OCI Architect Professional cheat sheet

Policy evaluation order: any explicit DENY in an attached or inherited policy wins; otherwise the first ALLOW found in the tenancy, compartment, or resource hierarchy grants access; absence of an ALLOW means implicit deny.

Policy inheritance is one-directional: a policy written at the tenancy (root compartment) applies to every compartment beneath it, but a policy in a child compartment never affects its parent or siblings.

Statement syntax: allow to in where . The subject may be a group, a dynamic group, a user, or any-user; verbs include inspect, read, use, and manage, applied in increasing scope.

manage = inspect + read + use + create/update/delete; use covers actions that consume a resource without deleting it (for example launching an instance in a subnet or attaching a volume); read includes inspect.

Dynamic group matching rules use instance or resource attributes, for example instance.compartment.id = 'ocid1.compartment...' or resource.type = 'instance' with tag-based matching; membership is evaluated from the resource principal, not a user credential.

Instance principals and resource principals obtain short-lived certificates from the OCI identity service; no user API key is stored on the instance, and the dynamic group rule plus a policy is what actually grants the call.

AuthN options: local IAM users with API signing keys (RSA key pair, fingerprint), federation via SAML 2.0 identity provider, and OCI IAM Identity Domains for MFA, password policies, and app integrations.

Confidential application (client credentials flow) is used for service-to-service OAuth; public client (authorization code with PKCE) is used for user-facing apps; both issue tokens scoped to the requesting identity domain.

A VCN has non-overlapping CIDR blocks (IPv4 /16 to /30 per block, up to five blocks); subnets are regional or AD-specific and each subnet gets its own route table, security list, and optional NSG association.

Route table rules are longest-prefix-match on destination CIDR; a rule with destination 0.0.0.0/0 via an internet gateway gives public reachability, via a NAT gateway gives egress-only, via a service gateway gives private access to OCI services.

Internet gateway allows bidirectional traffic to public IPs; NAT gateway allows outbound-only initiated traffic; service gateway is used for OCI service endpoints (Object Storage, etc.) without traversing the internet.

Security lists are subnet-level stateful virtual firewalls applied to all VNICs in the subnet; NSGs are VNIC-level and stateful. Both must allow traffic for it to pass when both are in use.

A private subnet is one with no route to an internet gateway; a public subnet routes 0.0.0.0/0 to an internet gateway. Public IP assignment requires the subnet to be public (or a reserved public IP attached to a private-subnet VNIC with a NAT/IGW route).

DRG (Dynamic Routing Gateway) attaches a VCN to on-premises via IPSec VPN or FastConnect, and to other VCNs via remote peering or DRG v2 attachments; a hub VCN centralizes connectivity and route tables control transit.

FastConnect provides private dedicated connectivity (1 Gbps or 10 Gbps per port, private peering or public peering); a virtual circuit maps to a DRG attachment and can be redundant across two locations for SLA.

DNS: the VCN resolver forwards to internet or on-premises resolvers; private DNS zones resolve within the VCN; a private view is bound to a resolver and applies only to queries from that VCN.

Load balancer shapes: flexible shape sets min/max bandwidth; a public LB needs a public subnet, a private LB is internal-only; backend sets use health checks and session persistence (cookie or source IP).

Instance shapes: Standard (E-series, general purpose), DenseIO (local NVMe), GPU (A-series), HPC (HPC-series with RDMA cluster networking), and Arm-based Ampere A1 (flexible OCPU/memory).

Flexible shapes let you set OCPU count and memory independently within shape limits; OCPU is the unit for billing and for CPU quota, and 1 OCPU on x86 equals 2 vCPUs (1 hyper-thread per core).

Preemptible instances cost less but can be reclaimed; capacity is not guaranteed. They are suited to fault-tolerant batch work, not to stateful production tiers.

Boot volumes are block volumes attached at launch; instance metadata service (169.254.169.254) supplies user data, instance identity, and certificates for instance principals.

Instance lifecycle: PROVISIONING, RUNNING, STOPPING, STOPPED, STARTING, TERMINATING, TERMINATED. Stopping preserves the boot volume; terminating deletes it unless preserve-boot-volume is set.

Autoscaling uses instance pools with a configuration (shape, image, subnet, availability domain) and a policy: metric-based (CPU), schedule-based, or manual. Instance pools can span ADs for resilience.

Placement: availability domains are independent data centers within a region; fault domains are groups of hardware within an AD. A regional subnet plus multiple ADs gives AD-level fault tolerance.

Compute images: platform images (Oracle-maintained), custom images (from a running instance or imported), and boot volume clones. Image compatibility is tied to shape family and firmware.

Oracle Cloud Agent plugins (monitoring, management, vulnerability scanning, bastion) run on the instance and are managed from the console; the agent must be running for those features to report.

Object Storage: buckets are namespace-scoped (namespace is tenancy-wide), with storage tiers Standard, Infrequent Access, Archive, and Auto-Tiering. Tier changes are per-object or per-lifecycle rule.

Object Storage durability/redundancy: buckets are regional by default; Object Storage does not use AD-scoped replication in the same way as block volumes, but cross-region replication can be configured per bucket.

Block Volume: volumes are AD-scoped and attached to one instance at a time (or to multiple with the multi-attach-enabled flag for shared read/write on supported shapes); performance is set by VPUs/GB or by the balanced/higher-performance tiers.

Block volume performance: lower cost uses balanced; higher performance gives more IOPS/throughput per GB. Volume performance scales with size until the shape's max; a volume can be resized online.

Block Volume backups are incremental and stored in Object Storage; volume groups give crash-consistent multi-volume backups; cross-region copy of backups is supported.

File Storage: file systems are AD-scoped or regional; mount targets live in a subnet and export via NFSv3; a mount target has one IP per AD it serves, and clients mount using the mount target IP.

File Storage snapshots are point-in-time and space-efficient; clones create a new file system from a snapshot without copying data.

Object Storage lifecycle policies move or delete objects by age, name prefix, or tag; versioning keeps prior object versions; retention rules (compliance/hold) prevent deletion for a fixed period.

Storage comparison: Object Storage is HTTP/S3-compatible and internet-accessible via public bucket or pre-authenticated request; Block Volume is raw block for a single instance; File Storage is shared NFS for many instances.