your Autonomous Database and check:
- Status is Enabled/Active.
- Metrics, performance pages, and health indicators are updating.
If monitoring fails:
- Re-check VCN/Subnet Security Lists or NSGs.
- Ensure the database’s network access type and ACL allow traffic from the OCI monitoring service (prefer via Service Gateway / private endpoint).

6. Harden VCN Security (If Using VCN/Private Endpoint)

In the networking section:

Go to Networking → Virtual Cloud Networks → select the VCN used.
For the Subnet used by the Autonomous Database private endpoint:
- Open Security Lists or NSGs.
Configure Ingress rules:
- Allow TCP to the database port from:
  - Required OCI services (via Service Gateway or specific IP ranges) and
  - Required application subnets.
Configure Egress rules:
- Allow outbound access as necessary to OCI services (e.g., Database Management, Object Storage) via Service Gateway.

If you share the current access type of your ADB (public vs private, and whether a private endpoint is already enabled), I can give a more precise click‑path and exact rule examples.

Using CLI

Below are step‑by‑step OCI CLI instructions to restrict network access for an Autonomous Database (ADB) while still allowing OCI Database Monitoring/Management.You typically do one or both of:

Disable public access
Enable access control lists (IP ACLs) and/or private endpoints

0. Prerequisites

OCI CLI configured (oci setup config)
Permission to update Autonomous Databases and networking resources
OCID of the Autonomous Database (ADB): ADB_OCID

1. Check current network configuration

oci db autonomous-database get \
  --autonomous-database-id <ADB_OCID> \
  --query 'data.{name:"db-name",isPublic:is-publicly-accessible,acl:is-access-control-enabled,whitelist:whitelisted-ips,subnet:subnet-id,peLabel:private-endpoint-label}' \
  --output table

This shows if:

It’s publicly accessible
ACL is enabled
Private endpoint is configured

2. Disable public access (recommended)

If the DB is publicly accessible, restrict it:

oci db autonomous-database update \
  --autonomous-database-id <ADB_OCID> \
  --is-publicly-accessible false

This forces access via VCN only (good for Database Monitoring via private connectivity).

3. Restrict by IP ACL (for controlled public/VCN access)

If you must keep some public/VCN access, use access control:

oci db autonomous-database update \
  --autonomous-database-id <ADB_OCID> \
  --is-access-control-enabled true \
  --whitelisted-ips '["<ALLOWED_IP_OR_CIDR_1>","<ALLOWED_IP_OR_CIDR_2>"]'

Examples:

--whitelisted-ips '["203.0.113.10/32","198.51.100.0/24"]'

To add/remove IPs later, pass the full desired list again.

4. Use a private endpoint in a VCN (best for Database Monitoring)

This ensures Autonomous DB is reachable only inside your VCN (where the Database Management/Monitoring service can connect).

4.1 Choose/create a subnet and NSG

Subnet OCID: SUBNET_OCID (in a private subnet recommended)
NSG OCIDs: NSG_OCID_1, NSG_OCID_2 (optional)

Ensure your NSG or Security Lists allow:

Inbound DB ports (typically 1522 for ADB)
From your monitoring agents / OCI services’ IPs (or from your management subnet)

4.2 Update ADB to use a private endpoint

oci db autonomous-database update \
  --autonomous-database-id <ADB_OCID> \
  --subnet-id <SUBNET_OCID> \
  --private-endpoint-label <unique-label> \
  --nsg-ids '["<NSG_OCID_1>","<NSG_OCID_2>"]'

You can combine with disabling public access:

oci db autonomous-database update \
  --autonomous-database-id <ADB_OCID> \
  --is-publicly-accessible false \
  --subnet-id <SUBNET_OCID> \
  --private-endpoint-label <unique-label> \
  --nsg-ids '["<NSG_OCID_1>"]'

5. Ensure ADB is still manageable for Database Monitoring

For OCI Database Management (Monitoring/Performance Hub) to work:

Enable Database Management (once per ADB):

oci db autonomous-database enable-database-management \
  --autonomous-database-id <ADB_OCID>

Ensure the VCN routing and NSG rules allow:
- Connectivity from OCI Database Management service to the private endpoint:
  - Inbound: DB port (e.g., 1522) from appropriate OCI services or your management subnet.
- Any required service gateway / private access for OCI control plane (if in a private subnet).

6. Verify final configuration

oci db autonomous-database get \
  --autonomous-database-id <ADB_OCID> \
  --query 'data.{isPublic:is-publicly-accessible,acl:is-access-control-enabled,whitelist:whitelisted-ips,subnet:subnet-id,peLabel:private-endpoint-label}' \
  --output table

You’ve remediated: the Autonomous Database now has network access restrictions (private access and/or IP ACLs) while remaining usable for OCI Database Monitoring.

Using Python

Below is how to remediate “OCI Autonomous Database should have network access restrictions” for an Autonomous Database that’s used by OCI Database Management / Monitoring, using Python + OCI SDK.

1. Decide the Target State

You typically want one (or both) of these:

Private endpoint only (best for DB Monitoring):
- ADB sits in a subnet in your VCN.
- Only reachable through your VCN and configured security rules / NSGs.
Public endpoint but restricted by ACL:
- ADB public endpoint enabled.
- is_access_control_enabled = True and only allow specific IPs / VCNs.

If you use Database Management (Database Monitoring), Oracle strongly recommends private endpoints.

2. Prerequisites

Python 3.x
oci SDK installed:
pip install oci
OCI config file (default: ~/.oci/config) with:
- tenancy, user, fingerprint, key_file, region
Autonomous Database OCID (e.g. ocid1.autonomousdatabase.oc1...)
If using private endpoint, you need:
- subnet_id (subnet in your VCN)
- Optional: nsg_ids (list of Network Security Group OCIDs)

3. Option A – Move ADB to Private Endpoint (Preferred for DB Monitoring)

This assumes:

You already created a private subnet and optional NSGs in the VCN where Database Management can reach the DB.

3.1 Python script (private endpoint)

import oci

# ---- 1. Load config and create client ----
config = oci.config.from_file("~/.oci/config", "DEFAULT")
database_client = oci.database.DatabaseClient(config)

# ---- 2. Set identifiers ----
autonomous_db_ocid = "ocid1.autonomousdatabase.oc1..xxxxx"
subnet_ocid = "ocid1.subnet.oc1..xxxxx"          # Subnet for private endpoint
nsg_ocids = ["ocid1.nsg.oc1..xxxxx"]             # Optional NSG list, or [] if not used
private_endpoint_label = "dbmon-pe"              # Any unique label in the subnet

# ---- 3. Build update details ----
update_details = oci.database.models.UpdateAutonomousDatabaseDetails(
    # Disable public endpoint
    is_publicly_accessible=False,
    # Configure private endpoint
    subnet_id=subnet_ocid,
    nsg_ids=nsg_ocids,
    private_endpoint_label=private_endpoint_label
)

# ---- 4. Call update API ----
response = database_client.update_autonomous_database(
    autonomous_database_id=autonomous_db_ocid,
    update_autonomous_database_details=update_details
)

print("Update in progress. New lifecycle state:", response.data.lifecycle_state)
print("Private endpoint:", response.data.private_endpoint)

What this does:

Disables public access.
Attaches the Autonomous Database to your VCN subnet (and NSGs).
Creates a private endpoint with the label dbmon-pe.

4. Option B – Keep Public Endpoint but Add IP / VCN Restrictions

If you must keep public access, enable ACL and restrict to:

Specific public IPs/CIDRs (whitelisted_ips)
And/or specific private endpoint IPs / subnets if applicable.

4.1 Python script (access control list)

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
database_client = oci.database.DatabaseClient(config)

autonomous_db_ocid = "ocid1.autonomousdatabase.oc1..xxxxx"

# Example: allow only these IPs/CIDRs
allowed_ips = [
    "203.0.113.10/32",   # Your office / jump host
    "198.51.100.0/24"    # Your corporate CIDR
]

update_details = oci.database.models.UpdateAutonomousDatabaseDetails(
    is_publicly_accessible=True,
    is_access_control_enabled=True,
    whitelisted_ips=allowed_ips
)

response = database_client.update_autonomous_database(
    autonomous_database_id=autonomous_db_ocid,
    update_autonomous_database_details=update_details
)

print("ACL update in progress. Lifecycle state:", response.data.lifecycle_state)
print("Access control enabled:", response.data.is_access_control_enabled)
print("Whitelisted IPs:", response.data.whitelisted_ips)

5. Ensure Database Monitoring Can Still Reach the DB

For private endpoints, you must:

Have a Database Management Private Endpoint (DB Management PE) deployed in:
- The same VCN and with reachability to the ADB subnet.
Ensure:
- NSG/Security List on ADB subnet allows:
  - Inbound TCP 1522 (or your configured port) from the DB Management PE.
- Route tables allow traffic between DB Management PE subnet and ADB subnet.

Those parts are done via:

VCN → Subnets / NSGs / Security Lists in Console, or
OCI Python SDK (oci.core.VirtualNetworkClient) if you need scriptable NSG/security rule updates.

Example for NSG inbound rule (conceptual, not full script):

Source: NSG of DB Management PE (or its subnet CIDR)
Protocol: TCP
Destination Port: 1522 (or service port)

6. Verification

In Console:
- Go to Autonomous Database → <your DB> → Network.
- Confirm:
  - Network access: Private endpoint (Option A)
    or
  - Public endpoint + Access control list enabled with narrow IPs (Option B).
In Database Management → Databases:
- Check that the target is reachable and that monitoring metrics are updating.

If you tell me:

Your current ADB network type (public or private),
Whether you already have a Database Management Private Endpoint and VCN set up,

I can give a more exact Python snippet including NSG/security rule changes.

Using Terraform

resource "oci_database_autonomous_database" "THIS_ADB" {
  # Existing required arguments for your Autonomous Database
  compartment_id = "OCID_OF_COMPARTMENT"
  db_name        = "ADB_DB_NAME"
  cpu_core_count = 1
  data_storage_size_in_tbs = 1
  admin_password = "REPLACE_WITH_SECURE_PASSWORD"
  db_workload    = "OLTP"

  # Network access restriction: enable ACLs for publicly accessible ADB
  is_access_control_enabled = true

  # Replace with the specific CIDR blocks / IPs that are allowed to connect
  whitelisted_ips = [
    "ALLOWED_IP_OR_CIDR_1",
    "ALLOWED_IP_OR_CIDR_2",
  ]

  # If your ADB is using a private endpoint, also restrict with NSGs:
  # nsg_ids = [
  #   oci_core_network_security_group.adb_nsg.id,
  # ]

  # ...any other existing arguments you already use...
}

# Optional: example NSG for a private-endpoint ADB, if applicable
resource "oci_core_network_security_group" "adb_nsg" {
  compartment_id = "OCID_OF_COMPARTMENT"
  vcn_id         = "OCID_OF_VCN"
  display_name   = "ADB_NSG"
}

resource "oci_core_network_security_group_security_rule" "adb_ingress" {
  network_security_group_id = oci_core_network_security_group.adb_nsg.id
  direction                 = "INGRESS"
  protocol                  = "6" # TCP

  source      = "ALLOWED_IP_OR_CIDR_1"
  source_type = "CIDR_BLOCK"

  tcp_options {
    destination_port_range {
      min = 1522
      max = 1522
    }
  }
}

Changing is_access_control_enabled and whitelisted_ips is an in‑place update and does not force replacement; adding or modifying nsg_ids is also in‑place, but changing subnet_id (not shown above) would force replacement and cause downtime.To verify, terraform plan should show an in-place update (~) to oci_database_autonomous_database.THIS_ADB adding is_access_control_enabled = true and the whitelisted_ips (and NSG IDs if you enable those).

OCI Misconfigurations

OCI Autonomous Database Should Have Network Access Restrictions

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Locate the Autonomous Database

2. Check and Adjust Network Access Type

If the DB is public (secure access from everywhere)

3. Configure Private Endpoint / VCN Access (Recommended)

4. Configure Access Control Rules (If Using Public Endpoint)

5. Validate OCI Database Monitoring Still Works

6. Harden VCN Security (If Using VCN/Private Endpoint)

0. Prerequisites

1. Check current network configuration

2. Disable public access (recommended)

3. Restrict by IP ACL (for controlled public/VCN access)

4. Use a private endpoint in a VCN (best for Database Monitoring)

4.1 Choose/create a subnet and NSG

4.2 Update ADB to use a private endpoint

5. Ensure ADB is still manageable for Database Monitoring

6. Verify final configuration

1. Decide the Target State

2. Prerequisites

3. Option A – Move ADB to Private Endpoint (Preferred for DB Monitoring)

3.1 Python script (private endpoint)

4. Option B – Keep Public Endpoint but Add IP / VCN Restrictions

4.1 Python script (access control list)

5. Ensure Database Monitoring Can Still Reach the DB

6. Verification

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Locate the Autonomous Database

​2. Check and Adjust Network Access Type

​If the DB is public (secure access from everywhere)

​3. Configure Private Endpoint / VCN Access (Recommended)

​4. Configure Access Control Rules (If Using Public Endpoint)

​5. Validate OCI Database Monitoring Still Works

​6. Harden VCN Security (If Using VCN/Private Endpoint)

​0. Prerequisites

​1. Check current network configuration

​2. Disable public access (recommended)

​3. Restrict by IP ACL (for controlled public/VCN access)

​4. Use a private endpoint in a VCN (best for Database Monitoring)

​4.1 Choose/create a subnet and NSG

​4.2 Update ADB to use a private endpoint

​5. Ensure ADB is still manageable for Database Monitoring

​6. Verify final configuration

​1. Decide the Target State

​2. Prerequisites

​3. Option A – Move ADB to Private Endpoint (Preferred for DB Monitoring)

​3.1 Python script (private endpoint)

​4. Option B – Keep Public Endpoint but Add IP / VCN Restrictions

​4.1 Python script (access control list)

​5. Ensure Database Monitoring Can Still Reach the DB

​6. Verification

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Locate the Autonomous Database

2. Check and Adjust Network Access Type

If the DB is public (secure access from everywhere)

3. Configure Private Endpoint / VCN Access (Recommended)

4. Configure Access Control Rules (If Using Public Endpoint)

5. Validate OCI Database Monitoring Still Works

6. Harden VCN Security (If Using VCN/Private Endpoint)

0. Prerequisites

1. Check current network configuration

2. Disable public access (recommended)

3. Restrict by IP ACL (for controlled public/VCN access)

4. Use a private endpoint in a VCN (best for Database Monitoring)

4.1 Choose/create a subnet and NSG

4.2 Update ADB to use a private endpoint

5. Ensure ADB is still manageable for Database Monitoring

6. Verify final configuration

1. Decide the Target State

2. Prerequisites

3. Option A – Move ADB to Private Endpoint (Preferred for DB Monitoring)

3.1 Python script (private endpoint)

4. Option B – Keep Public Endpoint but Add IP / VCN Restrictions

4.1 Python script (access control list)

5. Ensure Database Monitoring Can Still Reach the DB

6. Verification