Access Private Resources via Oracle Integration Cloud (OIC) using Private Endpoint

Private Endpoints are available in Oracle Integration Cloud 3(OIC3) as part of the 23.06 release. 

Private Endpoint allows to connect to private resources that resides in Virtual Cloud Network(VCN) without the need of connectivity agent. Earlier if we need to connect to Private Resources using OIC then we need to download and install a connectivity agent to establish this connectivity but with Private Endpoint we can avoid that step of installing and configuring the connectivity agent. Also Connectivity Agent was Inbound communication whereas Private End point is outbound communication.

The outbound traffic(Egress traffic) from Integration goes via private network and not through public internet providing additional security.  Another important thing to notice is a private endpoint secures only the outbound traffic from Integration Cloud and doesn't secure inbound traffic which originates outside the Oracle Integration.

Following Adapter support Private Endpoint as of 23.06 release - 

• FTP Adapter
• Oracle ADW Adapter
• Oracle ATP Adapter
• Oracle Database Cloud Service Adapter
• REST Adapter

More to be added in coming releases

Using Private Endpoint, you can connect to different resources like ATP, REST Server etc. in a private subnet. As of this release , there can be only one Private endpoint per integration Instance connecting to only one subnet.

  Things to remember - 

• The VCN must be in same region as Oracle Integration Instance
• The VCN and subnet can be in different compartments
• Subnet can be public or private
• Create Policy to access the resources 

            allow group group_name to manage virtual-network-family in compartment compartment-name 

In this blog, I will show how we can setup an ATP Database in private subnet, setup all required security/firewall rules, setup a OIC Private Endpoint and then connecting OIC to ATP DB sitting in private subnet via Private Endpoint.

For demo purpose we will expose a OIC REST endpoint to retrieve order details for a order which is been stored in Oracle ATP instance located in private subnet. Since, ATP is in private subnet it’s not accessible to outside world even app tier, and that’s where OIC Private Endpoint comes into picture to provide connectivity between OIC which is public internet and ATP which is in private subnet.

• Setup Virtual Cloud Network, Private and Public Subnet
• Provision ATP Database in Private Subnet
• Setup Private Endpoint for OIC
• Create ATP Connection in OIC
• Create Integration to fetch Order detail and test integration

Setup Virtual Cloud Network, Private and Public Subnet

Navigate to OCI home page > Networking > Virtual Cloud Network

Choose the right compartment where you want to spin-up the VCN and click on Create VCN

Enter the VCN name and click Next

Verify that VCN is successfully created with a Public and a Private Subnet

Provision ATP Database in Private Subnet

Navigate to OCI home page > Oracle Database > Autonomous Databases

Choose the right compartment where you want to spin-up the Autonomous Databases and click on Create Autonomous Database

Enter the Display name and Database name

Choose a workload type as "Transaction Processing"

Configure the database and Create administrator credentials

Choose network access as "Private endpoint access only" to Restrict access to a private endpoint within an OCI VCN. Choose the VCN and Private Subnet created in the above step then click Create Autonomous Database 

 

Verify that ATP is successfully created with a Private endpoint access

Setup Private Endpoint for OIC

Navigate to OCI home page > Developer Services > Integration 

Choose the right compartment where you have your OIC3 Instance, then click on the OIC3 Instance name and under Resources choose Private endpoints

Click on Create Private endpoint and choose the VCN and subnet that needs to be accessed privately

 

Verify that Private Endpoint is successfully created and you can see an entry now.

Currently there can be only one Private endpoint per integration Instance connecting to only one subnet. Also you cannot edit the Private endpoint and change VCN or subnet. You have delete and recreate the Private endpoint.

Now for OIC to access the Private Resources, we need to allow/add VCN CIDR for Ingress and Egress on ATP port in the private subnet security list.

    

Create ATP Connection in OIC

Login to OIC3 Console and navigate the Design > Connections and click on Create to create a new connection and choose Oracle ATP adapter.

Provide the Name and Identifier for your connection. Click on Create button.

In the next window, enter TNS Name in the Service Name field. Make sure to select the Security policy as “JDBC Over SSL”

You will see the option to upload the Wallet file from your system. Go ahead and upload the file and provide the following details:

• Wallet Password
• Database Service User Name
• Database Service Password

Choose the Access type as "Private endpoint" to connect to the database using the private network. 

Now go ahead and click the “Test” button. If all the details are correct you will see the Confirmation message as shown below. 

Make sure to click the Save button to save the connection. 

In my next blog I will show how to use this connection in an Integration. 

Integration with Private ATP using Private Endpoint in OIC3

This blog is in continuation to my previous blog where I have explained about the Private Endpoint and how we can create a connection to a ATP in Private Subnet. If you have not read that I would highly recommend to read that before we create integrations using the connection.

Connection to private ATP is created successfully and now ready to be used in a integration. But before we create Integration, remember to create a table in ATP Database. For this demo I have used the following script and created a Sales Order Table. 

CREATE TABLE SALES_ORDERS
(
        ORDER_ID NUMBER, 
REGION VARCHAR2(33 BYTE), 
COUNTRY VARCHAR2(21 BYTE), 
ITEM_TYPE VARCHAR2(15 BYTE), 
SALES_CHANNEL VARCHAR2(7 BYTE), 
ORDER_PRIORITY VARCHAR2(1 BYTE), 
ORDER_DATE DATE, 
SHIP_DATE DATE, 
UNITS_SOLD NUMBER, 
UNIT_PRICE NUMBER(6,2), 
UNIT_COST NUMBER(6,2), 
TOTAL_REVENUE NUMBER(10,2), 
TOTAL_COST NUMBER(10,2), 
TOTAL_PROFIT NUMBER(10,2)
   );
ALTER TABLE SALES_ORDERS MODIFY (ORDER_ID NOT NULL ENABLE);
ALTER TABLE SALES_ORDERS ADD PRIMARY KEY (ORDER_ID)
  USING INDEX  ENABLE;

And Insert few sample records in the table - 

Create Integration to fetch Order detail and test integration

Login to Oracle Integration Console then Home > Design > Integrations and Create an App Driven Orchestration integration

Click on + sign and choose the REST Trigger Connection 

Choose the Response json sample - 

Click on Done to complete the Rest Trigger.

Click on + sign after the Rest Trigger and choose the ATP Connection we created earlier using the private endpoint. 

 

Give a name and Choose operation to perform as "Run a SQL Statement"

Validate SQL Query and click Next and then Click on Done to complete the ATP Configuration.

Complete the Mapping 

Integration is now completed and you would need to complete the primary business identifier for the integration. 

 

Save and close. Now Activate the Integration 

Integration is now Active. Click on the Play Button to Run the Integration. Pass the order-id as Input and click on Run 

Verify the outbound 

This completes the series of blog on connecting private resources via Oracle Integration Cloud using Private endpoint