Integration Cloud instance restricts network access

Check ID: integration_instance_access_restricted
Provider: Oracle Cloud (OCI)
Service: integration
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: IntegrationInstance

What this check verifies

Oracle Integration Cloud instances are evaluated for network endpoint restrictions, confirming access is limited to approved IPs or VCNs. Configurations with 0.0.0.0/0, missing endpoint details, or PUBLIC endpoints without allowlists are identified; PRIVATE endpoints or PUBLIC endpoints with IP/VCN allowlists indicate restricted access.

Risk

Unrestricted OIC endpoints expose integration APIs and consoles to the Internet, enabling credential brute force, token theft, and unauthorized invocations. Attackers can exfiltrate data, alter workflows, and pivot into connected backends, impacting confidentiality and integrity, and causing availability issues via abuse or DoS.

Recommendation

Prefer PRIVATE endpoints and restrict access to specific VCNs. If PUBLIC is required, enforce strict IP allowlists-never 0.0.0.0/0. Apply least privilege at network layers, place OIC behind WAF/VPN, segment with security lists, and monitor access logs. Review allowlists regularly as part of defense in depth.

Remediation

CLI
Terraform
Dashboard steps

oci integration integration-instance update --integration-instance-id <example_resource_id> --network-endpoint-details '{"networkEndpointType":"PUBLIC","allowlistedHttpIps":["<ALLOWED_CIDR>"]}'

# Restrict OIC access by allowlisting specific IPs
resource "oci_integration_integration_instance" "<example_resource_name>" {
  network_endpoint_details {
    network_endpoint_type = "PUBLIC"
    allowlisted_http_ips  = ["<ALLOWED_CIDR>"]  # Critical: restricts access to specified IP/CIDR
  }
}

References

https://docs.oracle.com/en-us/iaas/Content/Network/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = integration_instance_access_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

IAM user has a valid email address Customer-managed KMS key rotates within 365 days

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires