Skip to main content

Oracle Cloud

Visualize OCI compute instances, virtual machine hosts, domains, access policies, oracle object storage, vaults, nosql services, streaming services , devops, functions, redis, resource manager , map OCI users to employees, and monitor changes through queries and alerts.

Installation​

This guide walks you through setting up the Oracle Cloud Infrastructure (OCI) integration in JupiterOne. The process involves two main steps:

  1. Configure API access in Oracle Cloud - Set up authentication credentials
  2. Configure the integration in JupiterOne - Connect JupiterOne to your OCI account

Prerequisites​

Before you begin, make sure you have:

  • Admin access to your Oracle Cloud Infrastructure account (or a user with sufficient permissions)
  • The ability to create API keys and configure IAM policies in OCI
  • Access to your JupiterOne account

Step 1: Configure API Access in Oracle Cloud​

To connect JupiterOne to your Oracle Cloud account, you'll need to create API credentials. Here's what you'll be collecting:

CredentialWhat It IsWhere You'll Get It
Private KeyThe private half of an RSA key pair used for API authenticationGenerated/downloaded during API key creation
Tenancy OCIDYour Oracle Cloud tenancy's unique identifierShown in the configuration preview after creating the API key
User OCIDThe unique identifier for your OCI user accountShown in the configuration preview after creating the API key
FingerprintA unique identifier for your public keyShown in the configuration preview after creating the API key
RegionThe Oracle Cloud region you want to connect toShown in the configuration preview after creating the API key
PassphraseOptional password protecting your private keyOnly needed if you used a passphrase when generating the key

Create an API Key in Oracle Cloud​

  1. Log into Oracle Cloud Infrastructure Console

    • Sign in as the root user or a user with permissions to create API keys and manage IAM policies

  2. Navigate to User Profile

    • Click on your profile icon in the top-right corner of the screen
    • Select My profile from the dropdown menu

  3. Add API Key

    • In your profile, scroll to the Tokens and Keys section
    • Click Add API Key

  4. Generate or Upload Key Pair

    • Recommended: Select "Generate a key pair for me" (easiest option)
    • Alternative: Upload your own public key if you already have one

  5. Download Your Private Key ⚠️ Important

    • If you generated a new key pair, you'll see an option to download the private key
    • Download and securely store this file - you'll need it for the JupiterOne integration
    • The private key file will have a .pem extension
    • Click Add Key

  6. Save Your Configuration Values

    • After adding the API key, Oracle Cloud will display a configuration file preview
    • This preview contains the following values you'll need:
      • User OCID: ocid1.user.oc1..xxxxx
      • Tenancy OCID: ocid1.tenancy.oc1..xxxxx
      • Fingerprint: A string like aa:bb:cc:dd:ee:ff:...
      • Region: Your region identifier (e.g., us-ashburn-1)
    • Copy and save these values - you'll enter them in JupiterOne in the next step

Set Up Required Permissions​

JupiterOne needs specific permissions to collect data from your Oracle Cloud account. This section walks you through creating a user group and assigning the necessary permissions via an IAM policy.

Why create a group? Oracle Cloud policies are typically applied to groups rather than individual users. This makes management easier and follows security best practices.

Step 1: Create a User Group​

  1. Navigate to Identity & Security

    • In the OCI Console, open Identity & Security from the main menu

  2. Select Domains

    • Click Domains in the left sidebar
    • Select your default domain (usually named "Default")

  3. Create a New Group

    • Click the User Management tab
    • Scroll to the Groups section
    • Click Create Group

  4. Configure the Group

    • Name: Enter J1Group (or any name you prefer)
    • Description: Add a description like "JupiterOne integration access group"
    • Users: Add your current user (the one with the API key) to this group
    • Click Create

Step 2: Create an IAM Policy​

Now you'll create a policy that grants the necessary permissions to your group. You can choose between two approaches:

Option A: Simple (Recommended for Most Users)

  • Fastest to set up
  • Grants broad read and inspect permissions
  • Perfect if you don't need fine-grained control

Option B: Granular

  • More restrictive permissions
  • Follows the principle of least privilege
  • Better for organizations with strict security requirements

This approach grants JupiterOne the permissions it needs with just 3 policy statements:

  1. Navigate to Policies

    • In the OCI Console, go to Identity & Security > Identity > Policies

  2. Create New Policy

    • Click Create Policy
    • Name: Enter a name like J1-Integration-Policy
    • Description: Add a description like "Policy for JupiterOne integration access"
    • Policy Builder: Select Show manual builder

  3. Add Policy Statements

    • Copy and paste the following three statements into the policy editor:
Allow group J1Group to inspect all-resources in tenancy
Allow group J1Group to read all-resources in tenancy
Allow group J1Group to use network-security-groups in tenancy
  1. Save the Policy
    • Click Create to save the policy

Important: Replace J1Group with your actual group name if you used something different.

Option B: Granular Permissions (Advanced)​

If you prefer more restrictive, fine-grained permissions, use this comprehensive policy set instead:

  1. Navigate to Policies

    • In the OCI Console, go to Identity & Security > Identity > Policies

  2. Create New Policy

    • Click Create Policy
    • Name: Enter a name like J1-Integration-Policy-Granular
    • Description: Add a description like "Granular policy for JupiterOne integration access"
    • Policy Builder: Select Show manual builder

  3. Add Policy Statements

    • Copy and paste all of the following statements into the policy editor:
Allow group J1Group to inspect groups in tenancy
Allow group J1Group to read policies in tenancy
Allow group J1Group to inspect devops-family in tenancy
Allow group J1Group to read fn-function in tenancy
Allow group J1Group to read fn-app in tenancy
Allow group J1Group to read instances in tenancy
Allow group J1Group to inspect dedicated-vm-hosts in tenancy
Allow group J1Group to read nosql-indexes in tenancy
Allow group J1Group to inspect nosql-tables in tenancy
Allow group J1Group to read buckets in tenancy
Allow group J1Group to inspect redis-clusters in tenancy
Allow group J1Group to inspect orm-stacks in tenancy
Allow group J1Group to inspect streams in tenancy
Allow group J1Group to inspect stream-pools in tenancy
Allow group J1Group to inspect keys in tenancy
Allow group J1Group to inspect vaults in tenancy
Allow group J1Group to inspect secrets in tenancy
Allow group J1Group to inspect secret-bundles in tenancy
Allow group J1Group to inspect cloud-guard-problems in tenancy
Allow group J1Group to inspect cloud-guard-detectors in tenancy
Allow group J1Group to inspect cloud-guard-detector-recipes in tenancy
Allow group J1Group to inspect cloud-guard-detector-rule-definitions in tenancy
Allow group J1Group to inspect cloud-exadata-infrastructures in tenancy
Allow group J1Group to inspect cloud-vmclusters in tenancy
Allow group J1Group to read vcns in tenancy
Allow group J1Group to read subnets in tenancy
Allow group J1Group to read vnics in tenancy
Allow group J1Group to inspect load-balancers in tenancy
Allow group J1Group to inspect file-systems in tenancy
Allow group J1Group to inspect mount-targets in tenancy
Allow group J1Group to inspect volumes in tenancy
Allow group J1Group to inspect volume-groups in tenancy
Allow group J1Group to inspect log-groups in tenancy
Allow group J1Group to inspect ons-topics in tenancy
Allow group J1Group to inspect ons-subscriptions in tenancy
Allow group J1Group to inspect analytics-instances in tenancy
Allow group J1Group to inspect integration-instances in tenancy
Allow group J1Group to use network-security-groups in tenancy
Allow group J1Group to read security-lists in tenancy
Allow group J1Group to inspect recovery-service-protected-databases in tenancy
Allow group J1Group to inspect instance-images in tenancy
Allow group J1Group to read authentication-policies in tenancy
Allow group J1Group to read compartments in tenancy
Allow group J1Group to read domains in tenancy
Allow group J1Group to read users in tenancy
Allow group J1Group to inspect vnic-attachments in tenancy
Allow group J1Group to inspect loganalytics-resources-family in tenancy
Allow group J1Group to inspect db-homes in tenancy
  1. Save the Policy
    • Click Create to save the policy

Important: Replace J1Group with your actual group name if you used something different.

Verify Your Setup​

Before proceeding, confirm that:

  • ✅ Your user is a member of the group you created
  • ✅ The IAM policy has been created successfully
  • ✅ The policy includes your group name in all statements

Step 2: Configure the Integration in JupiterOne​

Now that you have your Oracle Cloud credentials ready, it's time to set up the integration in JupiterOne.

Create a New Integration Instance​

  1. Navigate to Integrations

    • In JupiterOne, go to the Integrations page
    • Find and select Oracle Cloud from the list of available integrations

  2. Start Configuration

    • Click New Instance to begin setting up a new Oracle Cloud integration

Enter Configuration Details​

Fill out the following fields in the integration configuration form:

Basic Information​

  • Account Name (Required)

    • A friendly name to identify this Oracle Cloud account in JupiterOne
    • This name will appear in tags on ingested entities (tag.AccountName)
    • Example: production-oci, us-east-oci, or company-oci

  • Description (Optional)

    • Additional information to help you identify this integration instance
    • Useful if you have multiple Oracle Cloud accounts

Connection Settings​

  • Polling Interval (Required)
    • How often JupiterOne should automatically collect data from Oracle Cloud
    • Options typically include: DISABLED, 1 hour, 4 hours, 12 hours, 24 hours
    • Choose DISABLED if you prefer to run the integration manually

Oracle Cloud Credentials​

Enter the values you collected in Step 1:

  • Private Key (Required)

    • Paste the contents of the private key file (.pem file) you downloaded
    • Copy the entire file contents, including the header and footer lines: 
      -----BEGIN RSA PRIVATE KEY-----
      [key content]
      -----END RSA PRIVATE KEY-----

  • Tenancy OCID (Required)

    • Your tenancy's unique identifier
    • Format: ocid1.tenancy.oc1..xxxxx

  • User OCID (Required)

    • Your user's unique identifier
    • Format: ocid1.user.oc1..xxxxx

  • Fingerprint (Required)

    • The fingerprint associated with your API key
    • Format: aa:bb:cc:dd:ee:ff:...

  • Region (Required)

    • The Oracle Cloud region you want to connect to
    • Examples: us-ashburn-1, us-phoenix-1, eu-frankfurt-1

  • Private Key Passphrase (Optional)

    • Only required if you used a passphrase when generating the private key
    • Leave blank if your key is not encrypted

Complete the Setup​

  1. Review your configuration

    • Double-check that all required fields are filled in correctly
    • Verify that OCID values and fingerprints match what you saved from Oracle Cloud

  2. Click Create

    • JupiterOne will validate the credentials and start the initial data collection
    • The integration will begin running on your specified polling interval

Next Steps​

Once your integration is configured:

✅ The integration will automatically run according to your polling interval (or you can run it manually)

✅ Data from your Oracle Cloud account will begin populating in JupiterOne

✅ You can view, manage, and edit your integration instance by visiting the Instance management guide

Need help? If you encounter any issues during setup, verify that:

  • Your API key permissions are correctly configured
  • All OCID values and fingerprints are copied correctly (watch for extra spaces)
  • Your private key is pasted in full, including the header and footer lines