Check ID: database_autonomous_database_access_restricted
Provider: Oracle Cloud (OCI)
Service: database
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: AutonomousDatabase

​
What this check verifies

OCI Autonomous Database (shared) network exposure is evaluated: instances are treated as restricted when using a VCN private endpoint or when ACLs allow only specified IPs/VCNs. It identifies configurations with no ACL and no VCN, or ACLs permitting 0.0.0.0/0.

​
Risk

With open access, attackers can probe endpoints, brute-force credentials, or abuse leaked wallets to connect. Impact:
  • Confidentiality: unauthorized queries and data exfiltration
  • Integrity: malicious changes
  • Availability: heavy queries or scans causing service disruption

​
Recommendation

Prefer VCN private endpoints to eliminate internet exposure. If public access is required, enforce least privilege by limiting ACLs to specific CIDRs or VCNs; never use 0.0.0.0/0. Add defense in depth with NSGs and private connectivity (VPN/peering), monitor access, and rotate client wallets regularly.

​
Remediation

oci db autonomous-database update —autonomous-database-id <adb-ocid> —is-access-control-enabled true —whitelisted-ips ’[“<ALLOWED_IP_OR_CIDR>”]’

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = database_autonomous_database_access_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks