> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Autonomous Database Should Have Network Access Restrictions ### More Info: Autonomous Database instances that are publicly accessible should have ACL whitelists or NSG restrictions. Without network controls, the database is exposed to attacks from any IP address ### Risk Level High ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * FedRAMP * GDPR * HIPAA * HITRUST CSF * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To restrict network access on an OCI Autonomous Database (ADB) while still allowing it to be used for OCI Database Monitoring, you generally want to: * Disable public access (or avoid “Allow secure access from everywhere”) * Use private endpoints where possible * Define explicit access control rules (ACLs / VCN security lists / NSGs) * Ensure the OCI Database Management/Monitoring service endpoints can still reach the database Below are step‑by‑step instructions using the OCI Console. *** ## 1. Locate the Autonomous Database 1. Sign in to the OCI Console. 2. Open the navigation menu → **Oracle Database** → **Autonomous Transaction Processing** or **Autonomous Data Warehouse** (or **Autonomous Database**, depending on your tenancy UI). 3. Click on the **Autonomous Database** you are using for OCI Database Monitoring. *** ## 2. Check and Adjust Network Access Type On the database details page: 1. In the **Overview** section, look for **Network** or **Access Type**: * It may show **Secure access from everywhere**, **Virtual cloud network**, **Private endpoint**, or similar. 2. If it is **Secure access from everywhere** (public, no restrictions), you should restrict it. ### If the DB is public (secure access from everywhere) You cannot directly “convert” all aspects in some cases, so depending on allowed operations: 1. Click **More Actions** (or **Actions**) → look for: * **Update Network Access** or **Modify private endpoint access**. 2. If available, change the access to: * **Restrict access** using: * **Access control rules (IP whitelisting)**; or * **Virtual Cloud Network** / **Private Endpoint**. 3. Save the changes. If the console doesn’t allow switching from public to private in place, you may need to: * Create a **new Autonomous Database** with a **VCN/private endpoint** configuration and migrate data; then point monitoring to the new instance. *** ## 3. Configure Private Endpoint / VCN Access (Recommended) If you are able to configure **Private Endpoint**: 1. On the Autonomous Database details page, click **More Actions** → **Set Private Endpoint** (or **Update** / **Edit** network). 2. Choose: * **Virtual cloud network (VCN)**: Select the VCN where the private endpoint will live. * **Subnet**: Choose a **private subnet** (no public IPs, with access to OCI services as needed). 3. Ensure that: * The subnet has appropriate **route rules** (e.g., to Service Gateway for OCI services or NAT if needed). * **Security Lists** or **Network Security Groups (NSGs)** associated with the subnet allow traffic to database port (typically 1522 / 1521 depending on configuration) from: * OCI Database Management/Monitoring service IP ranges (usually via Service Gateway / OCI Services CIDR); and * Any approved application subnets. 4. Click **Save changes** / **Update**. *** ## 4. Configure Access Control Rules (If Using Public Endpoint) If you must keep a public endpoint but restrict it: 1. On the Autonomous Database page, look for the **Access Control List (ACL)** or **Access control** section. 2. Click **Edit** / **Manage Access Control List**. 3. Add only the **specific IP addresses or CIDR blocks** that should connect: * Your corporate IP ranges. * IPs of any jump hosts / bastion. 4. Remove **0.0.0.0/0** or any broad range that effectively allows open access. 5. Save the ACL. Ensure that OCI Database Management/Monitoring still works: * If monitoring is configured via an agent or from within the same VCN, ensure those IPs/subnets are included. * If the service uses Oracle-managed ranges exposed via Service Gateway, prefer private endpoint/VCN over public ACL. *** ## 5. Validate OCI Database Monitoring Still Works 1. In the console, open the navigation menu → **Oracle Database** → **Database Management** or **Database Monitoring**. 2. Select your Autonomous Database and check: * Status is **Enabled/Active**. * Metrics, performance pages, and health indicators are updating. 3. If monitoring fails: * Re-check VCN/Subnet **Security Lists** or **NSGs**. * Ensure the database’s **network access type** and ACL allow traffic from the OCI monitoring service (prefer via Service Gateway / private endpoint). *** ## 6. Harden VCN Security (If Using VCN/Private Endpoint) In the networking section: 1. Go to **Networking** → **Virtual Cloud Networks** → select the VCN used. 2. For the **Subnet** used by the Autonomous Database private endpoint: * Open **Security Lists** or **NSGs**. 3. Configure **Ingress** rules: * Allow TCP to the database port from: * Required OCI services (via Service Gateway or specific IP ranges) and * Required application subnets. 4. Configure **Egress** rules: * Allow outbound access as necessary to OCI services (e.g., Database Management, Object Storage) via Service Gateway. *** If you share the current access type of your ADB (public vs private, and whether a private endpoint is already enabled), I can give a more precise click‑path and exact rule examples. Below are step‑by‑step OCI CLI instructions to restrict network access for an Autonomous Database (ADB) **while still allowing OCI Database Monitoring/Management**. You typically do one or both of: * Disable public access * Enable access control lists (IP ACLs) and/or private endpoints *** ## 0. Prerequisites * OCI CLI configured (`oci setup config`) * Permission to update Autonomous Databases and networking resources * OCID of the Autonomous Database (ADB): `ADB_OCID` *** ## 1. Check current network configuration ```bash theme={null} oci db autonomous-database get \ --autonomous-database-id \ --query 'data.{name:"db-name",isPublic:is-publicly-accessible,acl:is-access-control-enabled,whitelist:whitelisted-ips,subnet:subnet-id,peLabel:private-endpoint-label}' \ --output table ``` This shows if: * It's publicly accessible * ACL is enabled * Private endpoint is configured *** ## 2. Disable public access (recommended) If the DB is publicly accessible, restrict it: ```bash theme={null} oci db autonomous-database update \ --autonomous-database-id \ --is-publicly-accessible false ``` This forces access via VCN only (good for Database Monitoring via private connectivity). *** ## 3. Restrict by IP ACL (for controlled public/VCN access) If you must keep some public/VCN access, use access control: ```bash theme={null} oci db autonomous-database update \ --autonomous-database-id \ --is-access-control-enabled true \ --whitelisted-ips '["",""]' ``` Examples: ```bash theme={null} --whitelisted-ips '["203.0.113.10/32","198.51.100.0/24"]' ``` To add/remove IPs later, pass the full desired list again. *** ## 4. Use a private endpoint in a VCN (best for Database Monitoring) This ensures Autonomous DB is reachable only inside your VCN (where the Database Management/Monitoring service can connect). ### 4.1 Choose/create a subnet and NSG * Subnet OCID: `SUBNET_OCID` (in a private subnet recommended) * NSG OCIDs: `NSG_OCID_1`, `NSG_OCID_2` (optional) Ensure your NSG or Security Lists allow: * Inbound DB ports (typically 1522 for ADB) * From your monitoring agents / OCI services’ IPs (or from your management subnet) ### 4.2 Update ADB to use a private endpoint ```bash theme={null} oci db autonomous-database update \ --autonomous-database-id \ --subnet-id \ --private-endpoint-label \ --nsg-ids '["",""]' ``` You can combine with disabling public access: ```bash theme={null} oci db autonomous-database update \ --autonomous-database-id \ --is-publicly-accessible false \ --subnet-id \ --private-endpoint-label \ --nsg-ids '[""]' ``` *** ## 5. Ensure ADB is still manageable for Database Monitoring For OCI Database Management (Monitoring/Performance Hub) to work: 1. **Enable Database Management** (once per ADB): ```bash theme={null} oci db autonomous-database enable-database-management \ --autonomous-database-id ``` 2. Ensure the **VCN routing and NSG rules** allow: * Connectivity from OCI Database Management service to the private endpoint: * Inbound: DB port (e.g., 1522) from appropriate OCI services or your management subnet. * Any required service gateway / private access for OCI control plane (if in a private subnet). *** ## 6. Verify final configuration ```bash theme={null} oci db autonomous-database get \ --autonomous-database-id \ --query 'data.{isPublic:is-publicly-accessible,acl:is-access-control-enabled,whitelist:whitelisted-ips,subnet:subnet-id,peLabel:private-endpoint-label}' \ --output table ``` You’ve remediated: the Autonomous Database now has network access restrictions (private access and/or IP ACLs) while remaining usable for OCI Database Monitoring. Below is how to remediate **“OCI Autonomous Database should have network access restrictions”** for an Autonomous Database that’s used by **OCI Database Management / Monitoring**, using **Python + OCI SDK**. *** ## 1. Decide the Target State You typically want **one** (or both) of these: 1. **Private endpoint only** (best for DB Monitoring): * ADB sits in a subnet in your VCN. * Only reachable through your VCN and configured security rules / NSGs. 2. **Public endpoint but restricted by ACL**: * ADB public endpoint enabled. * `is_access_control_enabled = True` and **only allow specific IPs / VCNs**. If you use **Database Management** (Database Monitoring), Oracle strongly recommends **private endpoints**. *** ## 2. Prerequisites * Python 3.x * `oci` SDK installed: ```bash theme={null} pip install oci ``` * OCI config file (default: `~/.oci/config`) with: * tenancy, user, fingerprint, key\_file, region * Autonomous Database **OCID** (e.g. `ocid1.autonomousdatabase.oc1...`) * If using **private endpoint**, you need: * `subnet_id` (subnet in your VCN) * Optional: `nsg_ids` (list of Network Security Group OCIDs) *** ## 3. Option A – Move ADB to Private Endpoint (Preferred for DB Monitoring) This assumes: * You already created a **private subnet** and optional NSGs in the VCN where Database Management can reach the DB. ### 3.1 Python script (private endpoint) ```python theme={null} import oci # ---- 1. Load config and create client ---- config = oci.config.from_file("~/.oci/config", "DEFAULT") database_client = oci.database.DatabaseClient(config) # ---- 2. Set identifiers ---- autonomous_db_ocid = "ocid1.autonomousdatabase.oc1..xxxxx" subnet_ocid = "ocid1.subnet.oc1..xxxxx" # Subnet for private endpoint nsg_ocids = ["ocid1.nsg.oc1..xxxxx"] # Optional NSG list, or [] if not used private_endpoint_label = "dbmon-pe" # Any unique label in the subnet # ---- 3. Build update details ---- update_details = oci.database.models.UpdateAutonomousDatabaseDetails( # Disable public endpoint is_publicly_accessible=False, # Configure private endpoint subnet_id=subnet_ocid, nsg_ids=nsg_ocids, private_endpoint_label=private_endpoint_label ) # ---- 4. Call update API ---- response = database_client.update_autonomous_database( autonomous_database_id=autonomous_db_ocid, update_autonomous_database_details=update_details ) print("Update in progress. New lifecycle state:", response.data.lifecycle_state) print("Private endpoint:", response.data.private_endpoint) ``` **What this does:** * Disables public access. * Attaches the Autonomous Database to your VCN subnet (and NSGs). * Creates a private endpoint with the label `dbmon-pe`. *** ## 4. Option B – Keep Public Endpoint but Add IP / VCN Restrictions If you must keep public access, **enable ACL** and restrict to: * Specific public IPs/CIDRs (`whitelisted_ips`) * And/or specific private endpoint IPs / subnets if applicable. ### 4.1 Python script (access control list) ```python theme={null} import oci config = oci.config.from_file("~/.oci/config", "DEFAULT") database_client = oci.database.DatabaseClient(config) autonomous_db_ocid = "ocid1.autonomousdatabase.oc1..xxxxx" # Example: allow only these IPs/CIDRs allowed_ips = [ "203.0.113.10/32", # Your office / jump host "198.51.100.0/24" # Your corporate CIDR ] update_details = oci.database.models.UpdateAutonomousDatabaseDetails( is_publicly_accessible=True, is_access_control_enabled=True, whitelisted_ips=allowed_ips ) response = database_client.update_autonomous_database( autonomous_database_id=autonomous_db_ocid, update_autonomous_database_details=update_details ) print("ACL update in progress. Lifecycle state:", response.data.lifecycle_state) print("Access control enabled:", response.data.is_access_control_enabled) print("Whitelisted IPs:", response.data.whitelisted_ips) ``` *** ## 5. Ensure Database Monitoring Can Still Reach the DB For **private endpoints**, you must: 1. Have a **Database Management Private Endpoint** (DB Management PE) deployed in: * The **same VCN** and with reachability to the ADB subnet. 2. Ensure: * NSG/Security List on ADB subnet allows: * Inbound TCP 1522 (or your configured port) from the DB Management PE. * Route tables allow traffic between DB Management PE subnet and ADB subnet. Those parts are done via: * **VCN → Subnets / NSGs / Security Lists** in Console, or * OCI Python SDK (`oci.core.VirtualNetworkClient`) if you need scriptable NSG/security rule updates. Example for NSG inbound rule (conceptual, not full script): * Source: NSG of DB Management PE (or its subnet CIDR) * Protocol: TCP * Destination Port: 1522 (or service port) *** ## 6. Verification 1. In Console: * Go to **Autonomous Database** → **``** → **Network**. * Confirm: * `Network access: Private endpoint` (Option A)\ or * `Public endpoint + Access control list enabled` with narrow IPs (Option B). 2. In **Database Management → Databases**: * Check that the target is reachable and that monitoring metrics are updating. *** If you tell me: * Your current ADB network type (public or private), * Whether you already have a Database Management Private Endpoint and VCN set up, I can give a more exact Python snippet including NSG/security rule changes. ```hcl theme={null} resource "oci_database_autonomous_database" "THIS_ADB" { # Existing required arguments for your Autonomous Database compartment_id = "OCID_OF_COMPARTMENT" db_name = "ADB_DB_NAME" cpu_core_count = 1 data_storage_size_in_tbs = 1 admin_password = "REPLACE_WITH_SECURE_PASSWORD" db_workload = "OLTP" # Network access restriction: enable ACLs for publicly accessible ADB is_access_control_enabled = true # Replace with the specific CIDR blocks / IPs that are allowed to connect whitelisted_ips = [ "ALLOWED_IP_OR_CIDR_1", "ALLOWED_IP_OR_CIDR_2", ] # If your ADB is using a private endpoint, also restrict with NSGs: # nsg_ids = [ # oci_core_network_security_group.adb_nsg.id, # ] # ...any other existing arguments you already use... } # Optional: example NSG for a private-endpoint ADB, if applicable resource "oci_core_network_security_group" "adb_nsg" { compartment_id = "OCID_OF_COMPARTMENT" vcn_id = "OCID_OF_VCN" display_name = "ADB_NSG" } resource "oci_core_network_security_group_security_rule" "adb_ingress" { network_security_group_id = oci_core_network_security_group.adb_nsg.id direction = "INGRESS" protocol = "6" # TCP source = "ALLOWED_IP_OR_CIDR_1" source_type = "CIDR_BLOCK" tcp_options { destination_port_range { min = 1522 max = 1522 } } } ``` Changing `is_access_control_enabled` and `whitelisted_ips` is an in‑place update and does not force replacement; adding or modifying `nsg_ids` is also in‑place, but changing `subnet_id` (not shown above) would force replacement and cause downtime. To verify, `terraform plan` should show an in-place update (`~`) to `oci_database_autonomous_database.THIS_ADB` adding `is_access_control_enabled = true` and the `whitelisted_ips` (and NSG IDs if you enable those).