Control: 2.8 Ensure Oracle Autonomous Shared Databases (ADB) access is restricted to allowed sources or deployed within a Virtual Cloud Network

Description

Oracle Autonomous Database Shared (ADB-S) automates database tuning, security, backups, updates, and other routine management tasks traditionally performed by DBAs. ADB-S provide ingress filtering of network traffic or can be deployed within an existing Virtual Cloud Network (VCN). It is recommended that all new ADB-S databases be deployed within a VCN and that the Access Control Rules are restricted to your corporate IP Addresses or VCNs for existing ADB-S databases.

Remediation

From Console

Follow the audit procedure above.
For each ADB-S database in the returned results, click the ADB-S database name.
Click Edit next to Access Control Rules.
Click +Another Rule and add rules as required.
Click Save Changes.

From CLI

Follow the audit procedure.
Get the json input format by executing the following command:

oci db autonomous-database update --generate-full-command-json-input

For each of the ADB-S Database identified get its details.
Update the whitelistIps, copy the WhiteListIPs element from the JSON returned by the above get call, edit it appropriately and use it in the following command:

oci db autonomous-database update –-autonomous-database-id <ABD-S OCID> -- from-json '<network endpoints JSON>'

Usage

Run the control in your terminal:

powerpipe control run oci_compliance.control.cis_v200_2_8

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run oci_compliance.control.cis_v200_2_8 --share

SQL

This control uses a named query:

select
  d.id as resource,
  case
    when whitelisted_ips is null then 'alarm'
    else 'ok'
  end as status,
  case
    when whitelisted_ips is null then d.title || ' is publicly accessible.'
    else d.title || ' not publicly accessible.'
  end as reason
  
  , d.region as region, d.tenant_name as tenant
  , coalesce(c.name, 'root') as compartment
from
  oci_database_autonomous_database as d
  left join oci_identity_compartment as c on c.id = d.compartment_id;