Table: oci_network_firewall_policy - Query OCI Networking Firewall Policies using SQL

A Firewall Policy in Oracle Cloud Infrastructure (OCI) Networking is a set of rules and actions that govern the traffic flow through gateways. It provides a secure and controlled environment for network applications. Firewall Policies are essential in maintaining the security and integrity of data in OCI Networking environments.

Table Usage Guide

The oci_network_firewall_policy table provides insights into Firewall Policies within OCI Networking. As a network administrator, you can explore policy-specific details through this table, including policy rules, actions, and associated metadata. Utilize it to uncover information about policies, such as those governing specific traffic, the actions associated with each policy, and the verification of policy rules.

Examples

Basic info

Explore the configuration and status of your network firewall policy. This information can help you assess the security rules and applications associated with your firewall, identify any mapped secrets, and determine whether the firewall is currently attached.

select
  id,
  display_name,
  application_lists,
  decryption_profiles,
  decryption_rules,
  ip_address_lists,
  is_firewall_attached,
  mapped_secrets,
  security_rules,
  url_lists,
  lifecycle_state as state
from
  oci_network_firewall_policy;

select
  id,
  display_name,
  application_lists,
  decryption_profiles,
  decryption_rules,
  ip_address_lists,
  is_firewall_attached,
  mapped_secrets,
  security_rules,
  url_lists,
  lifecycle_state as state
from
  oci_network_firewall_policy;

List network firewall policies created in the last 30 days

Explore the recently created network firewall policies to understand their configuration and status. This is helpful to monitor the recent changes and ensure the security rules, decryption profiles, and other settings are properly configured.

select
  id,
  display_name,
  application_lists,
  decryption_profiles,
  decryption_rules,
  ip_address_lists,
  is_firewall_attached,
  mapped_secrets,
  security_rules,
  url_lists,
  lifecycle_state as state
from
  oci_network_firewall_policy
where
  time_created >= now() - interval '30' day;

select
  id,
  display_name,
  application_lists,
  decryption_profiles,
  decryption_rules,
  ip_address_lists,
  is_firewall_attached,
  mapped_secrets,
  security_rules,
  url_lists,
  lifecycle_state as state
from
  oci_network_firewall_policy
where
  time_created >= datetime('now', '-30 day');

List network firewall policies with firewall attached

Determine the network firewall policies that have a firewall attached. This can help in identifying and managing the policies that are actively being implemented, thereby enhancing network security.

select
  id,
  display_name,
  application_lists,
  decryption_profiles,
  decryption_rules,
  ip_address_lists,
  is_firewall_attached,
  mapped_secrets,
  security_rules,
  url_lists,
  lifecycle_state as state
from
  oci_network_firewall_policy
where
  is_firewall_attached;

select
  id,
  display_name,
  application_lists,
  decryption_profiles,
  decryption_rules,
  ip_address_lists,
  is_firewall_attached,
  mapped_secrets,
  security_rules,
  url_lists,
  lifecycle_state as state
from
  oci_network_firewall_policy
where
  is_firewall_attached;

List network firewall policies without mapped secrets

Identify instances where network firewall policies are potentially vulnerable due to the absence of mapped secrets. This is crucial for enhancing security measures and avoiding unauthorized access.

select
  id,
  display_name,
  application_lists,
  decryption_profiles,
  decryption_rules,
  ip_address_lists,
  is_firewall_attached,
  mapped_secrets,
  security_rules,
  url_lists,
  lifecycle_state as state
from
  oci_network_firewall_policy
where
  mapped_secrets is null;

select
  id,
  display_name,
  application_lists,
  decryption_profiles,
  decryption_rules,
  ip_address_lists,
  is_firewall_attached,
  mapped_secrets,
  security_rules,
  url_lists,
  lifecycle_state as state
from
  oci_network_firewall_policy
where
  mapped_secrets is null;

Schema for oci_network_firewall_policy

Name	Type	Operators	Description
_ctx	jsonb		Steampipe context in JSON form.
application_lists	jsonb		A mapping of strings to arrays of Application objects.
compartment_id	text	=	The OCID of the compartment in Tenant in which the resource is located.
decryption_profiles	jsonb		A mapping of strings to DecryptionProfile objects.
decryption_rules	jsonb		List of Decryption Rules defining the behavior of the policy. The first rule with a matching condition determines the action taken upon network traffic.
defined_tags	jsonb		Defined tags for resource. Defined tags are set up in your tenancy by an administrator. Only users granted permission to work with the defined tags can apply them to resources.
display_name	text	=	A user-friendly name for the Network Firewall Policy.
freeform_tags	jsonb		Free-form tags for resource. This tags can be applied by any user with permissions on the resource.
id	text	=	The OCID of the Network Firewall Policy resource.
ip_address_lists	jsonb		Map defining IP address lists of the policy. The value of an entry is a list of IP addresses or prefixes in CIDR notation. The associated key is the identifier by which the IP address list is referenced.
is_firewall_attached	boolean		To determine if any Network Firewall is associated with this Network Firewall Policy.
lifecycle_details	text		A message describing the current state in more detail.
lifecycle_state	text	=	The current state of the Network Firewall.
mapped_secrets	jsonb		A mapping of strings to MappedSecret objects.
security_rules	jsonb		List of Security Rules defining the behavior of the policy. The first rule with a matching condition determines the action taken upon network traffic.
sp_connection_name	text	=, !=, ~~, ~~, !~~, !~~	Steampipe connection name.
sp_ctx	jsonb		Steampipe context in JSON form.
tags	jsonb		A map of tags for the resource.
tenant_id	text	=, !=, ~~, ~~, !~~, !~~	The OCID of the Tenant in which the resource is located.
time_created	timestamp with time zone		Time that Network Firewall Policy was created.
title	text		Title of the resource.
url_lists	jsonb		A mapping of strings to arrays of UrlPattern objects.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- oci

You can pass the configuration to the command with the --config argument:

steampipe_export_oci --config '<your_config>' oci_network_firewall_policy