Check ID: analytics_instance_access_restricted
Provider: Oracle Cloud (OCI)
Service: analytics
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: AnalyticsInstance

​
What this check verifies

Oracle Analytics Cloud endpoints are evaluated for network exposure. Public endpoints must use restricted allowlists of specific IPs/CIDRs; presence of 0.0.0.0/0 or no allowed sources indicates unrestricted access. Instances using a VCN/private endpoint or public endpoints limited to specific sources align with the intended exposure model.

​
Risk

Unrestricted OAC endpoints allow Internet-wide access to the login surface, enabling credential stuffing and brute force. Account takeover can expose reports and data sources (confidentiality), permit dashboard/model changes (integrity), and support lateral movement into connected systems.

​
Recommendation

Prefer private deployment in a VCN and apply least privilege network access. If public is required, enforce allowlists to specific IPs/CIDRs and never include 0.0.0.0/0. Use private access channels/service gateways, require MFA/SSO, and apply defense in depth (WAF, audit monitoring) to reduce exposure.

​
Remediation

resource "oci_analytics_analytics_instance" "example" {
  compartment_id    = "<example_resource_id>"
  name              = "<example_resource_name>"
  feature_set       = "ENTERPRISE_ANALYTICS"
  license_type      = "LICENSE_INCLUDED"
  idcs_access_token = "<example_resource_id>"

  capacity {
    capacity_type  = "OLPU_COUNT"
    capacity_value = 1
  }

  network_endpoint_details {
    network_endpoint_type = "PUBLIC"
    whitelisted_ips       = ["<example_resource_id>"] # Critical: restrict to specific allowed CIDR; not 0.0.0.0/0
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = analytics_instance_access_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks