You need to perform some steps before you can configure a private endpoint for a Visual Builder instance.

In addition to the policies required to provision and manage your instance, some network policies are needed to use private endpoints.

The following table lists the IAM policies required for a cloud user to add a private endpoint. The listed policies are the minimum requirements to add a private endpoint. You can also use a policy rule that is broader. For example, you could set the policy rule like this:

Allow group MyGroupName to manage virtual-network-family in compartment <compartmentName1>
Allow group MyGroupName to manage virtual-network-family in compartment <compartmentName2>

In this policy, <compartmentName1> is the compartment where the VCN and subnet exist, and <compartmentName2> is the compartment where the Visual Builder instance will be created.

This rule also works because it is a superset that contains all the required policies.

Visual Builder relies on the IAM (Identity and Access Management) service to authenticate and authorize cloud users to perform operations that use any of the Oracle Cloud Infrastructure interfaces (the Console, REST API, CLI, SDK, or others).

The IAM service uses groups, compartments and policies to control which cloud users can access which resources. In particular, a policy defines what kind of access a group of users has to a particular kind of resource in a particular compartment. For more information, see Getting Started with Policies.

You can use the Visual Builder Private Endpoint Quick Start on GitHub and the Oracle Cloud Infrastructure (OCI) Resource Manager to help you create the VCN, private subnet, and load balancer.

The Quick Start on GitHub hosts the zip archive used by the OCI Resource Manager to create the prerequisite infrastructure for a private endpoint-enabled Visual Builder instance. With a single click you can create and deploy the infrastructure for your Visual Builder private endpoint that includes a VCN, private subnet, and load balancer.

To create the infrastructure using OCI Resource Manager:

1. Click this button to open the OCI Resource Manager:
   
   

   If the button doesn't work, click this link: Deploy to Oracle Cloud.

   When you click the button, a zip archive for creating the infrastructure is retrieved from the Visual Builder Private Endpoint Quick Start on GitHub, and the OCI Resource Manager opens in your browser.

2. If you aren't already signed in, enter the tenancy and user credentials.
3. Review and accept the terms and conditions.
4. Select the region where you want to deploy the stack.
5. Follow the on-screen prompts and instructions to create the stack.
6. After creating the stack, click Terraform Actions, and select Plan.
7. Wait for the job to be completed, and review the plan.

   To make any changes, return to the Stack Details page, click Edit Stack, and make the required changes. Then, run the Plan action again.

8. If no further changes are necessary, return to the Stack Details page, click Terraform Actions, and select Apply.

When you provision a Visual Builder instance, you can choose to have the instance configured as a private endpoint.

1. Select Private endpoint access only.

   This expands the Virtual cloud network private access configuration area.

   
   

   
   Description of the illustration pe-choose-network-access.png

   
   

   If you select Private endpoint access only, this only allows connections from the specified private network (VCN), from peered VCNs, and from on-prem networks connected to your VCN.

2. Select a VCN compartment, and a VCN in your compartment.

   See VCNs and Subnets for more information.

3. Select the Subnet compartment, and a private subnet in your compartment.

   See VCNs and Subnets for more information.

4. (Optional) Click Show network advanced options to configure advanced options, including adding network security groups, and specifying a private IP address.
   See Configure Private Endpoint Advanced Network Options.
5. (Optional) Click Show advanced options to show options for mapping a custom endpoint to the private endpoint.

   See Map Your Custom Endpoint with Your Visual Builder Instance and Manage Tags.

6. Click Create Visual Builder Instance.

After an instance is provisioned as a private endpoint, you can update the instances VCN and subnet details and add network security groups.

1. On the Visual Builder Instance Details page, click Edit to open the Edit Visual Builder Instance dialog.
   
   

   
   Description of the illustration pe-edit-instance.png

   
   

   The Private endpoint access only option is already selected, and it is not possible to select the other options. Once an instance is provisioned as a private endpoint, it is not possible to switch the instance's network access type.

2. Make any changes to the instance's advanced network options.
   You can add the instance to network security groups (NSGs) in the advanced network options. See Configure Private Endpoint Advanced Network Options.
3. (Optional) Make any changes to the VCN compartment and subnet compartment settings.
   Note
   
   

   If you change the subnet, the private endpoint needs to be recreated, and a new IP is assigned to the private endpoint.

   See VCNs and Subnets for more information.

4. Click Save Changes.

The private endpoint access advanced options allow you to enter a user-specified private IP address and add one or more network security groups.

1. Select Private endpoint access only, if not selected.
   Note
   
   

   When you are editing an instance that has already been provisioned as a private endpoint, Private endpoint access only is already selected, and it is not possible to change it.

2. (Optional) Click Show network advanced options.

   The advanced network options enable you to provide a private IP address and specify a network security group (NSG).

   
   

   
   Description of the illustration pe-configure-nsg.png

   
   
   1. Optionally enter a Private IP address.

      Use this field to enter a custom private IP address. The private IP address you enter must be within the selected subnet's CIDR range.

      If you do not provide a custom private IP address, the IP address is automatically assigned.

   2. Optionally add Network security groups (NSGs).

      If you want more security over connections to the Visual Builder instance, you can define security rules in an NSG; this creates a virtual firewall for your instance.

      • Select a Network Security Group in your compartment to attach the Visual Builder to. If the Network Security Group is in a different compartment, select a different compartment and then select a Network Security Group in that compartment.
      • Click + Another Network Security Group to add another Network Security Group.
      • Click x to remove a Network Security Group entry.
      Note
      
      Incoming and outgoing connections are limited by the combination of ingress and egress rules defined in NSGs and the Security Lists defined with the VCN. When there are no NSGs, ingress and egress rules defined in the Security Lists for the VCN still apply. See Security Lists for more information on working with Security Lists.

      See Network Security Groups for more information.

Describes restrictions and notes for private endpoints on Visual Builder.

• After you update the network access to use a private endpoint, or after the provisioning completes where you configure a private endpoint, you can view the network configuration on the Visual Builder Details page under the Network section.

  The Network section shows the following information for a private endpoint:

  • Subnet: This includes a link for the subnet associated with the private endpoint.
  • Private endpoint IP: Shows the private endpoint IP for the private endpoint configuration.
  • Network security groups: This field includes links to the NSG(s) configured with the private endpoint.

• You can map a custom endpoint to a private endpoint during the provision process, or after provisioning completes.

• You can specify up to five NSGs to control access to your instance.

• You can change the private endpoint Network Security Group (NSG) for the instance.

  To change the NSG for a private endpoint, do the following:

  1. On the Visual Builder page, select an instance from the links under the Name column.

  2. On the Visual Builder Details page, click Edit. In the Edit instance, click Show network advanced options.

• You can connect your private endpoint to an ATP database in the same VCN and subnet. See Switch to Your Own Oracle DB Instance.

• Modifying a private IP address is not allowed after you provision an instance, regardless of whether the IP address is automatically assigned or if you enter a value in the Private IP address field.

• You cannot change the node count for private endpoint-enabled Visual Builder instances.

• When using a load balancer in front of a private endpoint, use the private endpoint IP for the Load Balancer Backend, and forward traffic on port 443. You also need to share the IP address of the public load balancer with DevOps so they can update the DNS registration to make the instance URL publicly accessible.