Can customers configure private endpoints?
Yes, as of 2026, OCI offers Private Endpoints, which allow you to access cloud services (like databases and storage) as if they were sitting directly in your own private network.
Instead of your server reaching out to a public URL over the internet, a Private Endpoint gives the service a Private IP address inside your subnet.
A Private Endpoint is essentially a Virtual Network Interface Card (VNIC) that OCI injects into your VCN.
The IP: It takes a private IP from your existing subnet range (e.g., 10.0.1.15).
The DNS: OCI automatically updates its private DNS so that when your server looks up objectstorage.us-phoenix-1.oraclecloud.com, it resolves to that local private IP instead of a public one.
The Security: Since it’s just a VNIC in your subnet, you can use Network Security Groups (NSGs) to write firewall rules that control exactly which servers are allowed to talk to that service.
In OCI, you have two main ways to talk to services privately. Choosing the right one is key:
| Feature | Service Gateway | Private Endpoint |
| Access Model | Gateway-based (Route Table) | Direct IP-based (VNIC) |
| Scope | Accesses all instances of a service | Accesses a specific resource |
| On-Premises Access | Complex (Requires transit routing) | Easy (Accessible via VPN/FastConnect) |
| Granularity | Low (All-or-nothing per VCN) | High (Per-resource control) |
Most major OCI PaaS and IaaS services support Private Endpoints in 2026:
Databases: Autonomous Database, Exadata, and Base Database.
Storage: Object Storage (allows you to lock buckets so they are only accessible via the private IP).
AI & Data: Data Science models, Data Flow, and OCI OpenSearch.
Integration: Oracle Integration Cloud (OIC) and API Gateway.
Stringent Compliance: In industries like Finance or Healthcare, you may be forbidden from having any traffic traverse a public endpoint, even if it's encrypted.
Hybrid Cloud: If you have an on-premises app that needs to upload files to OCI Object Storage, a Private Endpoint allows that app to use a private IP over your VPN/FastConnect, making the cloud feel like an extension of your own data center.
Zero Trust: You can use Private Endpoints to ensure that even if a user has the credentials for your database, they can only connect if they are physically "inside" your network.
To configure a Private Endpoint, you generally follow these steps:
Pick a Subnet: Choose a private subnet with at least one free IP address.
Assign an NSG: Create a Network Security Group that allows ingress on the service's port (e.g., 1522 for SQL, 443 for HTTPS).
Enable the Service: In the service console (e.g., Autonomous Database), change the Network Access type from "Secure Access from Anywhere" to "Private Endpoint Access Only."