In Oracle Cloud Infrastructure (OCI) > Autonomous Database (ADB), the "Choose Network Access" setting lets you control how users can connect to your database.
Important: If you make a change, it changes the connections in the Wallet. So you must re-download the wallet.
Important: You cannot do this on Always Free. This is only possible on Paid ADBs.
How to make a change
Find your Autonomous Database in OCI, click More Actions > Update network access
If you cannot find this option… you are probably using Always Free & the option is not available.
Settings
Here are what the settings look like:
What they are used for
TL;DR From left to right, just think Public, Mixed, Private
Secure Access from Everywhere
Use Cases:
Public applications needing global database access
Distributed teams or clients connecting from varied locations
APEX will be available across the Internet
Database will accessible given the Username, Password, Service & Wallet.
Secure Access from Allowed IPs and VCNs Only
Use Cases:
Controlled access for internal company IPs or office locations i.e over VPNs. Oracle has some good documentation on this.
Applications requiring restricted connectivity from specific OCI VCNs
Which means
IPs i.e useful for controlled access by remote teams, developers, or users outside of OCI who are connecting from static IP addresses.
VCNs i.e Ideal for applications, resources, or other services within OCI that need direct interaction with APEX or the database.
This option is more flexible for mixed-access needs
Private Endpoint Access Only
Use Cases:
Highly secure, internal applications within OCI
Used for Load Balancers
This option provides stricter security with full isolation within OCI.
It restricts access entirely to OCI’s private network, with no internet exposure.
Only resources within the same VCN or peered VCNs can access the database.
Changing a setting
Secure Access from Everywhere
Just click the icon
Secure Access from Allowed IPs and VCNs Only
Click the Icon
And then optionally set the IPs and VCNs afterwards
Private Endpoint Access Only
This moves the ADB to a private subnet belonging to a VCN. This is the highest level of security. The ADB can be accessed by any compute on the same VCN or on another VCN via the LPG.
To change to Private Endpoint, a Network Security Group can be optionally set now, or later. A Network Security Group (NSG) on Oracle Cloud Infrastructure (OCI) is like a firewall that defines security rules to control inbound and outbound traffic - so by assigning an ADB to a NSG, you are assigning it to a set of rules which contain ingress/egress (i.e the incoming/outgoing CIDRs) of the VCNs including port numbers. For example, ORDS on Autonomous operates on port 443, so I may allow my public subnet to allow incoming (ingress) traffic (http or tcp on port 443).
In addition, public access can be allowed by an IP. A public IP does work, although defeats the object, as this could present a security vulnerability because it contradicts the isolation typically expected with private subnets. However is could be used for Remote Developer Access or REST access from third party sources.
After making a change
If you make a change, it changes the connections in the Wallet. So you must re-download the wallet.
Database Connection > Download Wallet
ENJOY!
What’s the picture? Someone left the door open at Knareborough Castle, which is rare, so I snapped this quick picture - it looks like its in good nick too. Visit Yorkshire!