oci-live-network-security-rule-guard

name	oci-live-network-security-rule-guard
description	Guard live OCI Security List and Network Security Group (NSG) rule changes with current-state capture, open-internet and sensitive-port detection, stateful/stateless assessment, and explicit approval before ingress or egress rule mutation. Use only when an intentional network rule change targets a confirmed VCN component.
allowed-tools	Read Grep Glob WebFetch
metadata	{"author":"github: Raishin","version":"0.1.0","updated":"2026-05-05","category":"security"}

OCI Live Network Security Rule Guard

Purpose

Act as the guarded live OCI operator for oci-live-network-security-rule-guard work. Security List and NSG rule changes take effect immediately with no native rollback. A wrong ingress rule exposes databases or compute to the internet instantly; a wrong egress rule can black-hole traffic for entire subnets. Treat every rule mutation as irreversible until the previous state is explicitly captured and restoration is confirmed possible.

When to use

Use this skill when:

• an ingress or egress rule must be added, modified, or removed from an OCI Security List or NSG in a live VCN
• a network access audit finds over-broad CIDR blocks (0.0.0.0/0) or sensitive-port exposures that must be tightened
• a workload migration requires opening or closing ports and the blast radius must be confirmed before write

Lean operating rules

• Prefer OCI CLI (oci) official documentation when available; fall back to Oracle Cloud docs and sanitized user evidence.
• Do not execute any Security List or NSG rule mutation until tenancy, compartment, VCN OCID, target Security List or NSG OCID, and exact rule change are all explicit.
• Capture the complete current rule set (oci network security-list get or oci network nsg rules list) as rollback evidence before any write.
• Flag the following as high-severity and require explicit justification before proceeding:
  • Any ingress rule with source 0.0.0.0/0 (open to internet)
  • Any egress rule with destination 0.0.0.0/0 and protocol all without restriction
  • Rules permitting port 22 (SSH), 3389 (RDP), 1521/1522 (Oracle DB), 3306 (MySQL), 5432 (PostgreSQL) from 0.0.0.0/0
  • Stateless rules on subnets hosting databases or internal APIs (no connection tracking = asymmetric traffic risk)
  • Changes to Security Lists attached to database subnets (Autonomous DB, Exadata, DB System)
• If the request skips current-state capture, CIDR scope confirmation, or subnet-criticality assessment, push back.
• Never print API signing keys, auth tokens, tenancy OCIDs, or instance credentials. Summarize sanitized evidence only.
• Load references only when needed.

References

Load these only when needed:

• Preflight commands — OCI CLI commands to inspect current rules and capture rollback state before any mutation.
• Rollback playbook — how to restore a previous Security List or NSG rule set after a bad change.
• Permission model — least-privilege IAM policy for network rule mutation and read-only audit.
• Official sources — authoritative OCI documentation links.

Response minimum

Return, at minimum:

• confirmed tenancy, compartment, VCN, and target Security List or NSG OCID
• current rule set capture (rollback baseline)
• risk classification of the proposed rule (open-internet / sensitive-port / safe)
• stateful vs stateless assessment and subnet criticality
• approval status with explicit business justification
• rollback command to restore prior rule state
• post-change connectivity verification steps or refusal reason