Secure Oracle Analytics Server using Zero Trust Packet Routing

November 22, 2024 | 13 minute read
Text Size 100%:
rw

Published November 23, 2024 v1

Introduction Oracle Analytics Platform

The Oracle Analytics platform comprises OAC (Oracle Analytics Cloud) and OAS (Oracle Analytics Server). It supports the efforts of every analytics user role. AI and ML are embedded throughout the platform to accelerate productivity and power better business decisions. Features include:

  • Data visualization and storytelling
  • Machine learning
  • Mobile analytics
  • Open data source connectivity
  • Data preparation and enrichment
  • Enterprise data modeling

OAC PLATFORM


This post guides you in securing OAS (Oracle Analytics Server) using ZPR (Zero Trust Packet Routing). It is part of the Analytics Zero Trust Packet Routing series and a companion post to Secure Oracle Analytics Cloud using Zero Trust Packet Routing. It includes architectural diagrams, component descriptions, deployment scenarios, and links to other references.

Prerequisites

Following the guidance in this post requires:

  • An existing OCI tenancy.
  • An OCI Administrator with the authority to:
    • Manage Resources in Compartments
    • Manage ZPR Policies in the Tenancy
  • The ZPR components introduced in the Prepare Zero Trust Packet Routing Components for Securing Oracle Analytics Services  post:
    • An OCI compartment for ZPR
    • OCI Policies that allow the management of resources in the OCI compartment
    • ZPR Namespace
    • ZPR attributes
    • An understanding of ZPR policy statements
  • A VCN (Virtual Cloud Network).
  • A functioning ADW (Autonomous Data Warehouse) with a private endpoint in the VCN.
  • Two functioning OAS instances: one with a public endpoint and one with a private endpoint. Both must be in the same VCN as the ADW.
  • The OAS instances must be accessible.
    • Proxy resources, e.g., NLBs (Network Load Balancers) and Bastions, exist to support Internet access if necessary.
    • The DNS (Domain Name System) is configured to resolve the OAS and ADW hostnames.
    • The security lists and route tables are configured to allow ingress from users and egress to the ADW.
    • OAS connections exist to the ADW.

Synopsis

The OCI Zero Trust Packet Routing documentation provides an excellent introduction and a short video.

ZPR helps prevent unauthorized access to data by decoupling network security policies from the underlying network architecture. Using an easily understood, intent-based policy language, functional security administrators can define specific access pathways for data that build upon the foundation of network firewalls, route tables, and security lists managed by network administrators.

ZPR policies require that the network administration components exist but take precedence over them. For example, security lists and route tables in a VCN (Virtual Cloud Network) secure OAS resources. ZPR policies restrict access to only the resources explicitly assigned to ZPR security attributes referenced in a ZPR policy.

ZPR is VCN-centric. Components secured with ZPR security attributes must reside in the same VCN.


Topics
rw
Architecture
Initial State

This diagram depicts a VCN in an OCI region containing ADW and OAS instances and the public NLB and Bastion to support Internet access.

ZPR OAS Initial State


Prepared State

This diagram depicts the ZPR components necessary to secure the NLBs, OAS services, and the ADW.

ZPR OAS Secrued State

rw
Components

The secured architecture has these additional components:

  • ZPR Attribute Values
  • ZPR Policy Statements
  • ZPR Resource Assignments
Repository Database Schemas

An OAS instance requires a repository schema within a database, created and managed by an RCU (Repository Creation Utility). This post uses an Oracle base database system in a VCN (Virtual Cloud Network) private subnet and refers to the database and the utility as RCU.

OAS continually accesses the RCU during its operations.


Bastion Instance

A bastion resource provides restricted and time-limited secure access to resources that allow SSH (Secure Shell Protocol) access and don't have public endpoints. This post uses a compute instance in a public subnet to act as a bastion.

Administrators require a bastion to connect to the repository database and run the RCU.


User Devices

Devices with IP addresses that are used to connect to the OAS instances.


ZPR Attribute Values

ZPR security attribute values are referenced in ZPR policies to control access to supported resources.  The examples in Prepare Zero Trust Packet Routing Components for Securing Oracle Analytics Services have the following ZPR security attributes defined:

  • app (application)
  • network
  • database

This post uses the following values:

  • network:zpr-vcn
  • database:zpr-adw
  • database:zpr-rcu
  • app:zpr-oas
  • app:zpr-nlb
  • app:zpr-bastion

External resources outside the VCN must be referenced using CIDR blocks ( A CIDR block is a collection of IP addresses that share the same network prefix ). This post uses the following:

  • '10.20.0.0/16' for the user devices.

The following table shows the ZPR security attributes and values.

External App Database Network
'10.20.0.0/16'
zpr-nlb zpr-oas zpr-bastion
zpr-adw zpr-rcu
zpr-vcn

ZPR Policy Statements

A ZPR policy is a container for ZPR policy statements, which are rules specifying which resources can access other resources. A ZPR policy is based on an Attribute-Based Access Control (ABAC) authorization model that evaluates attributes (or characteristics) to determine resource access.

The following statements are used in this post (ceal_zpr is the ZPR namespace):

in ceal_zpr.network:zpr-vcn VCN allow '10.20.0.0/16' to connect to ceal_zpr.app:zpr-nlb endpoints
in ceal_zpr.network:zpr-vcn VCN allow '10.20.0.0/16' to connect to ceal_zpr.app:zpr-bastion endpoints
in ceal_zpr.network:zpr-vcn VCN allow '10.20.0.0/16' to connect to ceal_zpr.app:zpr-oas endpoints
in ceal_zpr.network:zpr-vcn VCN allow ceal_zpr.app:zpr-nlb endpoints to connect to ceal_zpr.app:zpr-oas endpoints
in ceal_zpr.network:zpr-vcn VCN allow ceal_zpr.app:zpr-bastion endpoints to connect to ceal_zpr.app:zpr-oas endpoints
in ceal_zpr.network:zpr-vcn VCN allow ceal_zpr.app:zpr-bastion endpoints to connect to ceal_zpr.database:zpr-rcu endpoints
in ceal_zpr.network:zpr-vcn VCN allow ceal_zpr.app:zpr-oas endpoints to connect to ceal_zpr.database:zpr-adw endpoints
in ceal_zpr.network:zpr-vcn VCN allow ceal_zpr.app:zpr-oas endpoints to connect to ceal_zpr.database:zpr-rcu endpoints

ZPR Protected Resources

Protected resources are OCI services, i.e., OAS and ADW, with assigned ZPR attribute values.

The protected resources in this post are:

  • A Bastion for SSH access to the private OAS instance and repository database schemas.
  • An NLB for HTTPS access to the private OAS instance.
  • The public and private OAS instances.
  • The private ADW endpoint.
  • The private database containing the OAS repository schemas.
rw
Deployment Scenarios Frameworks

Several frameworks exist to deploy the components:

OCI Terraform

The OCI Terraform provider allows you to use Terraform to interact with OCI resources.

OCI Console

The OCI Console provides a single interface to manage all cloud services.

OCI APIs (Application Programming Interface)

The OCI APIs are REST APIs that use HTTPS requests and responses.

OCI CLI (Command Line Interface)

The OCI CLI is a small footprint tool that can be used alone or with the OCI Console to complete OCI tasks. The CLI provides the same core functionality as the Console, plus additional commands. Some of these, such as the ability to run scripts, extend Console functionality.


Provisioning Sequence

The provisioning sequence assumes the ZPR compartment, namespace, and attributes exist.

Caution! The attribute values assigned to resources must first be referenced in a policy statement. Assigning attributes to resources without a corresponding reference renders them inaccessible.

Using your ZPR namespace requires the namespace to precede security attributes.

A typical provisioning sequence for the components in this post follows:

  1. Create a ZPR policy.
    • Familiarize yourself with ZPR policy basics before creating a policy.
    • Navigate to Identity & Security > ZPR Policies, and click Create Policy.
      • Enter a Name, e.g., ZPR_OAS_Policy, and a Description, then click Add Policy Statements.
        • Add the policy statements using the Manual Policy Builder.
        • Click Add.
      • Click Create Policy.

ZPR_OAS_Policy

  1. Protect Resources
    • Navigate to Identity & Security > ZPR Protected Resources, and click Add security attribute to resources.
      • Select the VCN. and click Next.
        • Select the Security attribute namespace, e.g., ceal_zpr, and the Security attribute, e.g., network, from the dropdowns.
        • Enter the Security attribute value, e.g., zpr-vcn, and click Next.
        • Review the added resource and click Submit.
        • Click Close.
    • Click Add security attribute to resources.
      • Select the private ADW and click Next.
        • Select the Security attribute namespace, e.g., ceal_zpr, and the Security attribute, e.g., database, from the dropdowns.
        • Enter the Security attribute value, e.g., zpr-adw, and click Next.
        • Review the added resource and click Submit.
        • Click Close.
    • Click Add security attribute to resources.
      • Select the repository database and click Next.
        • Select the Security attribute namespace, e.g., ceal_zpr, and the Security attribute, e.g., database, from the dropdowns.
        • Enter the Security attribute value, e.g., zpr-rcu, and click Next.
        • Review the added resource and click Submit.
        • Click Close.
    • Click Add security attribute to resources.
      • Select the NLB and click Next.
        • Select the Security attribute namespace, e.g., ceal_zpr, and the Security attribute, e.g., app, from the dropdowns.
        • Enter the Security attribute value, e.g., zpr-nlb, and click Next.
        • Review the added resources and click Submit.
        • Click Close.
    • Click Add security attribute to resources.
      • Select the Bastion and click Next.
        • Select the Security attribute namespace, e.g., ceal_zpr, and the Security attribute, e.g., app, from the dropdowns.
        • Enter the Security attribute value, e.g., zpr-bastion, and click Next.
        • Review the added resources and click Submit.
        • Click Close.
    • Click Add security attribute to resources.
      • Select both OAS instances and click Next.
        • Select the Security attribute namespace, e.g., ceal_zpr, and the Security attribute, e.g., app, from the dropdowns.
        • Enter the Security attribute value, e.g., zpr-oas, and click Next.
        • Review the added resources and click Submit.
        • Click Close.

ZPR OAS attribute


The next step in the ZPR journey is to assign ZPR attributes to other services, e.g., OAC and supporting resources. The processes differ depending on the use case and are described in companion posts in this series.

rw

Validation

Ensure that users can access the OAS instances and that the OAS connections to the ADW function correctly.

Ensure that ancillary connections that use the ZPR-protected resources function correctly.

Note. Once a ZPR attribute value is assigned to a resource, all ingress and egress to and from that resource are restricted. Assigning a ZPR value to an NLB and creating a ZPR policy statement allowing it to connect to OAS is insufficient.  You must also write statements for the users and resources connected to the NLB.
For example, assume the same NLB is used as a proxy for SQL*Developer connections to the ADW. This post adds an attribute value to the NLB and policy statements that allow the NLB to connect to OAS and user devices to connect to it.  Because there is no statement allowing the NLB to connect to the ADW, SQL*Developer sessions now fail.

rw

Explore More
Explore the Oracle Analytics community, blogs, and library.
Explore more about ZPR
Explore Analytics Platform Features rw

 

Dayne Carley


Previous Post

Unlocking Custom Visualizations in Oracle Analytics: A Guide to Building Your First D3.js Bar Chart - Part 1

Prasenjit Thakur | 5 min read

Next Post


Unlocking Custom Visualizations in Oracle Analytics: Implementing Core Logic for Bar Charts - Part 2

Prasenjit Thakur | 11 min read
Oracle Chatbot
Disconnected