This diagram depicts a VCN in an OCI region containing ADW and OAS instances and the public NLB and Bastion to support Internet access.
This diagram depicts the ZPR components necessary to secure the NLBs, OAS services, and the ADW.
Published November 23, 2024 v1
The Oracle Analytics platform comprises OAC (Oracle Analytics Cloud) and OAS (Oracle Analytics Server). It supports the efforts of every analytics user role. AI and ML are embedded throughout the platform to accelerate productivity and power better business decisions. Features include:
This post guides you in securing OAS (Oracle Analytics Server) using ZPR (Zero Trust Packet Routing). It is part of the Analytics Zero Trust Packet Routing series and a companion post to Secure Oracle Analytics Cloud using Zero Trust Packet Routing. It includes architectural diagrams, component descriptions, deployment scenarios, and links to other references.
Following the guidance in this post requires:
The OCI Zero Trust Packet Routing documentation provides an excellent introduction and a short video.
ZPR helps prevent unauthorized access to data by decoupling network security policies from the underlying network architecture. Using an easily understood, intent-based policy language, functional security administrators can define specific access pathways for data that build upon the foundation of network firewalls, route tables, and security lists managed by network administrators.
ZPR policies require that the network administration components exist but take precedence over them. For example, security lists and route tables in a VCN (Virtual Cloud Network) secure OAS resources. ZPR policies restrict access to only the resources explicitly assigned to ZPR security attributes referenced in a ZPR policy.
ZPR is VCN-centric. Components secured with ZPR security attributes must reside in the same VCN.
This diagram depicts a VCN in an OCI region containing ADW and OAS instances and the public NLB and Bastion to support Internet access.
This diagram depicts the ZPR components necessary to secure the NLBs, OAS services, and the ADW.
The secured architecture has these additional components:
An OAS instance requires a repository schema within a database, created and managed by an RCU (Repository Creation Utility). This post uses an Oracle base database system in a VCN (Virtual Cloud Network) private subnet and refers to the database and the utility as RCU.
OAS continually accesses the RCU during its operations.
A bastion resource provides restricted and time-limited secure access to resources that allow SSH (Secure Shell Protocol) access and don't have public endpoints. This post uses a compute instance in a public subnet to act as a bastion.
Administrators require a bastion to connect to the repository database and run the RCU.
Devices with IP addresses that are used to connect to the OAS instances.
ZPR security attribute values are referenced in ZPR policies to control access to supported resources. The examples in Prepare Zero Trust Packet Routing Components for Securing Oracle Analytics Services have the following ZPR security attributes defined:
This post uses the following values:
External resources outside the VCN must be referenced using CIDR blocks ( A CIDR block is a collection of IP addresses that share the same network prefix ). This post uses the following:
The following table shows the ZPR security attributes and values.
External | App | Database | Network | |||||
'10.20.0.0/16' |
|
|
zpr-vcn |
A ZPR policy is a container for ZPR policy statements, which are rules specifying which resources can access other resources. A ZPR policy is based on an Attribute-Based Access Control (ABAC) authorization model that evaluates attributes (or characteristics) to determine resource access.
The following statements are used in this post (ceal_zpr is the ZPR namespace):
in | ceal_zpr.network:zpr-vcn | VCN allow | '10.20.0.0/16' | to connect to | ceal_zpr.app:zpr-nlb | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | '10.20.0.0/16' | to connect to | ceal_zpr.app:zpr-bastion | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | '10.20.0.0/16' | to connect to | ceal_zpr.app:zpr-oas | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | ceal_zpr.app:zpr-nlb | endpoints to connect to | ceal_zpr.app:zpr-oas | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | ceal_zpr.app:zpr-bastion | endpoints to connect to | ceal_zpr.app:zpr-oas | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | ceal_zpr.app:zpr-bastion | endpoints to connect to | ceal_zpr.database:zpr-rcu | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | ceal_zpr.app:zpr-oas | endpoints to connect to | ceal_zpr.database:zpr-adw | endpoints |
in | ceal_zpr.network:zpr-vcn | VCN allow | ceal_zpr.app:zpr-oas | endpoints to connect to | ceal_zpr.database:zpr-rcu | endpoints |
Protected resources are OCI services, i.e., OAS and ADW, with assigned ZPR attribute values.
The protected resources in this post are:
Several frameworks exist to deploy the components:
The OCI Terraform provider allows you to use Terraform to interact with OCI resources.
The OCI Console provides a single interface to manage all cloud services.
OCI APIs (Application Programming Interface)
The OCI APIs are REST APIs that use HTTPS requests and responses.
OCI CLI (Command Line Interface)
The OCI CLI is a small footprint tool that can be used alone or with the OCI Console to complete OCI tasks. The CLI provides the same core functionality as the Console, plus additional commands. Some of these, such as the ability to run scripts, extend Console functionality.
The provisioning sequence assumes the ZPR compartment, namespace, and attributes exist.
Using your ZPR namespace requires the namespace to precede security attributes.
A typical provisioning sequence for the components in this post follows:
The next step in the ZPR journey is to assign ZPR attributes to other services, e.g., OAC and supporting resources. The processes differ depending on the use case and are described in companion posts in this series.
Ensure that users can access the OAS instances and that the OAS connections to the ADW function correctly.
Ensure that ancillary connections that use the ZPR-protected resources function correctly.
Note. Once a ZPR attribute value is assigned to a resource, all ingress and egress to and from that resource are restricted. Assigning a ZPR value to an NLB and creating a ZPR policy statement allowing it to connect to OAS is insufficient. You must also write statements for the users and resources connected to the NLB.
For example, assume the same NLB is used as a proxy for SQL*Developer connections to the ADW. This post adds an attribute value to the NLB and policy statements that allow the NLB to connect to OAS and user devices to connect to it. Because there is no statement allowing the NLB to connect to the ADW, SQL*Developer sessions now fail.
Series Overview for Securing Oracle Analytics Cloud Resources using Zero Trust Packet Routing
Prepare Zero Trust Packet Routing Components for Securing Oracle Analytics Services
Zero Trust Packet Routing IAM Policies
Enabling Zero Trust Packet Routing
Managing Security Attribute Namespaces
Managing Security Attributes
ZPR policy basics
Managing Zero Trust Packet Routing Policies
ZPR Policy Syntax
ZPR Protected Resources
Data visualization and storytelling
Machine learning
Mobile analytics
Open data source connectivity
Data preparation and enrichment
Enterprise data modeling
Previous Post
Next Post