Control: 2.7 Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network

Description

Oracle Analytics Cloud (OAC) is a scalable and secure public cloud service that provides a full set of capabilities to explore and perform collaborative analytics for you, your workgroup, and your enterprise. OAC instances provide ingress filtering of network traffic or can be deployed with in an existing Virtual Cloud Network VCN. It is recommended that all new OAC instances be deployed within a VCN and that the Access Control Rules are restricted to your corporate IP Addresses or VCNs for existing OAC instances.

Remediation

1. Login to OCI Console.
2. Click in the search bar, top of the screen.
3. Type Advanced Resource Query and click enter.
4. Click the Advanced Resource Query button in the upper right of the screen.
5. Enter the following query in the query box:

query analyticsinstance resources

6. For each OAC Instance returned click on the link under Display name.
7. Ensure Access Control Rules IP Address/CIDR Block as well as Virtual Cloud Networks are correct.
8. Repeat for other subscribed regions.
9. For each OAC instance in the returned results, click the OAC Instance name.
10. Click Edit next to Access Control Rules.
11. Click +Another Rule and add rules as required.

From Command Line

1. Executethefollowingcommand:

for region in `oci iam region list | jq -r '.data[] | .name'`;
  do
  for compid in `oci iam compartment list --compartment-id-in-subtree TRUE 2>/dev/null | jq -r '.data[] | .id'`
    do
    output=`oci analytics analytics-instance list --compartment-id
    $compid --region $region --all 2>/dev/null | jq -r '.data[] | select(."network-endpoint-details"."network-endpoint-type" == "PUBLIC")'`
    if [ ! -z "$output" ]; then echo $output; fi
    done
  done

2. Ensure network-endpoint-type are correct.
3. Get the json input format by executing the below command:

oci analytics analytics-instance change-network-endpoint --generate-full-command-json-input

4. For each of the OAC Instances identified get its details.
5. Update the Access Control Rules, copy the network-endpoint-details element from the JSON returned by the above get call, edit it appropriately and use it in the following command:

oci integration analytics-instance change-network-endpoint --from-json '<network endpoints JSON>'