Back to Checks
oraclecloud

Autonomous Shared Database (ADB) is deployed within a VCN or restricts public access with whitelisted IPs excluding 0.0.0.0/0

database_autonomous_database_access_restricted
Service: databaseSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:AutonomousDatabase

OCI Autonomous Database (shared) network exposure is evaluated: instances are treated as restricted when using a VCN private endpoint or when ACLs allow only specified IPs/VCNs. It identifies configurations with no ACL and no VCN, or ACLs permitting 0.0.0.0/0.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

With open access, attackers can probe endpoints, brute-force credentials, or abuse leaked wallets to connect.

Impact:

  • Confidentiality: unauthorized queries and data exfiltration
  • Integrity: malicious changes
  • Availability: heavy queries or scans causing service disruption

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks database_autonomous_database_access_restricted

Recommendation

Prefer VCN private endpoints to eliminate internet exposure. If public access is required, enforce least privilege by limiting ACLs to specific CIDRs or VCNs; never use 0.0.0.0/0.

Add defense in depth with NSGs and private connectivity (VPN/peering), monitor access, and rotate client wallets regularly.

Remediation

CLI

oci db autonomous-database update --autonomous-database-id <adb-ocid> --is-access-control-enabled true --whitelisted-ips '["<ALLOWED_IP_OR_CIDR>"]'

Terraform

resource "oci_database_autonomous_database" "<example_resource_name>" {
  is_access_control_enabled = true                 # Critical: enable ACLs to restrict public access
  whitelisted_ips           = ["<ALLOWED_IP_OR_CIDR>"]  # Critical: allow only specific IP/CIDR; do not use 0.0.0.0/0
}

Other

1In OCI Console, go to Autonomous Database and select the instance
2Click More Actions > Update
3Under Network Access, enable Access control list (ACL)
4Add an allowed IP/CIDR (exclude 0.0.0.0/0) and remove any 0.0.0.0/0 entry
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.database.database_client import (
    database_client,
)


class database_autonomous_database_access_restricted(Check):
    """Ensure Oracle Autonomous Shared Database (ADB) access is restricted or deployed within a VCN (CIS 2.8)"""

    def execute(self):
        findings = []

        for adb in database_client.autonomous_databases:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=adb,
                region=adb.region,
                compartment_id=adb.compartment_id,
                resource_id=adb.id,
                resource_name=adb.display_name,
            )

            # Check if database has no whitelisted IPs and no subnet (unrestricted public access)
            if not adb.whitelisted_ips and not adb.subnet_id:
                report.status = "FAIL"
                report.status_extended = f"Autonomous Database {adb.display_name} has unrestricted public access with no whitelisted IPs and is not deployed in a VCN."
            # Check if database has whitelisted IPs containing 0.0.0.0/0
            elif adb.whitelisted_ips and "0.0.0.0/0" in adb.whitelisted_ips:
                report.status = "FAIL"
                report.status_extended = f"Autonomous Database {adb.display_name} has unrestricted public access with IP range 0.0.0.0/0 in whitelisted IPs."
            else:
                report.status = "PASS"
                if adb.subnet_id:
                    report.status_extended = f"Autonomous Database {adb.display_name} is deployed within a VCN."
                else:
                    report.status_extended = f"Autonomous Database {adb.display_name} has restricted public access with whitelisted IPs."

            findings.append(report)

        return findings

References