Oracle Cloud Infrastructure Bastion

 Introduction

One of the most common security mistakes in cloud environments is exposing virtual machines directly to the Internet for administrative access. While opening SSH (port 22) or RDP (port 3389) may seem convenient, it significantly increases the attack surface and exposes critical infrastructure to automated scans, brute-force attacks, and unauthorized access attempts.

Oracle Cloud Infrastructure (OCI) Bastion provides a secure alternative by enabling administrators to connect to private Compute instances without assigning public IP addresses. Instead of allowing permanent inbound access, OCI Bastion creates time-limited, audited sessions that follow Zero Trust security principles.

Whether you’re managing production workloads, development environments, or enterprise applications such as Oracle EPM, OCI Bastion helps reduce security risks while simplifying secure remote administration.

In this article, we’ll explore how OCI Bastion works, its key benefits, common use cases, and the best practices every OCI administrator should implement.


Why Use OCI Bastion?

Traditional administration often requires assigning public IP addresses to servers or opening firewall rules to allow SSH or RDP access. These approaches increase operational risk and require continuous maintenance to remain secure.

OCI Bastion eliminates this requirement by acting as a secure access service between administrators and private cloud resources.

Key Benefits

  • No public IP addresses required for Compute instances
  • Secure SSH access to private resources
  • Temporary sessions with automatic expiration
  • Centralized access management
  • Integration with OCI Identity and Access Management (IAM)
  • Reduced attack surface
  • Support for Zero Trust security principles
  • Auditability through OCI logging and monitoring

By removing direct administrative exposure to the Internet, organizations can significantly strengthen the security posture of their OCI environments.


How OCI Bastion Works

OCI Bastion acts as a controlled access layer between an administrator and resources deployed inside a private subnet.

Instead of assigning a public IP address to a Compute instance, the administrator creates a temporary Bastion session. The connection is authenticated and authorized through OCI Identity and Access Management (IAM), restricted to approved client IP addresses, and protected with an SSH key pair.

The basic access flow is:

  1. The administrator authenticates to OCI.
  2. IAM policies determine whether the administrator can use the Bastion service.
  3. A temporary session is created for the target resource.
  4. The administrator uses the generated SSH command and private key.
  5. OCI Bastion routes the connection to the private resource.
  6. The session automatically expires after its configured lifetime.


Insert the Architecture Image Here

OCI Bastion – Secure Access Architecture


OCI Bastion Session Types

OCI Bastion supports different session types depending on the resource and protocol administrators need to access.

Managed SSH Session

Provides direct SSH access to supported Linux Compute instances.

Requirements include:

  • Linux Compute instance
  • OpenSSH Server
  • Oracle Cloud Agent
  • Bastion Plugin enabled

This is the simplest option for Linux virtual machines managed directly in OCI.


SSH Port Forwarding Session

Creates an encrypted tunnel between your local workstation and a specific port on a private resource.

Common use cases include:

  • SSH
  • Remote Desktop (RDP)
  • Oracle Database
  • MySQL
  • VNC
  • Any TCP-based application

This option is ideal for databases and Windows servers because it doesn’t require the Bastion plugin.


Dynamic Port Forwarding

Creates a SOCKS5 proxy that allows secure access to multiple internal resources through a single encrypted tunnel.

This is particularly useful for administrators who need temporary access to several services inside a private subnet.


Common OCI Bastion Use Cases

OCI Bastion can be used in many enterprise scenarios.

Secure Linux Administration

Connect securely to private Linux Compute instances without exposing them to the Internet.

Windows Remote Desktop

Access Windows servers through secure RDP tunnels without assigning public IP addresses.

Private Database Access

Create secure tunnels to Oracle Database or MySQL instances located in private subnets.

Oracle EPM Administration

Provide secure administrative access to:

  • Planning
  • HFM
  • Essbase
  • FDMEE
  • WebLogic
  • Oracle HTTP Server

without exposing production servers externally.

High-Security Environments

OCI Bastion is an excellent solution for organizations implementing Zero Trust architectures and Security Zones.


Prerequisites

Before creating an OCI Bastion, verify the following:

  • Target resources are deployed in private subnets.
  • IAM policies have been configured.
  • Bastion belongs to the correct VCN.
  • Client IP addresses are included in the allowlist.
  • Security Lists or NSGs allow required traffic.
  • SSH key pair is available.
  • Credentials are ready.
  • Oracle Cloud Agent and Bastion Plugin are enabled when using Managed SSH.


IAM and Least Privilege

OCI IAM controls who can create, manage, and use Bastions.

Apply the Principle of Least Privilege by granting only the permissions required for each administrator.

Recommended practices include:

  • Separate Bastion administrators from users.
  • Restrict permissions by compartment.
  • Limit access to specific Bastions.
  • Control access using administrator groups.
  • Protect privileged accounts with MFA.

Example policy:

Allow group Bastion-Administrators to manage bastion-family in compartment Production

Security Best Practices

To maximize the security benefits of OCI Bastion:

  • Restrict Client CIDR ranges.
  • Use temporary sessions only.
  • Enable Multi-Factor Authentication.
  • Protect SSH private keys.
  • Apply Least Privilege.
  • Review IAM policies regularly.
  • Audit all Bastion activities.
  • Monitor administrative sessions.
  • Limit network access using NSGs.
  • Periodically review active users and permissions.


Monitoring and Auditing

OCI Bastion integrates with Oracle Cloud native monitoring services.

Administrators should monitor:

  • Session creation
  • Session deletion
  • Administrator activity
  • Failed access attempts
  • IAM changes
  • Audit events

Combining Bastion with OCI Audit and Monitoring provides complete visibility into administrative access.


Common Mistakes

Avoid these common configuration errors:

  • Allowing large Client CIDR ranges.
  • Forgetting NSG or Security List rules.
  • Disabling the Bastion Plugin.
  • Selecting the wrong session type.
  • Granting excessive IAM permissions.
  • Leaving sessions active longer than necessary.
  • Treating Bastion as a replacement for server hardening.

Conclusion

OCI Bastion is a modern, secure, and cloud-native solution for managing administrative access to private cloud resources. By eliminating the need for public IP addresses and replacing traditional jump servers with temporary, controlled sessions, organizations can significantly reduce their attack surface while improving operational security.

When combined with OCI Identity and Access Management, Multi-Factor Authentication, Audit, and Monitoring, OCI Bastion becomes an essential component of a Zero Trust architecture.

Whether you’re managing Oracle EPM environments, databases, or general cloud infrastructure, implementing OCI Bastion is a recommended best practice for protecting production environments while maintaining secure and efficient administrative access.


About the Author

João Teixeira

Oracle EPM & OCI Infrastructure Specialist

Oracle ACE Apprentice

JLTDS Oracle Tech

Sharing practical guides, best practices, and real-world solutions for Oracle Cloud Infrastructure (OCI) and Oracle Enterprise Performance Management (EPM).





Comentários

Postar um comentário

Postagens mais visitadas deste blog

Oracle Essbase 21c Production Readiness Assessment: What I Check Before an Environment Goes Live

Imagem
It Runs. But Is It Ready for Production? Every Essbase assessment I have performed starts with the same uncomfortable question, and it is rarely the question the client expects. They usually want to know why a calculation is slow, or why a Managed Server occasionally throws a memory warning. What they are really asking, without knowing it, is a bigger question: is this environment actually ready to carry production weight, or has it just been running long enough that nobody has stopped to check? Those are not the same thing. An Essbase Managed Server can start cleanly, applications can come online, Smart View can connect, and a calculation script can execute without error, and none of that proves the environment is production-ready. It proves the environment is currently functional under whatever conditions exist at that exact moment. Production readiness is a different claim. It means the environment has been observed under representative load, the configuration has been validated r...
Leia mais

I Broke My OCI Environment on Purpose

Imagem
  Introduction Most cloud architecture diagrams show the perfect scenario. Compute instances are healthy. Networks are available. Databases are responding. Monitoring dashboards are green. Applications are running normally. But production environments are rarely that predictable. So instead of asking: “Is my OCI architecture well designed?” I wanted to explore a different question: “What happens when individual components start failing?” This article presents a controlled OCI Chaos Engineering Lab designed to examine how different infrastructure and application failures affect an enterprise cloud environment. The objective is not simply to break infrastructure. The objective is to understand four things: Can I detect the failure? Can I diagnose it? Can I isolate the impact? Can I recover from it? The Experiment For this lab, we will examine six controlled failure scenarios representing problems that operations teams may encounter in production environments. The C...
Leia mais

OCI Landing Zone Blueprint

Imagem
  Introduction Deploying resources in Oracle Cloud Infrastructure (OCI) is straightforward, but building an enterprise-ready cloud environment requires much more than provisioning Compute instances and Virtual Cloud Networks (VCNs). Organizations need a well-defined architecture that establishes security, governance, networking, identity, monitoring, and operational standards before business workloads are deployed. This foundational architecture is commonly referred to as a Landing Zone . An OCI Landing Zone provides a standardized framework that helps organizations deploy cloud resources consistently while enforcing security policies, governance controls, and operational best practices from the very beginning. Rather than configuring each project independently, administrators create a reusable architecture that accelerates deployments, simplifies management, and reduces operational risk. Whether supporting Oracle EPM, enterprise databases, business applications, or cloud-nativ...
Leia mais