This diagram depicts a VCN in an OCI region containing ADW and OAC private endpoints and public NLBs to support Internet access.
This diagram depicts the ZPR components necessary to secure the NLBs, OAC services, and the ADW.
Published November 18, 2024 v3
The Oracle Analytics platform comprises OAC (Oracle Analytics Cloud) and OAS (Oracle Analytics Server). It supports the efforts of every analytics user role. AI and ML are embedded throughout the platform to accelerate productivity and power better business decisions. Features include:
This post guides you in securing OAC (Oracle Analytics Cloud) using ZPR (Zero Trust Packet Routing). It is part of the Analytics Zero Trust Packet Routing series and a companion post to Secure Oracle Analytics Server using Zero Trust Packet Routing. It includes architectural diagrams, component descriptions, deployment scenarios, and links to other references.
Following the guidance in this post requires:
The OCI Zero Trust Packet Routing documentation provides an excellent introduction and a short video.
ZPR helps prevent unauthorized access to data by decoupling network security policies from the underlying network architecture. Using an easily understood, intent-based policy language, functional security administrators can define specific access pathways for data that build upon the foundation of network firewalls, route tables, and security lists managed by network administrators.
ZPR policies require that the network administration components exist but take precedence over them. For example, security lists and route tables in a VCN (Virtual Cloud Network) secure OAC resources. ZPR policies restrict access to only the resources explicitly assigned to ZPR security attributes referenced in a ZPR policy.
ZPR is VCN-centric. Components secured with ZPR security attributes must reside in the same VCN.
The public OAC instance is in the Oracle Services Network and accessible from the Internet. Because it is not in the VCN, it cannot be secured directly with ZPR.
This post shows an alternative where the public OAC instance is accessed via an NLB in the VCN. This alternative enables ZPR to secure it.
This diagram depicts a VCN in an OCI region containing ADW and OAC private endpoints and public NLBs to support Internet access.
This diagram depicts the ZPR components necessary to secure the NLBs, OAC services, and the ADW.
The secured architecture has these additional components:
ZPR security attribute values are referenced in ZPR policies to control access to supported resources. The examples in Prepare Zero Trust Packet Routing Components for Securing Oracle Analytics Services have the following ZPR security attributes defined:
This post uses the following values:
External resources outside the VCN must be referenced using CIDR blocks ( A CIDR block is a collection of IP addresses that share the same network prefix ). This post uses the following:
The following table shows the ZPR security attributes and values.
External |
App | Database | Network | ||||
|
|
zpr-adw | zpr-vcn |
A ZPR policy is a container for ZPR policy statements. ZPR policy statements are rules that specify what resources can access other resources. A ZPR policy is based on an Attribute-Based Access Control (ABAC) authorization model that evaluates attributes (or characteristics) to determine resource access.
The following statements are used in this post (ceal_zpr is the ZPR namespace):
in | ceal_zpr.network:zpr-vcn | VCN allow | '10.20.0.0/16' | to connect to | ceal_zpr.app:zpr-nlb | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | ceal_zpr.app:zpr-nlb | endpoints to connect to | ceal_zpr.app:zpr-oac | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | ceal_zpr.app:zpr-oac | endpoints to connect to | ceal_zpr.database:zpr-adw | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | ceal_zpr.app:zpr-nlb | endpoints to connect to | '138.1.49.233' |
Protected resources are OCI services, i.e., OAC, NLB, ADW, with assigned ZPR attribute values.
The protected resources in this post are:
Several frameworks exist to deploy the components:
The OCI Terraform provider allows you to use Terraform to interact with OCI resources.
The OCI Console provides a single interface to manage all cloud services.
OCI APIs (Application Programming Interface)
The OCI APIs are REST APIs that use HTTPS requests and responses.
OCI CLI (Command Line Interface)
The OCI CLI is a small footprint tool that can be used alone or with the OCI Console to complete OCI tasks. The CLI provides the same core functionality as the Console, plus additional commands. Some of these, such as the ability to run scripts, extend Console functionality.
The provisioning sequence assumes the ZPR compartment, namespace, and attributes exist.
Using your ZPR namespace requires the namespace to precede security attributes.
A typical provisioning sequence for the components in this post follows:
The next step in the ZPR journey is to assign ZPR attributes to other services, e.g., OAS and supporting resources. The processes differ depending on the use case and are described in companion posts in this series.
Ensure that users can access the OAC instances and that the OAC connections to the ADW function correctly.
Ensure that ancillary connections that use the ZPR-protected resources function correctly.
Note. Once a ZPR attribute value is assigned to a resource, all ingress and egress to and from that resource is restricted. Assigning a value to an NLB and then creating a statement allowing it to connect to OAC is not enough. You must also write statements for the users and resources connected to the NLB.
For example, assume the same NLB is used as a proxy for SQL*Developer connections to the ADW. This post adds an attribute value to the NLB and policy statements that allow the NLB to connect to OAC and user devices to connect to it. Because there is no statement allowing the NLB to connect to the ADW, SQL*Developer sessions now fail.
Series Overview for Securing Oracle Analytics Cloud Resources using Zero Trust Packet Routing
Prepare Zero Trust Packet Routing Components for Securing Oracle Analytics Services
Secure Oracle Analytics Server using Zero Trust Packet Routing
Zero Trust Packet Routing IAM Policies
Enabling Zero Trust Packet Routing
Managing Security Attribute Namespaces
Managing Security Attributes
ZPR policy basics
Managing Zero Trust Packet Routing Policies
ZPR Policy Syntax
ZPR Protected Resources
Data visualization and storytelling
Machine learning
Mobile analytics
Open data source connectivity
Data preparation and enrichment
Enterprise data modeling
Previous Post
Next Post