Back to Checks
oraclecloud

Oracle Analytics Cloud instance is deployed within a Virtual Cloud Network or restricts public access to allowed sources

analytics_instance_access_restricted
Service: analyticsSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:AnalyticsInstance

Oracle Analytics Cloud endpoints are evaluated for network exposure. Public endpoints must use restricted allowlists of specific IPs/CIDRs; presence of 0.0.0.0/0 or no allowed sources indicates unrestricted access. Instances using a VCN/private endpoint or public endpoints limited to specific sources align with the intended exposure model.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Unrestricted OAC endpoints allow Internet-wide access to the login surface, enabling credential stuffing and brute force. Account takeover can expose reports and data sources (confidentiality), permit dashboard/model changes (integrity), and support lateral movement into connected systems.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks analytics_instance_access_restricted

Recommendation

Prefer private deployment in a VCN and apply least privilege network access. If public is required, enforce allowlists to specific IPs/CIDRs and never include 0.0.0.0/0. Use private access channels/service gateways, require MFA/SSO, and apply defense in depth (WAF, audit monitoring) to reduce exposure.

Remediation

Terraform

resource "oci_analytics_analytics_instance" "example" {
  compartment_id    = "<example_resource_id>"
  name              = "<example_resource_name>"
  feature_set       = "ENTERPRISE_ANALYTICS"
  license_type      = "LICENSE_INCLUDED"
  idcs_access_token = "<example_resource_id>"

  capacity {
    capacity_type  = "OLPU_COUNT"
    capacity_value = 1
  }

  network_endpoint_details {
    network_endpoint_type = "PUBLIC"
    whitelisted_ips       = ["<example_resource_id>"] # Critical: restrict to specific allowed CIDR; not 0.0.0.0/0
  }
}

Other

1In OCI Console, go to Analytics & AI > Analytics Cloud and select your instance
2On Instance Details, under Network Access, click Edit next to Access Control
3Remove any 0.0.0.0/0 entry (if present)
4Add an access rule with the specific allowed public IP or CIDR
5Click Save

Check Code

"""Check Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.analytics.analytics_client import (
    analytics_client,
)


class analytics_instance_access_restricted(Check):
    """Check Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network."""

    def execute(self) -> Check_Report_OCI:
        """Execute the analytics_instance_access_restricted check."""
        findings = []

        for instance in analytics_client.analytics_instances:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=instance,
                region=instance.region,
                resource_name=instance.name,
                resource_id=instance.id,
                compartment_id=instance.compartment_id,
            )

            # Check if instance has PUBLIC network endpoint type
            if (
                instance.network_endpoint_type
                and instance.network_endpoint_type.upper() == "PUBLIC"
            ):
                # Check if whitelisted IPs are configured
                if not instance.whitelisted_ips:
                    report.status = "FAIL"
                    report.status_extended = f"Analytics instance {instance.name} has public access with no whitelisted IPs configured."
                # Check if 0.0.0.0/0 is in whitelisted IPs
                elif "0.0.0.0/0" in instance.whitelisted_ips:
                    report.status = "FAIL"
                    report.status_extended = f"Analytics instance {instance.name} has public access with unrestricted IP range (0.0.0.0/0)."
                else:
                    report.status = "PASS"
                    report.status_extended = f"Analytics instance {instance.name} has public access with restricted whitelisted IPs."
            else:
                report.status = "PASS"
                report.status_extended = f"Analytics instance {instance.name} is deployed within a VCN or has restricted access."

            findings.append(report)

        return findings

References