Manage Service Access and Security

Give Users Permissions to Manage Analytics Cloud Instances

About Permissions to Manage Oracle Analytics Cloud Instances

You use authorization policies to control access to resources in your tenancy. For example, you can create a policy that authorizes users to create and manage Oracle Analytics Cloud instances.

You create policies using the Oracle Cloud Infrastructure Console. For detailed information, see Managing Policies.

Resource Types for Oracle Analytics Cloud
Resource Types Description

analytics-instance

A single Oracle Analytics Cloud instance.

analytics-instances

One or more Oracle Analytics Cloud instances.

analytics-instance-work-request

A single work request for Oracle Analytics Cloud.

Each operation you perform on an Oracle Analytics Cloud instance, creates a work request. For example, operations such as create, start, stop, and so on.

analytics-instance-work-requests One or more work requests.

Supported Variables

The values of these variables are supplied by Oracle Analytics Cloud. In addition, other general variables are supported. See General Variables for All Requests.

Variable Type Description Sample Value
target.analytics-instance.id ocid OCID for the Analytics Cloud instance. target.analytics-instance.id = 'oci1.analyticsinstance.oc1..abc123'
target.analytics-instance.name string Name of the Analytics Cloud instance. target.analytics-instance.name = 'myanalytics_1'
target.analytics-instance.source-compartment.id ocid OCID of the source compartment, in a "move compartment" operation. target.analytics-instance.source-compartment.id = 'ocid1.compartment.oc1..aaa100'
target.analytics-instance.destination-compartment.id ocid OCID of the destination compartment in a "move compartment" operation. target.analytics-instance.destination-compartment.id = 'ocid1.compartment.oc1..aaa200'

Details for Verb and Resource-Type Combinations

Oracle Cloud Infrastructure offers a standard set of verbs to define permissions across Oracle Cloud Infrastructure resources (Inspect, Read, Use, Manage). These tables list the Oracle Analytics Cloud permissions associated with each verb. The level of access is cumulative as you go from Inspect to Read to Use to Manage.

INSPECT

Resource- Type INSPECT Permission
  • analytics-instance
  • analytics-instances
  • ANALYTICS_INSTANCE_INSPECT
  • analytics-instance-work-request
  • analytics-instance-work-requests
  • ANALYTICS_INSTANCE_WR_INSPECT

READ

Resource- Type READ Permission
  • analytics-instance
  • analytics-instances
  • ANALYTICS_INSTANCE_INSPECT
  • ANALYTICS_INSTANCE_READ
  • analytics-instance-work-request
  • analytics-instance-work-requests
  • ANALYTICS_INSTANCE_WR_INSPECT
  • ANALYTICS_INSTANCE_WR_READ

USE

Resource- Type USE Permission
  • analytics-instance
  • analytics-instances
  • ANALYTICS_INSTANCE_INSPECT
  • ANALYTICS_INSTANCE_READ
  • ANALYTICS_INSTANCE_USE
  • analytics-instance-work-request
  • analytics-instance-work-requests
  • N/A

MANAGE

Resource- Type MANAGE Permission
  • analytics-instance
  • analytics-instances
  • ANALYTICS_INSTANCE_INSPECT
  • ANALYTICS_INSTANCE_READ
  • ANALYTICS_INSTANCE_USE
  • ANALYTICS_INSTANCE_CREATE
  • ANALYTICS_INSTANCE_DELETE
  • ANALYTICS_INSTANCE_UPDATE
  • ANALYTICS_INSTANCE_MOVE
  • ANALYTICS_INSTANCE_MANAGE
  • analytics-instance-work-request
  • analytics-instance-work-requests
  • ANALYTICS_INSTANCE_WR_INSPECT
  • ANALYTICS_INSTANCE_WR_READ
  • ANALYTICS_INSTANCE_WR_DELETE

Permissions Required for Each API Operation

This table shows the API operations available for Oracle Analytics Cloud, grouped by resource type.

REST API Operation CLI Command Operation Permission Required to Use the Operation
ListAnalyticsInstances analytics-instance list ANALYTICS_INSTANCE_INSPECT
CreateAnalyticsInstance analytics-instance create ANALYTICS_INSTANCE_CREATE
GetAnalyticsInstance analytics-instance get ANALYTICS_INSTANCE_READ
UpdateAnalyticsInstance analytics-instance update ANALYTICS_INSTANCE_UPDATE
DeleteAnalyticsInstance analytics-instance delete ANALYTICS_INSTANCE_DELETE
StartAnalyticsInstance analytics-instance start ANALYTICS_INSTANCE_USE
StopAnalyticsInstance analytics-instance stop ANALYTICS_INSTANCE_USE
ScaleAnalyticsInstance analytics-instance scale ANALYTICS_INSTANCE_MANAGE
ChangeAnalyticsInstanceCompartment analytics-instance change-compartment ANALYTICS_INSTANCE_MOVE
ChangeAnalyticsInstanceNetworkEndpoint analytics-instance change-network-endpoint ANALYTICS_INSTANCE_MANAGE
ListWorkRequests work-request list ANALYTICS_INSTANCE_WR_INSPECT
GetWorkRequest work-request get ANALYTICS_INSTANCE_WR_READ
DeleteWorkRequest work-request delete ANALYTICS_INSTANCE_WR_DELETE
ListWorkRequestErrors work-request-error list ANALYTICS_INSTANCE_WR_INSPECT
ListWorkRequestLogs work-request-log list ANALYTICS_INSTANCE_WR_INSPECT

Example Policy Statements to Manage Analytics Cloud Instances

Here are typical policy statements that you might use to authorize access to Oracle Analytics Cloud instances.

When you create a policy for your tenancy, you grant users access to all compartments by way of policy inheritance. Alternatively, you can restrict access to individual Oracle Analytics Cloud instances or compartments.

Let users in the Administrators group fully manage any Analytics instance

# Full manage permissions (Create, View, Update, Delete, Scale, Start, Stop...)
allow group Administrators to manage analytics-instances in tenancy
allow group Administrators to manage analytics-instance-work-requests in tenancy

Let users in the analytics_power_users group read, start, and stop all Analytics instances in compartment MyOACProduction

# Use permissions (List, Get, Start, Stop)
allow group analytics_power_users to use analytics-instances in compartment MyOACProduction

Let users in the analytics_test_users group create and manage a single Analytics instance (myanalytics_1) in compartment MyOACTest

# Full manage permissions on a single instance
allow group analytics_test_users to manage analytics-instances in compartment MyOACTest where target.analytics-instances.name = 'myanalytics_1'

Let users in the analytics_power_users group move Analytics instances between two named compartments

# Custom permissions to move instances between two specific compartments.
allow group analytics_power_users to {ANALYTICS_INSTANCE_INSPECT, ANALYTICS_INSTANCE_READ, ANALYTICS_INSTANCE_MOVE} in tenancy
where all {
        target.analytics-instance.source-compartment.id =
        'ocid1.compartment.oc1..aaa100',
        target.analytics-instance.destination-compartment.id =
        'ocid1.compartment.oc1..aaa200'
  }

Let users in the analytics_users group inspect any Analytics instance and their associated work requests

# Inspect permissions (list analytics instances and work requests) using metaverbs.
allow group analytics_users to inspect analytics-instances in tenancy
allow group analytics_users to inspect analytics-instance-work-requests in tenancy
# Inspect permissions (list analytics instances and work requests) using permission names.
allow group analytics_users to {ANALYTICS_INSTANCE_INSPECT} in tenancy
allow group analytics_users to {ANALYTICS_INSTANCE_WR_INSPECT} in tenancy

Let users in the analytics_users2 group read details about any Analytics instance and their associated work requests

# Read permissions (read complete analytics instance and work request metadata) using metaverbs.
allow group analytics_users2 to read analytics-instances in tenancy
allow group analytics_users2 to read analytics-instance-work-requests in tenancy
# Read permissions (read complete analytics instance and work request metadata) using permission names.
allow group analytics_users2 to {ANALYTICS_INSTANCE_INSPECT, ANALYTICS_INSTANCE_READ} in tenancy
allow group analytics_users2 to {ANALYTICS_INSTANCE_WR_INSPECT, ANALYTICS_INSTANCE_WR_READ} in tenancy

Let users in the analytics_power_users2 group read, start, and stop all Analytics instances and read their associated work requests

# Use permissions (read, stop, start on analytics instance, read on work request) using metaverbs.
allow group analytics_power_users2 to use analytics-instances in tenancy
allow group analytics_power_users2 to read analytics-instance-work-requests in tenancy
# Use permissions (read, stop, start on analytics instance, read on work request) using permission names.
allow group
        analytics_power_users2 to {ANALYTICS_INSTANCE_INSPECT, ANALYTICS_INSTANCE_READ, ANALYTICS_INSTANCE_USE} in
        tenancy
allow group
        analytics_power_users2 to {ANALYTICS_INSTANCE_WR_INSPECT, ANALYTICS_INSTANCE_WR_READ} in
        tenancy

Let users in the Administrators2 group manage any Analytics instance and their associated work requests

# Full manage permissions (use, scale, delete on analytics instance, read and cancel on work request) using metaverbs.
allow group Administrators2 to manage analytics-instances in tenancy
allow group Administrators2 to manage analytics-instance-work-requests in tenancy
# Full manage permissions (use, create, scale, delete on analytics instance, read and cancel on work request) using permission names.
allow group 
        Administrators2 to
        {ANALYTICS_INSTANCE_INSPECT, ANALYTICS_INSTANCE_READ, ANALYTICS_INSTANCE_USE,
        ANALYTICS_INSTANCE_CREATE, ANALYTICS_INSTANCE_DELETE, ANALYTICS_INSTANCE_UPDATE,
        ANALYTICS_INSTANCE_MOVE, ANALYTICS_INSTANCE_MANAGE} in 
        tenancy
allow group
        Administrators2 to 
        {ANALYTICS_INSTANCE_WR_INSPECT, ANALYTICS_INSTANCE_WR_READ, ANALYTICS_INSTANCE_WR_DELETE} in
        tenancy

Typical Workflow for Setting Up Policies to Manage Analytics Cloud Instances

If you’re setting up policies for Oracle Analytics Cloud for the first time, take some time to understand what's required before you start.

Description of policy_flow.jpg follows

High-level steps:

  1. Create users in the federated Oracle Identity Cloud Service (IDCS).
  2. Create one or more groups and assign users to each group, as required.

    Give the groups suitable names and include only those users that you want to manage Oracle Analytics Cloud instances in Oracle Cloud Infrastructure (Gen 2). For example, prefix them with OCI and indicate the level of access for users in the group: OCI_Users, OCI_Power_Users, OCI_Analytics_Admins, and so on.

  3. Create groups in Oracle Cloud Infrastructure (OCI).

    Give the groups suitable names. For example, prefix them with analytics and mirror the naming convention that you used in Oracle Identity Cloud Service: analytics_users, analytics_power_users, analytics_service_admins, and so on.

  4. Map the groups you created in OCI to the groups in IDCS.
  5. Create one or more polices, as required.

    Give users in OCI groups suitable access permissions to compartments and Oracle Analytics Cloud instances.

For more detailed steps, see the next topic.

Give a User Permissions to Manage Analytics Cloud Instances

You can create security policies to give users suitable access to Oracle Analytics Cloud instances in Oracle Cloud Infrastructure Console.

  1. Sign-in to your Cloud Account as Cloud Account Administrator.
  2. Navigate to the federated Oracle Identity Cloud Service.
    1. Under Governance and Administration, click Identity, then Federation.
    2. Click the link to your Oracle Identity Cloud Service Console.
  3. In Oracle Identity Cloud Service, add one or more users.
    1. In the Users section, click Add a User.
    2. Enter details about the user, and click Finish.
  4. In Oracle Identity Cloud Service, create one or more groups and assign users to the appropriate group.
    1. Click Groups in the Navigator, and then click Add.
    2. Enter details about the group, and click Next.
      For example, if you're creating a policy that gives users permissions to fully manage Oracle Analytics Cloud instances you might name the group OCI_Analytics_Admins (or similar) and include a short description such as "Users with permissions to set up and manage Oracle Analytics Cloud instances on Oracle Cloud Infrastructure" (or similar).
    3. Add one or more users to the group.
  5. In Oracle Cloud Infrastructure Console, create an OCI group that corresponds to each of the groups you created in Oracle Identity Cloud Service.
    1. Under Governance and Administration, click Identity, then Groups.
    2. Click Create Group.
    3. Enter details about the group.
      For example, if you're creating a policy that gives users permissions to fully manage Oracle Analytics Cloud instances you might name the group analytics_service_admin (or similar) and include a short description such as "Users with permissions to set up and manage Oracle Analytics Cloud instances on Oracle Cloud Infrastructure" (or similar).
  6. Map OCI groups to the corresponding groups in Oracle Identity Cloud Service.
    1. Under Governance and Administration, click Identity, then Federation.
    2. Navigate to your Oracle Identity Cloud Service federation.
      For most tenancies, the federation is named OracleIdentityCloudService.
    3. Click Add Mapping and select the name of a group you created in Oracle Identity Cloud Service. For example, OCI_Analytics_Admins.
    4. Select the OCI group you want to map to. For example, analytics_service_admin.
  7. Create a policy that gives users belonging to an OCI group, specific access permissions to Oracle Analytics Cloud instances or compartments.
    1. Under Governance and Administration, click Identity, then Policies.
    2. Select a compartment, and click Create Policy.

Users belonging to any groups mentioned in the policy statement get their new permission when they next sign in to the Console.

Give Data Sources Access to Analytics Cloud Instances

You can connect Oracle Analytics Cloud to a wide range of data sources. Some data sources, such as Oracle Autonomous Data Warehouse, require you to include the IP address of your Oracle Analytics Cloud instance in their allowlist.

Topics:

Find the IP Address or Host Name of Your Oracle Analytics Cloud Instance

You can find the host name and IP address information for your Oracle Analytics Cloud deployment on the Additional Details tab in Oracle Cloud Infrastructure Console.

  1. In Oracle Cloud Infrastructure Console, click Navigation menuin the top left corner.
  2. Under Solutions and Platform, select Analytics, then Analytics Cloud.
  3. Select the compartment that contains the Oracle Analytics Cloud instance you're looking for.
  4. Click the name of the instance.
  5. Click Additional Details.

    The Hostname, IP Address and Gateway IP Address of your instance is displayed in the Network section.

    Host name and IP Address information

Add the IP Address of Your Oracle Analytics Cloud Instance to Allowlists

Before you try to connect Oracle Analytics Cloud to an Oracle Cloud database, ask the database administrator to add the IP address (or address range) for your Oracle Analytics Cloud instance to the target database's allowlist. The database administrator must add a security rule on the target Oracle Cloud database that allows TCP/IP traffic from Oracle Analytics Cloud on a specific database port.

This topic describes how to add Oracle Analytics Cloud to the allow list for an Oracle Cloud database. If you want to connect to other data sources, follow similar steps, as required.

  1. Make a note of the IP Address or Gateway IP Address of your Oracle Analytics Cloud instance that you or your database administrator must allow access to.
  2. Include the IP address information that you made a note of in Step 1 in the security list for your Oracle Cloud database.

    The way you register the IP address or CIDR address of your Oracle Analytics Cloud instance depends on whether the database you're trying to connect to is deployed on Oracle Cloud Infrastructure or Oracle Cloud Infrastructure Classic:

    • Database on Oracle Cloud Infrastructure
      1. Add an ingress rule.
        Description of uc1_securitylist.jpg follows

      2. Specify the IP address in the SOURCE CIDR field.
        Description of uc1_ingressrules.jpg follows

    • Database on Oracle Cloud Infrastructure Classic
      1. Add an access rule.Description of access_rules_ocic1-png.png follows
      2. Specify the IP address in the field below the Source fieldDescription of access_rules_ocic2-png.png follows

Public IP Ranges and Gateway IPs for Oracle Analytics Cloud Instances

If you want to connect Oracle Analytics Cloud with a public endpoint to a database in Oracle Cloud, you must add the IP address, IP address range, or gateway IP where your Oracle Analytics Cloud instance is located on Oracle Cloud Infrastructure to the database's allowlist.

The public IP address information that you provide depends on the type of database you want to connect to and whether or not your Oracle Analytics Cloud instance is deployed in the same region as the database.

Database Oracle Autonomous Data Warehouse Oracle Autonomous Transaction Processing Any Other Oracle Cloud Database
Same region as Oracle Analytics Cloud Allow 240.0.0.0/4 Allow 240.0.0.0/4 Allow the region-specific IP address.
Different region to Oracle Analytics Cloud Allow the region-specific IP address. Allow the region-specific IP address. Allow the region-specific IP address.

Region-Specific IP Address Information for Oracle Analytics Cloud (

Use Oracle Cloud Infrastructure Console to find the public IP address or gateway IP address of your Oracle Analytics Cloud instance that you or your database administrator must add to the database's allowlist. See Find the IP Address or Host Name of Your Oracle Analytics Cloud Instance.

Alternatively, if you know the region where you deployed your Oracle Analytics Cloud instance, find that region in the table below and make a note of the IP address listed in the IP Address Range column or the Gateway IP Address column.

The security policy enforced by your company or organization determines whether you must provide the IP address ranges or Gateway IP address. If you're not sure, check with your network administrator.

For example, if you deployed your Oracle Analytics Cloud instance in Tokyo, Japan East (ap-tokyo-1) and your company's security policy requires you to provide an IP address range, you add 192.29.39.56/29. Alternatively, if you're required to provide a Gateway IP address, you add 192.29.39.59.

Region Where Oracle Analytics Cloud Deployed Region Identifier IP Address Range Gateway IP Address
Asia Pacific (APAC)
Australia Southeast (Melbourne) ap-melbourne-1 192.29.211.152/29 192.29.211.154
Australia East (Sydney) ap-sydney-1 192.29.144.152/29 192.29.144.154
India South (Hyderabad) ap-hyderabad-1 129.148.128.56/29 129.148.128.61
India West (Mumbai) ap-mumbai-1 192.29.48.240/29 192.29.48.246
Japan Central (Osaka) ap-osaka-1 192.29.242.208/29 192.29.242.211
Japan East (Tokyo) ap-tokyo-1 192.29.39.56/29 192.29.39.59
South Korea Central (Seoul) ap-seoul-1 192.29.20.96/29 192.29.20.98
South Korea North (Chuncheon) ap-chuncheon-1 129.148.144.24/29 129.148.144.31
Europe, the Middle East and Africa (EMEA)
Germany Central (Frankfurt) eu-frankfurt-1

147.154.148.0/29

147.154.148.171

138.1.64.33

Netherlands Northwest (Amsterdam) eu-amsterdam-1

192.29.193.72/29

192.29.193.76

Switzerland North (Zurich) eu-zurich-1 192.29.60.112/29 192.29.60.112
Saudi Arabia West (Jeddah) me-jeddah-1 192.29.225.72/29 192.29.225.78
UK South (London) uk-london-1

147.154.229.168/29

147.154.229.170

Latin America
Brazil East (Sao Paulo) sa-saopaulo-1 192.29.128.232/29 192.29.128.238
North America
Canada Southeast (Montreal) ca-montreal-1 192.29.82.176/29 192.29.82.176
Canada Southeast (Toronto) ca-toronto-1 192.29.13.0/29

192.29.13.6

US East (Ashburn) us-ashburn-1

147.154.20.0/29

147.154.20.1

147.154.3.185

147.154.0.3

US West (Phoenix) us-phoenix-1

147.154.104.160/29

147.154.104.165

US West (San Jose) us-sanjose-1

129.148.161.112/29

129.148.161.117

Restrict Access to Oracle Analytics Cloud Deployed with a Public Endpoint

About Public Endpoints and Access Control Rules

When you set up an Oracle Analytics Cloud instance you have the option to deploy Oracle Analytics Cloud with a public internet accessible endpoint. For security reasons, you might want to restrict access through one or more access control rules.

You can add and edit access control rules whenever you want and manage access in several ways. You can manage access with:
  • A specific set of IP addresses
  • A CIDR block range (Classless Inter-Domain Routing)
  • An Oracle Cloud Infrastructure VCN (Virtual Cloud Network)
  • Any combination of the above, that is, IP addresses, CIDR ranges, VCNs

For example:

  • Scenario 1 - Allow access to Oracle Analytics Cloud over the public internet. Restrict access to a fixed set of IP addresses.
  • Scenario 2 - Allow access to Oracle Analytics Cloud over the public internet. Restrict access to hosts within a fixed CIDR block range.

  • Scenario 3 - Allow access to Oracle Analytics Cloud from an Oracle Cloud Infrastructure VCN that's deployed in the same region as Oracle Analytics Cloud, without going over the public internet. At the same time, allow other third-party cloud services or users to access Oracle Analytics Cloud over the public internet.

  • Scenario 4 - Allow access to Oracle Analytics Cloud from your on-premise network without going through the public internet. At the same time, allow other third-party cloud services or users to access Oracle Analytics Cloud over the public internet.
Public endpoint scenarios

The sample diagram shows Oracle Analytics Cloud deployed with a public endpoint and two access control rules. The first rule allows access from the IP address 204.204.100.100 and the second rule allows access from the Oracle Cloud Infrastructure VCN customer-oci-vcn. The VCN is peered to an on-premise network, and access to Oracle Analytics Cloud is routed through the VCN's service gateway.

While Oracle Analytics Cloud is accessible from the public internet, you can implement your own access control rules to provide any additional security that you need. In this example, only the third-party service with the egress gateway IP address 204.204.100.100 accessed Oracle Analytics Cloud over the public internet. Traffic from the on-premise network never uses the public internet, instead it uses the service gateway configured inside the VCN.

Prerequisites for a Public Endpoint

Before you create an Oracle Analytics Cloud instance that's accessible from the public internet, consider whether or not your organization wants to restrict access.

No Restrictions

No prerequisites. If you want Oracle Analytics Cloud to be accessible from anywhere, you can create the Oracle Analytics Cloud instance with no access control.

Restrict Access to a Specific IP Address or CIDR Block Range

If you plan to limit access to traffic from a specific IP address or CIDR block range, record all the IP addresses or CIDR ranges that you want to allow. When you create your Oracle Analytics Cloud instance, you use this information to define one or more access control rules for Oracle Analytics Cloud.

Restrict Access to a Specific VCN

If you plan to limit access to traffic from a specific Oracle Cloud Infrastructure VCN, ensure that the VCN exists and you have the required policies to access the VCN.

  1. Set up an Oracle Cloud Infrastructure VCN in the same region as the Oracle Analytics Cloud instance you plan to create.
  2. Set up a service gateway in your VCN, and a route table to send traffic to Oracle Analytics Cloud through the service gateway.
  3. Ensure that you (or whoever plans to create the Oracle Analytics Cloud instance) have the required policies to access the VCN.
    • READ policy for the compartment:
      ALLOW GROUP <ANALYTICS ADMIN GROUP> TO READ compartments IN TENANCY
    • READ policy for the VCN:
      ALLOW GROUP <ANALYTICS ADMIN GROUP> TO READ virtual-network-family IN TENANCY

Typical Workflow to Restrict Public Access using Rules

If you want to deploy an Oracle Analytics Cloud instance with a public endpoint for the first time with one or more access control rules, follow these tasks as a guide.

Task Description More Information
Understand prerequisites for a public endpoint Consider whether or not your organization plans to restrict access. If required, record the IP addresses, CIDR ranges, and VCNs that you plan to allow access to. Prerequisites for a Public Endpoint

Create Oracle Analytics Cloud with a public endpoint

Use Oracle Cloud Infrastructure Console to deploy a new service.

Create Oracle Analytics Cloud with a Public Endpoint

Allow access by IP address, CIDR range, or VCN

Add one or more access control rules. You can allow access to Oracle Analytics Cloud by public IP address, public CIDR block range, or VCN.

Manage Access Control Rules

(Optional) Set up private access from your on-premise network

Set up an Oracle Cloud Infrastructure VCN that connects to your on-premise network using FastConnect private peering or VPN Connect. The VCN must be deployed in the same region as Oracle Analytics Cloud.

Set up a service gateway in your VCN, and a route table to send traffic to Oracle Analytics Cloud through the service gateway.

Add an access control rule in your Oracle Analytics Cloud instance that allows access from your VCN.

Configure VCN peering to your on-premise network through FastConnect or VPN Connect to enable access from your on-premise network.

Configure transit routing with the VCN to give your on-premise network private access to Oracle Analytics Cloud.

Working with VCNs and Subnets

Setting Up a Service Gateway in the Console

Manage Access Control Rules

Access to Your On-Premises Network

Setting Up Private Access to Oracle Services

(Optional) Set up private access from hosts on your VCN

Set up an Oracle Cloud Infrastructure VCN in the same region as Oracle Analytics Cloud.

Set up a service gateway in your VCN, and a route table to send traffic to Oracle Analytics Cloud through the service gateway.

Add an access control rule in your Oracle Analytics Cloud instance that allows access from your VCN.

Working with VCNs and Subnets

Setting Up a Service Gateway in the Console

Manage Access Control Rules

Create Oracle Analytics Cloud with a Public Endpoint

You can use Oracle Cloud Infrastructure Console, API, or command line to deploy Oracle Analytics Cloud with a public endpoint.

If you're new to Oracle Analytics Cloud, see Create a Service for all the steps.

This topic highlights only the information you must configure to enable access over the public internet and define any access control rules that you require.

Options to create public endpoint
  1. For Network Access, select Public.
  2. To configure access control rules, select Configure Access Control Rules, and then add one or more rules using the specific public IP addresses, public CIDR block ranges, and VCNs that you want to allow access to.

    You can add, edit, and delete access control rules at any time. So if you prefer, you can add your rules later on.

Manage Access Control Rules

If you deployed Oracle Analytics Cloud with a public internet accessible endpoint, you can restrict access to your service through an access control list (ACL) that contains one or more rules. You can add and edit access control rules whenever you want and allow access by public IP address, public CIDR block range, or VCN using the Console, API, or command line.

Note

Required IAM Policy to Edit Analytics Instance

Verb: manage

Resource Types: analytics-instance, analytics-instances

Permission: ANALYTICS_INSTANCE_MANAGE

See About Permissions to Manage Oracle Analytics Cloud Instances.

Additional IAM Policy Required to Edit a Public Endpoint

Verb: read

Resource Type: virtual-network-family, compartment, compartments

See Prerequisites for a Public Endpoint.

Manage Access Rules for a Public Endpoint using the Console

If you deployed Oracle Analytics Cloud with a public internet accessible endpoint, you can restrict access to your service through an access control list (ACL) that contains one or more rules. You can add and edit access control rules whenever you want and allow access by public IP address, public CIDR block range, or VCN.

  1. In Console, click Navigation menuin the top left corner.
  2. Under Solutions and Platform, select Analytics, then Analytics Cloud.
  3. Select the compartment that contains the Oracle Analytics Cloud instance you're looking for.
  4. Click the name of the instance you want to control access to.
  5. On the Instance Information page, click the Edit icon next to the Access Control Rules option.
    Edit Access Control Rules
  6. Add or edit access control rules as required.

    You can specify the following types of rule:

    • IP Address: Select IP Address to a specific public IP address.
    • CIDR Block: Select CIDR Block to specify a range of public IP addresses using CIDR notation.
    • Virtual Cloud Network: Select Virtual Cloud Network to specify an existing Oracle Cloud Infrastructure VCN. The drop-down list shows all the VCNs in the current compartment that you have access to. If you can't see the VCN or subnet you want, check you have the required permissions. See About Public Endpoints and Access Control Rules.

      Click Change Compartment to select a VCN from a different compartment.

Manage Access Rules for a Public Endpoint using the REST API

You can use the ChangeAnalyticsInstanceNetworkEndpoint operation to change access control rules for an Oracle Analytics Cloud instance with a public endpoint.

Refer to the Oracle Cloud Infrastructure REST API Reference for information about how to use this operation:

Manage Access Rules for a Public Endpoint using the Command Line

You can use the change-network-endpoint command to change access control rules for an Oracle Analytics Cloud instance with a public endpoint.

For example:
oci
  analytics analytics-instance change-network-endpoint \
  --analytics-instance-id ocid1.analyticsinstance.oc1.us-ashburn-1.aaaaaaaa5pynfxr2e6wpshkhkoajoiqizwmhc6x7ogp4aw66whyq76fdk32q \
  --network-endpoint-details '{
"networkEndpointType": "PUBLIC", 
"whitelistedIps": ["168.122.67.231", "168.122.59.5", "10.20.30.35/26", "240.0.0.0/4"], 
"whitelistedVcns": [{"id": "ocid1.vcn.oc1.us-ashburn-1.amaaaaaarfop2rqahtll2uacphjioux3v346fgp6rscmgcekdg6uni3axzna"}]
}'

Refer to the Oracle Cloud Infrastructure CLI Command Reference for information about how to use this command:

Deploy Oracle Analytics Cloud with a Private Endpoint

If you want only hosts within your virtual cloud network (VCN) or your on-premise network to have access to Oracle Analytics Cloud, you can deploy your Oracle Analytics Cloud instance with a private endpoint.

Topics:

About Private Endpoints

When you set up an Oracle Analytics Cloud instance you have the option to restrict access through a private endpoint. Private access means that traffic doesn't go over the internet. Private access can be from hosts within your virtual cloud network (VCN) or your on-premise network.

For example:

  • Scenario 1 - Allow access to Oracle Analytics Cloud from an on-premise (corporate) network. Don't allow access to anyone outside the corporate network.

  • Scenario 2 - Allow access to Oracle Analytics Cloud from an Oracle Cloud Infrastructure VCN that's deployed in the same region as Oracle Analytics Cloud. Don't allow access to anyone outside the virtual cloud network.

When you deploy an Oracle Analytics Cloud instance with a private endpoint, the Oracle Analytics Cloud URL is only accessible from a browser if the client machine supports host name resolution. This means you must configure Domain Name Server (DNS) resolution on your private network to access the private endpoint. For example, you might use a DNS resolution strategy similar to that described in the article Hybrid DNS Configuration using DNS VM in VCN.

Private endpoint scenarios

The diagram shows Oracle Analytics Cloud deployed with a private endpoint. The private Oracle Analytics Cloud is only accessible through an Oracle Cloud Infrastructure VCN in your tenancy; you can't access Oracle Analytics Cloud from the public internet.

You must peer the VCN to your on-premise network. To enable access to Oracle Analytics Cloud, the on-premise network DNS must provide host name resolution for Oracle Analytics Cloud.

Prerequisites for a Private Endpoint

Before you create an Oracle Analytics Cloud instance with a private endpoint, complete the required prerequisites.

The prerequisites are the same for both scenarios:

  • Private access from an on-premise network through an Oracle Cloud Infrastructure VCN
  • Private access from hosts in an Oracle Cloud Infrastructure VCN
  1. Set up the Oracle Cloud Infrastructure VCN with a subnet for Oracle Analytics Cloud.

    The VCN must be in the region where you plan to deploy Oracle Analytics Cloud. See Working with VCNs and Subnets.

    Note

    If you plan to access Oracle Analytics Cloud from an on-premise network, keep some address space available in the VCN for additional subnets in case you need them for host name resolution.
  2. Ensure that you (or whoever plans to create the Oracle Analytics Cloud instance) have the required policies to access the VCN.

    Several options are available. Choose the most appropriate level for you:

    Broad Resource Access Policy

    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO READ compartments IN TENANCY
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO MANAGE virtual-network-family IN TENANCY

    Limited Resource Access Policy

    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO READ compartments IN TENANCY
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO READ virtual-network-family IN compartment <compartment name of VCN>
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO USE subnets IN compartment <compartment name of subnet>
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO MANAGE vnics IN compartment <compartment name of AnalyticsInstance>

    Moderate Resource Access Policy - Option 1

    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO READ compartments IN TENANCY
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO READ virtual-network-family IN TENANCY
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO USE subnets IN TENANCY
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO MANAGE vnics IN TENANCY

    Moderate Resource Access Policy - Option 2

    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO READ compartments IN TENANCY
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO USE virtual-network-family IN compartment <compartment name of VCN>
    • ALLOW GROUP <ANALYTICS ADMIN GROUP> TO MANAGE virtual-network-family IN compartment <compartment name of AnalyticsInstance>

Typical Workflow to Deploy Oracle Analytics Cloud with a Private Endpoint

If you want to deploy an Oracle Analytics Cloud instance with a private endpoint for the first time, follow these tasks as a guide.

Task Description More Information
Understand prerequisites for a private endpoint

Set up an Oracle Cloud Infrastructure virtual cloud network (VCN) with a subnet for Oracle Analytics Cloud.

The VCN must be in the region where you plan to deploy Oracle Analytics Cloud.

Prerequisites for a Private Endpoint

Create Oracle Analytics Cloud with a private endpoint

Use Oracle Cloud Infrastructure Console to deploy a new service.

Create Oracle Analytics Cloud with a Private Endpoint

Configure the connection to your on-premise network using FastConnect or VPN Connect.

(Only required if you want to access Oracle Analytics Cloud from an on-premise network)

Use FastConnect or VPN to peer your on-premise network with the Oracle Cloud Infrastructure VCN through which you plan to access Oracle Analytics Cloud.

Connect to Your On-premise Network using FastConnect or VPN Connect

Change the VCN or subnet used to access Oracle Analytics Cloud

If you want to access Oracle Analytics Cloud through a different VCN or subnet, you can edit the configuration at any time.

Change a Private Endpoint using the Console

Create Oracle Analytics Cloud with a Private Endpoint

You can use Oracle Cloud Infrastructure Console, API, or command line to deploy Oracle Analytics Cloud with a private endpoint.

If you're new to Oracle Analytics Cloud, see Create a Service for all the steps.

This topic highlights only the information you must configure to enable private access through a private endpoint.

Options to create a private endpoint
  1. For Network Access, select Private.
  2. Select the Virtual Cloud Network and the Subnet that you want to use to access Oracle Analytics Cloud.

Connect to Your On-premise Network using FastConnect or VPN Connect

If you want to access an Oracle Analytics Cloud instance that is deployed with a private endpoint in an Oracle Cloud Infrastructure VCN from your on-premise network, you must peer your on-premise network with the Oracle Cloud Infrastructure VCN. You can use FastConnect or VPN to peer your on-premise network with a VCN on Oracle Cloud Infrastructure.

Typically, these tasks are performed by the network administrator responsible for the on-premise network and the Oracle Cloud Infrastructure network. You can complete these steps before or after you create your Oracle Analytics Cloud instance.

  1. In Oracle Cloud Infrastructure Console, navigate to the Additional Details tab to determine the Hostname of your Oracle Analytics Cloud instance.
  2. Peer your on-premise network with the Oracle Cloud Infrastructure VCN through FastConnect or VPN Connect.
  3. In your on-premise network, configure a suitable host name resolution solution for Oracle Analytics Cloud.

    Several options are available to you:

    • (Testing purposes only) From a client machine in your on-premise network, add a host name entry in the /etc/hosts file for Oracle Analytics Cloud.

      Use the hostname that you copied in Step 1. For example:
      <myinstanceid>.analytics.ocp.oraclecloud.com
    • Add a DNS record in your on-premise intranet DNS server (Domain Name System) for Oracle Analytics Cloud, that is, specify the host name for Oracle Analytics Cloud and its private IP address.
    • Set up a hybrid DNS solution. For example, see Hybrid DNS configuration using DNS VM in OCI VCN.
      1. Configure your on-premise intranet DNS server with conditional DNS forwarding to the DNS server configured in the VCN, and specify the host name for Oracle Analytics Cloud.
      2. Configure your on-premise intranet DNS server with DNS forwarding to the DNS server configured in the VCN, and specify the entire Oracle Analytics Cloud domain, that is, analytics.ocp.oraclecloud.com.
  4. Test that you can access Oracle Analytics Cloud from your on-premise network.

Change the VCN or Subnet Used to Access a Private Endpoint

If you want to access Oracle Analytics Cloud through a different VCN or subnet, you can edit the configuration using the Console, API, or command line.

Note

Required IAM Policy to Edit Analytics Instance

Verb: manage

Resource Types: analytics-instance, analytics-instances

Permission: ANALYTICS_INSTANCE_MANAGE

See About Permissions to Manage Oracle Analytics Cloud Instances.

IAM Policy Required to Change a Private Endpoint

Verb: manage

Resource Type: virtual-network-family

Verb: read

Resource Type: compartment, compartments

To learn about other, more detailed access policy options, see Prerequisites for a Private Endpoint.

Change a Private Endpoint using the Console

If you want to access Oracle Analytics Cloud through a different VCN or subnet, you can edit the configuration.

  1. In Console, click Navigation menuin the top left corner.
  2. Under Solutions and Platform, select Analytics, then Analytics Cloud.
  3. Select the compartment that contains the Oracle Analytics Cloud instance you're looking for.
  4. Click the name of the instance you want to change access to.
  5. On the Instance Information page, click the Edit icon next to Subnet.
  6. Select a different Virtual Cloud Network, Subnet, or both.

    Click Change Compartment to select resources from a different compartment. If you can't see the VCN or subnet you want, check you have the required permissions. See Prerequisites for a Private Endpoint.

    Options to edit the VCN or subnet
Change a Private Endpoint using the REST API

You can use the ChangeAnalyticsInstanceNetworkEndpoint operation to command to change the VCN or subnet used to access an Oracle Analytics Cloud instance with a private endpoint.

Refer to the Oracle Cloud Infrastructure REST API Reference for information about how to use this operation:

Change a Private Endpoint using the Command Line

You can use the change-network-endpoint command to change the VCN or subnet used to access an Oracle Analytics Cloud instance with a private endpoint.

For example:
oci \
  analytics analytics-instance change-network-endpoint \
  --analytics-instance-id ocid1.analyticsinstance.oc1.us-ashburn-1.aaaaaaaa5pynfxr2e6wpshkhkoajoiqizwmhc6x7ogp4aw66whyq76fdk32q \
  --network-endpoint-details '{
"networkEndpointType": "PRIVATE", "vcnId" : 
"ocid1.vcn.oc1.us-ashburn-1.amaaaaaarfop2rqav4x2wox6dt72o57jmnevpguq63gcsdtrbk42bvz446sa", 
"subnetId": "ocid1.subnet.oc1.us-ashburn-1.aaaaaaaal5xb6vodov35nbcqhsnwoypeieowgy44vambmnokzpwv22pvjxoq"
}'

Refer to the Oracle Cloud Infrastructure CLI Command Reference for information about how to use this command:

Connect to a Database Deployed on Oracle Cloud Infrastructure with a Public IP Address

Configure Oracle Analytics Cloud to connect to a database deployed on Oracle Cloud Infrastructure with a public IP address, so that end users can analyze that data in visualizations, analyses, and pixel-perfect reports.

Typical Workflow to Connect to a Database Deployed on Oracle Cloud Infrastructure

If you’re connecting to an database deployment on Oracle Cloud Infrastructure for the first time, follow these tasks as a guide.

Task Description More Information

Verify the prerequisites

Verify that your environment satisfies the prerequisites required for this configuration.

Prerequisites

Record database information

Record connection information for database.

Record Database Information

Enable database access

Add an ingress rule to give Oracle Analytics Cloud access to the database.

Enable Database Access Through Port 1521

Connect to the database

Create and test your connections.

Connect to Your Database from Oracle Analytics Cloud

Prerequisites

Before you start, make sure you have the required environment.

Step Description Important Information to Note

Set up Oracle Analytics Cloud

Deploy Oracle Analytics Cloud.

Region

Availability Domain

Set up a Virtual Cloud Network (VCN) on Oracle Cloud Infrastructure

Set up a VCN for the database deployment on Oracle Cloud Infrastructure.

Note: The VCN must be in the same Region and Availability Domain as Oracle Analytics Cloud.

Virtual Cloud Network

Subnet

Same:

  • Region

  • Availability Domain

Deploy a database:

  • Deploy the database on the VCN in Oracle Cloud Infrastructure

  • Populate the database with data

  • Set up a database user with permissions to read database tables

Deploy a database on the VCN in Oracle Cloud Infrastructure.

Note: The database must be in the same Region and Availability Domain as the VCN.

Public IP

Database Unique Name

Host Domain Name

Database User/Password

Same:

  • Region

  • Availability Domain

  • Virtual Cloud Network

  • Client Subnet

Record Database Information

All the information you need to connect to a database is available in the Oracle Cloud Infrastructure Console. Record the information now, so you have the required details when you set up the connection in Oracle Analytics Cloud.

  1. In Oracle Cloud Infrastructure Console, click the navigation icon Hamburger icon for toggling navigation options.
  2. Under Database, click Bare Metal, VM, and Exadata, and then click DB Systems.
  3. Locate the database you want to connect to and record the Public IP address.
    Description of uc1_databases.jpg follows

  4. Click the name of the database you want to connect to and write down the values in these fields: Database Unique Name, Host Domain Name, Virtual Cloud Network, Client Subnet, and Port.
    Description of uc1_database.jpg follows

  5. Find out the user name and password of a database user with permissions to read from this database, and write them down as you need these later. For example, the user SYSTEM.

Enable Database Access Through Port 1521

Add an ingress rule that enables Oracle Analytics Cloud to access the database through port 1521.

  1. Make a note of the Oracle Analytics Cloud IP addresses that you want to allow access to.
  2. In the Oracle Cloud Infrastructure home page, click the navigation icon Hamburger icon for toggling navigation options, then under Databases, click Bare Metal, VM, and Exadata, and then DB Systems.
  3. Click the database that you want to connect to.
  4. Click the Virtual Cloud Network link.
    Description of uc1_database_vcn.jpg follows

  5. Navigate to the appropriate subnet, and under Security Lists, click Default Security List For <VCN>.
    Description of uc1_vnc.jpg follows

  6. Click Add Ingress Rules.
    Description of uc1_securitylist.jpg follows

  7. For each IP address that you want to give access to, add an ingress rule to allow any incoming traffic from the public internet to reach port 1521 on this database node, with the following settings:
    • SOURCE CIDR: Enter the IP address that you wrote down in Step 1.

    • IP PROTOCOL: TCP

    • SOURCE PORT RANGE: All

    • DESTINATION PORT RANGE: 1521

    • Allows: TCP traffic for ports: 1521


    Description of uc1_ingressrules.jpg follows

Connect to Your Database from Oracle Analytics Cloud

After enabling access to the database, use the database connection information you wrote down earlier to connect Oracle Analytics Cloud to the database. The way you connect to the database depends on what you want to do with the data.

  • Visualize the data.

  • Model the data using Data Modeler, then generate analyses and dashboards.

  • Model the data with Oracle Analytics Cloud Developer Client Tool, then generate analyses and dashboards.

  • Publish the data in pixel-perfect reports.

Connect to Your Database for Data Visualization
In Oracle Analytics Cloud, create an Oracle Database connection for data visualizations in the usual way. See Create Database Connections.

Description of uc1_conns.png follows

Use the database details you recorded earlier to fill in the Create Connection dialog.

Description of uc1_cconnection.png follows

Specify these values:
  • New Connection Name: A name for the database you want to connect to.

  • Host: The Public IP address for the database instance. For example, 123.213.85.123.

  • Port: The port number that enables access to the database. For example, 1521.

  • Username: The name of a user with read access to the database.

  • Password: The password for the specified database user.

  • Service Name: A concatenated name comprising Database Unique Name and Host Domain Name, separated with a period. For example, CustDB_iad1vm.sub05031027070.customervcnwith.oraclevcn.com.

Connect to Your Database for Data Modeler
In Oracle Analytics Cloud Console, create a connection in the usual way. See Connect to Data in an Oracle Cloud Database.
Use the database details you recorded earlier to fill in the Create Connection dialog.

Description of uc1_console1.jpg follows

Specify these values:
  • Name and Description: A name for the database you want to connect to.

  • Connect using: Select Host, Port, and Service Name.

  • Host: The Public IP address for the database. For example, 123.213.85.123.

  • Port: The port number that enables access to the database. For example, 1521.

  • Service Name: A concatenated name comprising Database Unique Name and Host Domain Name, separated with a period. For example, CustDB_iad1vm.sub05031027070.customervcnwith.oraclevcn.com.

  • Connect as: The name of a user with read access to the database.

  • Password: The password for the specified database user.

Connect to Your Database in Oracle Analytics Cloud Developer Client Tool
In Oracle Analytics Cloud Developer Client tool, click File, then Open, then In the Cloud to open your data model. See Edit a Data Model in the Cloud.
When you sign in, use connection information for your Oracle Analytics Cloud to fill in the Open in the Cloud dialog.
Create a connection pool for your database. In the Physical pane, expand the DBaaS node, right-click the database icon, and click Properties to display the Connection Pool dialog. Use the database details you recorded earlier to specify Call Interface, Data Source Name, User Name, and Password.


Description of connpool-gif.bmp follows

Specify these values:
  • Call interface: Select Default (Oracle Call Interface (OCI)).

  • Data Source Name: Specify the connection details. For example:

    (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=129.213.85.177)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=CustDB_iad1vm.sub05031027070.customervcnwith.oraclevcn.com))

    For SERVICE_NAME, specify the concatenated Database Unique Name and Host Domain Name separated by a period, for example, db1_phx1tv.mycompany.com. To find both these names in Oracle Cloud Infrastructure Console, click Databases, Bare Metal, VM, and Exadata, DB Systems, and then click the name of your database.

Connect to Oracle Autonomous Data Warehouse with a Public IP Address

Configure Oracle Analytics Cloud to connect to Autonomous Data Warehouse over a public IP address so that end users can analyze that data in visualizations, analyses, dashboards, and pixel-perfect reports.

Typical Workflow to Connect to Oracle Autonomous Data Warehouse with a Public IP Address

If you’re connecting Oracle Analytics Cloud to Autonomous Data Warehouse over a public IP address for the first time, follow these tasks as a guide.

Task Description More Information

Verify the prerequisites

Verify that your environment satisfies the prerequisites required for this configuration.

Prerequisites

Enable access to Autonomous Data Warehouse

Upload your Autonomous Data Warehouse Client Credentials file (wallet file) to Oracle Analytics Cloud.

Enable Access to Oracle Autonomous Data Warehouse

Connect to Autonomous Data Warehouse

Create and test your connections.

Connect to Oracle Autonomous Data Warehouse

Prerequisites

Before you start, make sure you have the required environment.

Step Description Important Information to Note

Set up Oracle Analytics Cloud

Deploy Oracle Analytics Cloud.

Region

Availability Domain

Set up Oracle Autonomous Data Warehouse

Deploy Autonomous Data Warehouse.

  • Deploy Autonomous Data Warehouse on Oracle Cloud Infrastructure.

  • Populate Autonomous Data Warehouse with data.

  • Set up a database user with permissions to read database tables on Autonomous Data Warehouse

Host Name

Port Number

Service Name

(Obtain these details from tnsnames.ora in the Autonomous Data Warehouse Client Credentials file.)

Enable Access to Oracle Autonomous Data Warehouse

To enable secure communication between Oracle Analytics Cloud and Autonomous Data Warehouse, you upload trusted SSL certificates to Oracle Analytics Cloud.

  1. In Autonomous Data Warehouse Console, obtain the Client Credentials file.
    The Client Credentials file is a ZIP file containing the files cwallet.sso and tnsnames.ora. See Download Client Credentials (Wallets) in Using Oracle Autonomous Data Warehouse.
  2. Extract the cwallet.sso file from the Client Credentials file.
  3. Upload the cwallet.sso file to Oracle Analytics Cloud.
    1. Sign in to Oracle Analytics Cloud, open the Console and click Connections.
    2. Click Upload Wallet to upload a wallet for the first time or Replace Wallet to update an existing wallet.
    3. Click Browse and locate the wallet file (cwallet.sso) you downloaded from Autonomous Data Warehouse.
    4. Select the file and click Open.
    5. Click Update and OK to update the existing wallet file.

Connect to Oracle Autonomous Data Warehouse

After enabling access to Oracle Autonomous Data Warehouse, use the connection details you recorded earlier to connect Oracle Analytics Cloud to Autonomous Data Warehouse. The way you connect depends on what you want to do with the data.

  • Visualize the data

  • Model the data using Data Modeler, then generate analyses and dashboards.

  • Model the data with Oracle Analytics Cloud Developer Client Tool, then generate analyses and dashboards.

  • Publish the data in pixel-perfect reports.

Connect to Autonomous Data Warehouse for Data Visualization
In Oracle Analytics Cloud, create an Autonomous Data Warehouse connection for data visualization. See Create Connections to Oracle Autonomous Data Warehouse.

Description of uc6_connectionadwc-gif.gif follows

Now create a new project and data set to visualize data from your Autonomous Data Warehouse.
Connect to Autonomous Data Warehouse for Data Modeler
In Oracle Analytics Cloud Console, create a connection in the usual way. See Connect to Data in an Oracle Cloud Database.
Use the database details you recorded earlier to fill in the Create Connection dialog.

Description of uc6_conn_console-gif.jpg follows

Specify these values:
  • Name and Description: A short name and description to identify this connection in Oracle Analytics Cloud.

  • Connect Using: Select Host, Port, and Service Name.

  • Host: The host name of the Autonomous Data Warehouse instance that you obtained from the downloaded tnsnames.ora file. For example, adwc.example.oraclecloud.com.

  • Port: The port number that you obtained from the downloaded tnsnames.ora file. For example, 1522.

  • Service Name: The service name that you obtained from the downloaded tnsnames.ora file. For example, adwc1_high.adwc.oraclecloud.com.

  • Connect as: The name of a user with read access to Autonomous Data Warehouse. For example, ADMIN.

  • Password: The password for the specified database user.

  • Enable SSL: Select this option.

In Data Modeler, you can now model data from your Autonomous Data Warehouse using this connection.
Connect to Autonomous Data Warehouse in Oracle Analytics Cloud Developer Client Tool
You can use Oracle Analytics Cloud Client Tool to edit a data model connected to Autonomous Data Warehouse.
  1. On the machine where you installed Oracle Analytics Cloud Developer Client Tool, copy the cwallet.sso, sqlnet.ora, and tnsnames.ora from the zip file that you downloaded from Autonomous Data Warehouse to the folder:
    <Developer Client Tool installation folder>\domains\bi\config\fmwconfig\bienv\core
    Description of uc6_admintool-gif.gif follows
  2. Edit sqlnet.ora so that the wallet location points to:
    <Developer Client Tool installation folder>\domains\bi\config\fmwconfig\bienv\core
    For example:
    WALLET_LOCATION = (SOURCE = (METHOD = file) (METHOD_DATA = (DIRECTORY="C:\ade\admintoolOAC18.2.1\domains\bi\config\fmwconfig\bienv\core"))) SSL_SERVER_DN_MATCH=yes
  3. In Oracle Analytics Cloud Developer Client tool, click File, then Open, then In the Cloud to open your data model. See Edit a Data Model in the Cloud.
    When you log in, use the connection information for your Oracle Analytics Cloud instance to fill in the Open in the Cloud dialog.
    • For Port, specify 443.

    • For Host name, specify the host domain name of your Oracle Analytics Cloud instance.

    • Select SSL. For Trust Store and Password, point to a local JDK/JRE cacerts keystore that trusts certificates signed by well-known CAs.

  4. Connect to Autonomous Data Warehouse.
    1. Click File, then Import Metadata to start the Import Metadata wizard, and follow the on-screen instructions.Description of uc6_imp_md-gif.gif follows
    2. On the Select Data Source page, for the Data Source Name value, specify a long TNS connection string from the downloaded tnsnames.ora file. Include the entire description, enclosed in brackets.

      For example:

      (description=(address=(protocol=tcps)(port=1522)(host=adwc.example.oraclecloud.com))(connect_data=(service_name=adwc1_high.adwc.oraclecloud.com))(security=(ssl_server_cert_dn="CN=adwc.example.oraclecloud.com,OU=Oracle BMCS US,O=Oracle Corporation,L=Redwood City,ST=California,C=US")) )

    3. For User Name and Password, enter the credentials for the ADMIN user or another suitable Autonomous Data Warehouse user.
You’re now ready to model the data in Oracle Analytics Cloud Developer Client Tool, publish the data model to Oracle Analytics Cloud, and create analyses and data visualizations using data from Autonomous Data Warehouse.

Connect to a Database Deployed on Oracle Cloud Infrastructure Classic with a Public IP Address

Configure Oracle Analytics Cloud to connect to Oracle Database Classic Cloud Service deployed on Oracle Cloud Infrastructure Classic so that end users can analyze that data in visualizations, analyses, and pixel-perfect reports.

Typical Workflow to Connect to a Database Deployed on Oracle Cloud Infrastructure Classic

If you’re connecting Oracle Analytics Cloud to a database deployed on Oracle Cloud Infrastructure Classic for the first time, follow these tasks as a guide.

Task Description More Information

Verify the prerequisites

Verify that your environment satisfies the prerequisites required for this configuration.

Prerequisites

Record database information

Record connection information for Oracle Database Classic Cloud Service.

Record Database Information

Enable database access

Add access rules to enable Oracle Analytics Cloud access to the database.

Enable Database Access Through Port 1521

Connect to the database

Create and test your connections.

Connect to Your Database from Oracle Analytics Cloud

Prerequisites

Before you start, make sure you have the required environment.

Step Description Note Important Information

Set up Oracle Analytics Cloud

Deploy Oracle Analytics Cloud.

Region

Availability Domain

Deploy Oracle Database Classic Cloud Service

  • Deploy Oracle Database Classic Cloud Service on the Virtual Cloud Network in Oracle Cloud Infrastructure Classic.

  • Populate Oracle Database Classic Cloud Service with data.
  • Set up a database user with permissions to read database tables.

Deploy Oracle Database Classic Cloud Service on the Virtual Cloud Network in Oracle Cloud Infrastructure Classic.

Public IP

Service Name

Host Domain Name

Database User/Password

Same:

  • Region

Record Database Information

All the information you need to connect to Oracle Database Classic Cloud Service is available in Oracle Cloud Infrastructure Console. Record the information now, so you have the required details when you set up the connection in Oracle Analytics Cloud.

  1. In Oracle Cloud Infrastructure Console, click Navigation menu icon in the top left corner.
  2. Under More Oracle Cloud Services, go to Classic Data Management Services, and click Database Classic.
  3. Click the name of the database you want to connect to and from the Instance Overview section, record the Service Name from the Connect String. For example, ucmdb906:1521/PDB1.504988564.oraclecloud.internal.
  4. Extract and record the Service Name of the database from the connect string value. For example, PDB1.504988564.oraclecloud.internal.
  5. Record the IP address of the database displayed in the Resources section.
  6. Find out the user name and password of a database user with permissions to read from this database, and write them down.  For example, the user SYSTEM.

Enable Database Access Through Port 1521

Add an access rule that enables Oracle Analytics Cloud to access the database through port 1521.

  1. In Oracle Cloud Infrastructure Console, click Navigation menu icon in the top left corner.
  2. Under More Oracle Cloud Services, go to Classic Data Management Services, and click Database Classic.
  3. Select the database you want to connect to.
  4. Click the Manage service icon and select Access Rules.
  5. For port 1521, click Actions and select Enable to enable the port for the default Oracle listener.
    Description of enable1521.png follows

Connect to Your Database from Oracle Analytics Cloud

After enabling access to the database, use the database connection information you recorded earlier to connect Oracle Analytics Cloud to the database deployed in Oracle Cloud Infrastructure Classic. The way you connect to the database depends on what you want to do with the data.

  • Visualize the data.

  • Model the data using Data Modeler, then generate analyses and dashboards.

  • Model the data with Oracle Analytics Cloud Developer Client Tool, then generate analyses and dashboards.

Connect to Your Database for Data Visualization
In Oracle Analytics Cloud, create an Oracle Database connection for data visualizations in the usual way. See Create Database Connections.

Description of classicdb1.png follows

Use the database details you recorded earlier to fill in the Create Connection dialog.

Description of classicdb2.png follows

Specify these values:
  • Connection Name: The name of the Oracle Database Classic Cloud Service you want to connect to.

  • Host: The Public IP address for Oracle Database Classic Cloud Service. For example, 123.213.85.123.

  • Port: The port number that enables access to Oracle Database Classic Cloud Service. For example, 1521.

  • Username: The name of a user with read access to Oracle Database Classic Cloud Service.

  • Password: The password for the specified database user.

  • Service Name: The service name on the Database Classic page. For example, PDB1.123456789.oraclecloud.internal.

Connect to Your Database for Data Modeler
In Oracle Analytics Cloud Console, create a connection in the usual way. See Connect to Data in an Oracle Cloud Database.
Use the database details you recorded earlier to fill in the Create Connection dialog.

Description of classicdb3.png follows

Specify these values:
  • Name and Description: The name of the Oracle Database Classic Cloud Service you want to connect to.

  • Connect Using: Select Host, Port, and Service Name.

  • Host: The Public IP address for Oracle Database Classic Cloud Service. For example, 123.213.85.123.

  • Port: The port number that enables access to Oracle Database Classic Cloud Service. For example, 1521.

  • Service Name: The service name from the Database Classic page. For example, PDB1.123456789.oraclecloud.internal.

  • Connect as: The name of a user with read access to Oracle Database Classic Cloud Service.

  • Password: The password for the specified database user.

Connect to Your Database in Oracle Analytics Cloud Developer Client Tool
In Oracle Analytics Cloud Developer Client tool, click File, Open, and then In the Cloud to open your data model in the usual way. See Edit a Data Model in the Cloud.
When you sign in, use connection information for your Oracle Analytics Cloud to fill in the Open in the Cloud dialog.
Create a connection pool for your database. In the Physical pane, expand the database node, right-click the database icon, and click Properties to display the Connection Pool dialog. Use the database details you recorded earlier to specify Call Interface, Data Source Name, User Name, and Password.


Description of connpool-gif.bmp follows

Specify these values:
  • Call interface: Select Default (Oracle Call Interface (OCI).

  • Data Source Name: Specify the connection details. For example:

    (DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=123.213.85.123)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=PDB1.587075508.oraclecloud.internal))

    For SERVICE_NAME, use the Database Classic page to locate the service name. For example, PDB1.587075508.oraclecloud.internal.

You’re now ready to model the data in Oracle Analytics Cloud Developer Client Tool, publish the data model to Oracle Analytics Cloud, and create analyses and data visualizations using data from Oracle Database Classic Cloud Service.

Federate with Oracle Identity Cloud Service Manually

In most cases, Oracle Analytics Cloud is automatically federated with the primary Oracle Identity Cloud Service instance associated with your tenancy. If you want to federate with a secondary Oracle Identity Cloud Service instance or your tenancy is a government region where federation isn't set up automatically, you must federate with Oracle Identity Cloud Service manually.

The way you do this depends whether your Oracle Identity Cloud Service includes the COMPUTEBAREMETAL application. If a COMPUTEBAREMETAL application doesn’t exist in your tenancy, you must perform some additional steps to set up a trusted application that you can use.

  1. Sign-in to your Oracle Identity Cloud Service console with administrator privileges.
  2. In the Oracle Identity Cloud Service console, click Applications.
  3. Determine whether the COMPUTEBAREMETAL application is available.
    • COMPUTEBAREMETAL application in the list

      1. Open the application, and click the Configuration tab.
      2. Expand General Information and make a note of the Client ID.
      3. Click Show Secret to display and then copy the Client Secret.
      4. Skip Step 4 and go to Step 5.
    • No COMPUTEBAREMETAL application in the list

      Continue with Step 4 to set up a trusted application.

  4. Set up a trusted application.
    1. In the Applications tab, click Add Application.
    2. Click Confidential Application.
    3. Enter a suitable Name (for example, OCI_Federation) and Description (for example, Confidential application to enable federation with OCI), and then click Next.
    4. In Allowed Grant Types, select Resource Owner, Client Credentials, and JWT Assertion.
    5. In the App Roles table, add the role Security Administrator.
    6. Click Next, and then click Finish.
    7. When the Application Added dialog is displayed, make a note of the Client ID and Client Secret.
    8. Click Activate and then OK to confirm that you want to activate the application.
  5. Create a group named OCI_Administrators.
    1. Click the Groups tab.
    2. Create a group called OCI_Administrators, and add one or more users to the group.
  6. Federate your Oracle Identity Cloud Service in Oracle Cloud Infrastructure.
    1. Sign-in to your Oracle Cloud Infrastructure Console.
    2. Under Governance and Administration, click Identity, then Federation.
    3. Click Add identity provider.
    4. Enter details about the Oracle Identity Cloud Service instance you want to use.

      Enter a Name (for example, OracleIdentityCloudProvider), Description, and for Type select Oracle Identity Cloud Service.

      Enter the Base URL for the Oracle Identity Cloud Service instance you want to use (primary or secondary), and then enter the Client ID and Client Secret values that you recorded earlier.

    5. Click Continue.
    6. Map the Oracle Identity Cloud Service group you created in Step 5 (OCI_Administrators) to the Administrators group in Oracle Cloud Infrastructure.
    7. Click Add Provider.

    The identity provider is displayed with the status Active.

  7. Sign out of your tenancy.

    The Sign In page now displays the federated identity provider. For example oracleidentycloudprovider.

    Oracle Identity Cloud Service users who sign in through the federated identity provider inherit permissions based on their Oracle Identity Cloud Service to Oracle Cloud Infrastructure group mappings. This means that users who belong to the Oracle Identity Cloud Service group OCI_Administrators have all the permissions granted to the Oracle Cloud Infrastructure group Administrators.