> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Open oracle remediation ### Triage and Remediation ### Remediation To remediate the Oracle Port Should Not Be Open misconfiguration for GCP using GCP console, follow these steps: 1. Log in to the GCP console ([https://console.cloud.google.com/](https://console.cloud.google.com/)). 2. Select the project that contains the affected resource. 3. In the navigation menu on the left-hand side, click on "Compute Engine" and then select "VM instances". 4. Locate the instance that has the open Oracle port and click on its name to open its details page. 5. Click on the "Edit" button at the top of the page to edit the instance settings. 6. Scroll down to the "Firewall" section and click on "Management, security, disks, networking, sole tenancy". 7. Under the "Firewall" section, click on "Network interfaces". 8. Click on "default" to expand the network interface settings. 9. In the "Firewall rules" section, locate the rule that allows traffic on the Oracle port (default is 1521). 10. Click on the trashcan icon next to the rule to delete it. 11. Click on the "Save" button at the bottom of the page to save the changes. 12. Verify that the Oracle port is no longer open by running a port scan or checking the instance's firewall rules. By following these steps, you have successfully remediated the Oracle Port Should Not Be Open misconfiguration for GCP using GCP console. # To remediate the misconfiguration "Oracle Port Should Not Be Open" for GCP using GCP CLI, follow the below steps: 1. Open the GCP console and navigate to the GCP project where the misconfiguration exists. 2. Open the Cloud Shell by clicking on the icon on the top right corner of the console. 3. Run the following command to list all the firewall rules in the project: ``` gcloud compute firewall-rules list ``` 4. Identify the firewall rule that allows access to the Oracle port. Note down the name of the firewall rule. 5. Run the following command to delete the firewall rule: ``` gcloud compute firewall-rules delete [FIREWALL_RULE_NAME] ``` Replace \[FIREWALL\_RULE\_NAME] with the name of the firewall rule identified in step 4. 6. Confirm the deletion by typing "Y" when prompted. 7. Verify that the firewall rule has been deleted by running the following command: ``` gcloud compute firewall-rules list ``` The output should not contain the firewall rule that was deleted in step 5. By following these steps, you have successfully remediated the misconfiguration "Oracle Port Should Not Be Open" for GCP using GCP CLI. To remediate the misconfiguration "Oracle Port Should Not Be Open" in GCP using Python, you can follow the below steps: 1. Identify the instances in your GCP project that have the Oracle port open. You can use the GCP Python SDK to get the list of instances and their network configuration. 2. For each instance with the Oracle port open, use the GCP Python SDK to update the firewall rule that allows traffic to the Oracle port. You can either delete the rule or modify it to allow traffic only from a specific IP address or range. 3. To delete the firewall rule, you can use the following Python code: ```python theme={null} from google.cloud import compute_v1 # Create a client object to interact with GCP client = compute_v1.FirewallsClient() # Define the name of the firewall rule to delete firewall_rule_name = 'oracle-port' # Delete the firewall rule operation = client.delete(project='your-project-id', firewall=firewall_rule_name) ``` 4. To modify the firewall rule to allow traffic only from a specific IP address or range, you can use the following Python code: ```python theme={null} from google.cloud import compute_v1 # Create a client object to interact with GCP client = compute_v1.FirewallsClient() # Define the name of the firewall rule to modify firewall_rule_name = 'oracle-port' # Define the new source IP range for the firewall rule new_source_range = '10.0.0.0/24' # Get the current firewall rule firewall_rule = client.get(project='your-project-id', firewall=firewall_rule_name) # Modify the firewall rule to allow traffic only from the new source IP range firewall_rule.source_ranges = [new_source_range] operation = client.update(project='your-project-id', firewall=firewall_rule_name, firewall_resource=firewall_rule) ``` Note: Replace 'your-project-id' with the actual ID of your GCP project, and 'oracle-port' with the name of the firewall rule that allows traffic to the Oracle port. ```hcl theme={null} resource "google_compute_firewall" "oracle_db_restricted" { name = "oracle-db-restricted" network = google_compute_network.MY_VPC.name # Replace with your VPC resource or self_link direction = "INGRESS" # Replace these with the specific trusted CIDR ranges that should reach port 1521 source_ranges = [ "TRUSTED_CIDR_1", # e.g. "203.0.113.10/32" "TRUSTED_CIDR_2", # e.g. "198.51.100.0/24" ] allowed { protocol = "tcp" ports = ["1521"] } # Optionally keep or set appropriate priority and tags if you already use them priority = 1000 target_tags = ["ORACLE_DB_TARGET_TAG"] # Replace or remove if you use service accounts instead description = "Restrict Oracle TCP 1521 access to known IP addresses" enable_logging = true } ``` If you already have a `google_compute_firewall` rule that currently allows `tcp:1521` from `0.0.0.0/0`, update that existing resource’s `source_ranges` (and `target_tags` if needed) instead of creating a new one, so Terraform changes only the ranges from `["0.0.0.0/0"]` to your trusted CIDRs. This change does not force replacement; `terraform plan` should show an in-place update to the existing `google_compute_firewall` resource, specifically modifying `source_ranges` (and any related attributes you adjust) so that no rule remains with `tcp:1521` open to `0.0.0.0/0`.