Control: 2.8 Ensure Oracle Autonomous Shared Databases (ADB) access is restricted to allowed sources or deployed within a Virtual Cloud Network

Description

Oracle Autonomous Database Shared (ADB-S) automates database tuning, security, backups, updates, and other routine management tasks traditionally performed by DBAs. ADB-S provide ingress filtering of network traffic or can be deployed within an existing Virtual Cloud Network (VCN). It is recommended that all new ADB-S databases be deployed within a VCN and that the Access Control Rules are restricted to your corporate IP Addresses or VCNs for existing ADB-S databases.

Remediation

1. Login to OCI Console.
2. Click in the search bar, top of the screen.
3. Type Advanced Resource Query and click enter.
4. Click the Advanced Resource Query button in the upper right of the screen.
5. Enter the following query in the query box:

query autonomousdatabase resources

6. For each ABD-S database returned click on the link under Display name.
7. Click Edit next to Access Control List.
8. Ensure Access Control Rules IP Address/CIDR Block as well as VCNs are correct.
9. Repeat for other subscribed regions.
10. For each ADB-S database in the returned results, click the ADB-S database name.
11. Click Edit next to Access Control Rules.
12. Click +Another Rule and add rules as required.
13. Click Save Changes.

From Command Line

1. Executethefollowingcommand:

for region in `oci iam region list | jq -r '.data[] | .name'`;
  do
  for compid in `oci iam compartment list --compartment-id-in-subtree TRUE 2>/dev/null | jq -r '.data[] | .id'`
    do
    for adbid in `oci db autonomous-database list --compartment-id
    $compid --region $region --all 2>/dev/null | jq -r '.data[] | select(."nsg- ids" == null).id'`
      do
      output=`oci db autonomous-database get --autonomous-database-id $adbid --region $region --query=data.{"WhiteListIPs:\"whitelisted- ips\","id:id""} --output table 2>/dev/null`
      if [ ! -z "$output" ]; then echo $output; fi
      done
    done
  done

2. Ensure WhiteListIPs are correct.
3. Get the json input format by executing the following command:

oci db autonomous-database update --generate-full-command-json-input

4. For each of the ADB-S Database identified get its details.
5. Update the whitelistIps, copy the WhiteListIPs element from the JSON returned by the above get call, edit it appropriately and use it in the following command:

oci db autonomous-database update –-autonomous-database-id <ABD-S OCID> -- from-json '<network endpoints JSON>'