From 1a6285c6a07142d57e5f20d6101f229e2992bde3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Fri, 6 Mar 2026 12:30:50 +0100 Subject: [PATCH] chore(oraclecloud): enhance metadata for `integration` service (#9376) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + ...n_instance_access_restricted.metadata.json | 32 +++++++++---------- 2 files changed, 17 insertions(+), 16 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index d551aae168..6b4dc56aa7 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -24,6 +24,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update Oracle Cloud Compute Engine service metadata to new format [(#9371)](https://github.com/prowler-cloud/prowler/pull/9371) - Update Oracle Cloud Database service metadata to new format [(#9372)](https://github.com/prowler-cloud/prowler/pull/9372) - Update Oracle Cloud File Storage service metadata to new format [(#9374)](https://github.com/prowler-cloud/prowler/pull/9374) +- Update Oracle Cloud Integration service metadata to new format [(#9376)](https://github.com/prowler-cloud/prowler/pull/9376) --- diff --git a/prowler/providers/oraclecloud/services/integration/integration_instance_access_restricted/integration_instance_access_restricted.metadata.json b/prowler/providers/oraclecloud/services/integration/integration_instance_access_restricted/integration_instance_access_restricted.metadata.json index f1dc34147c..5003af480d 100644 --- a/prowler/providers/oraclecloud/services/integration/integration_instance_access_restricted/integration_instance_access_restricted.metadata.json +++ b/prowler/providers/oraclecloud/services/integration/integration_instance_access_restricted/integration_instance_access_restricted.metadata.json @@ -1,35 +1,35 @@ { "Provider": "oraclecloud", "CheckID": "integration_instance_access_restricted", - "CheckTitle": "Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources", - "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards", - "CIS OCI Foundations Benchmark" - ], + "CheckTitle": "Integration Cloud instance uses a private endpoint or a public endpoint with IP or VCN allowlists", + "CheckType": [], "ServiceName": "integration", "SubServiceName": "", - "ResourceIdTemplate": "oci:integration:instance", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "IntegrationInstance", "ResourceGroup": "compute", - "Description": "Oracle Integration Cloud access should be restricted to allowed sources.", - "Risk": "Not meeting this network security requirement increases risk of unauthorized access.", - "RelatedUrl": "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm", + "Description": "**Oracle Integration Cloud instances** are evaluated for **network endpoint restrictions**, confirming access is limited to approved IPs or VCNs. Configurations with `0.0.0.0/0`, missing endpoint details, or **PUBLIC** endpoints without allowlists are identified; **PRIVATE** endpoints or PUBLIC endpoints with IP/VCN allowlists indicate restricted access.", + "Risk": "Unrestricted OIC endpoints expose integration APIs and consoles to the Internet, enabling credential brute force, token theft, and unauthorized invocations. Attackers can exfiltrate data, alter workflows, and pivot into connected backends, impacting confidentiality and integrity, and causing availability issues via abuse or DoS.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.oracle.com/en-us/iaas/Content/Network/home.htm" + ], "Remediation": { "Code": { - "CLI": "", + "CLI": "oci integration integration-instance update --integration-instance-id --network-endpoint-details '{\"networkEndpointType\":\"PUBLIC\",\"allowlistedHttpIps\":[\"\"]}'", "NativeIaC": "", - "Other": "", - "Terraform": "" + "Other": "1. In the OCI Console, go to Developer Services > Integration > Integration instances\n2. Open and click Edit\n3. If using Public endpoint: add an entry under Allowed IPs (e.g., ) and remove any 0.0.0.0/0\n4. Alternatively, switch to Private endpoint if desired and select the required VCN/subnet\n5. Click Save", + "Terraform": "```hcl\n# Restrict OIC access by allowlisting specific IPs\nresource \"oci_integration_integration_instance\" \"\" {\n network_endpoint_details {\n network_endpoint_type = \"PUBLIC\"\n allowlisted_http_ips = [\"\"] # Critical: restricts access to specified IP/CIDR\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources", - "Url": "https://hub.prowler.com/check/oci/integration_instance_access_restricted" + "Text": "Prefer **PRIVATE** endpoints and restrict access to specific VCNs. *If PUBLIC is required*, enforce strict IP allowlists-never `0.0.0.0/0`. Apply **least privilege** at network layers, place OIC behind **WAF/VPN**, segment with security lists, and monitor access logs. Review allowlists regularly as part of **defense in depth**.", + "Url": "https://hub.prowler.com/check/integration_instance_access_restricted" } }, "Categories": [ - "network-security" + "internet-exposed", + "trust-boundaries" ], "DependsOn": [], "RelatedTo": [],