Oracle Cloud Infrastructure Documentation

Configuring Network Access for an IoT Flow Runtime

Define the subnet and network security groups in an IoT Flow Runtime's network configuration.

Configure an existing IoT Flow Runtime with the subnet and network security groups required by your flow. The network configuration is updated as part of the IoT Flow Runtime resource.

Use a private subnet with the routes and security rules required by your flow. For outbound internet access from a private subnet, route traffic through a NAT gateway. Limit network security group rules to the protocols, ports, sources, and destinations the flow requires.

To define network access while creating a runtime, see Creating an IoT Flow Runtime.

    1. On the IoT domains list page, select the domain with the flow runtime you want to work with, and then select Flow runtimes. If you need help finding the IoT domains list page, see Listing IoT Domains.
    2. Select the Flow runtime name to open the IoT Flow Runtime details page.
    3. Select Edit.
    4. In network configuration, if configured select the subnet that can reach the flow runtime or the File Storage mount target, include any network security groups that must remain attached. Select up to five network security groups.

      Use network security groups and subnets to control traffic.

    5. Save the changes and wait for the update to complete.

  • Use the generated IoT Flow Runtime update command with a complete network configuration file.

    oci iot flow-runtime update --iot-flow-runtime-id <flow-runtime-OCID> --network-config file://network-config.json

    For example, network-config.json contains:

    {
  "subnetId": "ocid1.subnet.oc1..exampleuniqueID",
  "networkSecurityGroupIds": [
    "ocid1.networksecuritygroup.oc1..exampleuniqueID"
  ]
}

    Omitting --network-config preserves the existing network configuration. Providing it replaces the complete configuration. To remove the configuration, pass the value supported by the final generated CLI for a null networkConfig.

    For all options, see CLI Command Reference.

  • Run the UpdateIotFlowRuntime operation to replace the network configuration for an existing IoT Flow Runtime.

    PUT /20250531/iotFlowRuntimes/{iotFlowRuntimeId}
{
  "networkConfig": {
    "subnetId": "ocid1.subnet.oc1..exampleuniqueID",
    "networkSecurityGroupIds": [
      "ocid1.networksecuritygroup.oc1..exampleuniqueID"
    ]
  }
}

    If networkConfig is present, subnetId is required. You can provide up to five network security group OCIDs in networkSecurityGroupIds.

    Updates are partial. Omitting networkConfig preserves the existing configuration. Providing it replaces the complete configuration. To remove the configuration, pass networkConfig as null.