Back to Checks
oraclecloud

Integration Cloud instance uses a private endpoint or a public endpoint with IP or VCN allowlists

integration_instance_access_restricted
Service: integrationSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:IntegrationInstance

Oracle Integration Cloud instances are evaluated for network endpoint restrictions, confirming access is limited to approved IPs or VCNs. Configurations with 0.0.0.0/0, missing endpoint details, or PUBLIC endpoints without allowlists are identified; PRIVATE endpoints or PUBLIC endpoints with IP/VCN allowlists indicate restricted access.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Unrestricted OIC endpoints expose integration APIs and consoles to the Internet, enabling credential brute force, token theft, and unauthorized invocations. Attackers can exfiltrate data, alter workflows, and pivot into connected backends, impacting confidentiality and integrity, and causing availability issues via abuse or DoS.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks integration_instance_access_restricted

Recommendation

Prefer PRIVATE endpoints and restrict access to specific VCNs. If PUBLIC is required, enforce strict IP allowlists-never 0.0.0.0/0. Apply least privilege at network layers, place OIC behind WAF/VPN, segment with security lists, and monitor access logs. Review allowlists regularly as part of defense in depth.

Remediation

CLI

oci integration integration-instance update --integration-instance-id <example_resource_id> --network-endpoint-details '{"networkEndpointType":"PUBLIC","allowlistedHttpIps":["<ALLOWED_CIDR>"]}'

Terraform

# Restrict OIC access by allowlisting specific IPs
resource "oci_integration_integration_instance" "<example_resource_name>" {
  network_endpoint_details {
    network_endpoint_type = "PUBLIC"
    allowlisted_http_ips  = ["<ALLOWED_CIDR>"]  # Critical: restricts access to specified IP/CIDR
  }
}

Other

1In the OCI Console, go to Developer Services > Integration > Integration instances
2Open <example_resource_name> and click Edit
3If using Public endpoint: add an entry under Allowed IPs (e.g., <ALLOWED_CIDR>) and remove any 0.0.0.0/0
4Alternatively, switch to Private endpoint if desired and select the required VCN/subnet
5Click Save

Check Code

"""Check Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.integration.integration_client import (
    integration_client,
)


class integration_instance_access_restricted(Check):
    """Check Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources."""

    def execute(self) -> Check_Report_OCI:
        """Execute the integration_instance_access_restricted check."""
        findings = []

        for instance in integration_client.integration_instances:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=instance,
                region=instance.region,
                resource_name=instance.display_name,
                resource_id=instance.id,
                compartment_id=instance.compartment_id,
            )
            # Check if instance has no network endpoint details (unrestricted access)
            if not instance.network_endpoint_details:
                report.status = "FAIL"
                report.status_extended = f"Integration instance {instance.display_name} has no network endpoint details configured (unrestricted access)."
            # Check if 0.0.0.0/0 is in network endpoint details
            elif "0.0.0.0/0" in str(instance.network_endpoint_details):
                report.status = "FAIL"
                report.status_extended = f"Integration instance {instance.display_name} has unrestricted access with 0.0.0.0/0 in network endpoint details."
            # Check if PUBLIC endpoint with no allowlists
            elif (
                instance.network_endpoint_details.get("network_endpoint_type")
                == "PUBLIC"
                and not instance.network_endpoint_details.get("allowlisted_http_ips")
                and not instance.network_endpoint_details.get("allowlisted_http_vcns")
            ):
                report.status = "FAIL"
                report.status_extended = f"Integration instance {instance.display_name} has public access with no IP or VCN allowlists configured."
            else:
                report.status = "PASS"
                report.status_extended = f"Integration instance {instance.display_name} has restricted network access configured."

            findings.append(report)

        return findings

References