OCI Architect Professional key terms

A tenancy-level group whose membership is defined by matching rules on resource attributes rather than by manual user assignment. It lets OCI services such as compute instances or functions authenticate as principals without stored credentials.

An IAM feature that lets a compute instance call OCI APIs using certificates issued by the instance metadata service. Authorization is granted through dynamic group membership and policies, removing the need for user credentials on the host.

A signed, short-lived identity that lets serverless resources such as Functions or Data Flow runs call OCI APIs. The resource is placed in a dynamic group, and policies then authorize the calls.

A logical container used to organize and isolate OCI resources for access control, quota, and cost tracking. Policies are usually written against compartments, and resources inherit access from the compartment hierarchy.

The root compartment that represents an entire OCI customer account. It holds the top-level administrators, global service limits, and the root of the compartment hierarchy.

A rule written in OCI's human-readable policy language that grants a group or dynamic group permission to act on a resource family in a compartment. It combines subject, verb, resource-type, and location.

An optional clause attached to a policy statement that narrows when the statement applies, using variables such as request time, source IP, or resource tags. Conditions reduce over-broad grants without splitting compartments.

An Identity and Access Management container that holds users, groups, and identity-provider configuration for a set of applications. Multiple identity domains let one tenancy serve separate populations with independent sign-in settings.

Trust configured between OCI IAM and an external identity provider so users sign in with corporate credentials and receive OCI access through mapped groups. It is typically implemented with SAML or OIDC.

Automated synchronization of users and groups from an external identity provider into OCI IAM using the SCIM standard. It keeps membership current so policy grants follow joiners, movers, and leavers without manual work.

A tag namespace and key that an administrator creates centrally and can mark as required or cost-tracking. Defined tags support governance, policy conditions, and cost allocation across compartments.

A simple key-value tag that any user with write access to a resource can apply, with no central namespace or validation. It is convenient for ad hoc labeling but weaker for governance than defined tags.

The software-defined network boundary for OCI resources, containing subnets, route tables, gateways, and security rules. Resources in different VCNs communicate only through configured gateways, peering, or private access paths.

A contiguous CIDR range within a VCN that scopes where resources receive addresses. It can be public or private and can be regional or tied to a single availability domain.

A set of stateless ingress and egress rules applied at the subnet level to all resources in that subnet. Because it is stateless, return traffic must be explicitly allowed by a matching rule.

A stateful virtual firewall applied to selected VNICs rather than to a whole subnet. Return traffic for allowed flows is automatically permitted, making it the preferred control for tiered applications.

An ordered set of rules that decides where traffic leaving a subnet is sent, based on destination CIDR. Each rule points to a target such as an internet gateway, NAT gateway, or service gateway.

A highly available VCN component that gives resources with public IP addresses inbound and outbound connectivity to the internet. It requires matching route table and security rule entries to work.

A VCN component that allows instances in a private subnet to initiate outbound internet connections without exposing them to inbound traffic. Return traffic is statefully allowed back to the originating instance.

A VCN gateway that provides private access to supported OCI services such as Object Storage without crossing the internet. Traffic stays on the Oracle network when routes and policies allow it.

A private IP address in a subnet that exposes a managed service or a customer service through the VCN. It keeps traffic off public networks and can be reached from on-premises over private connectivity.

A dedicated private network connection between an on-premises location and an OCI region, delivered through a partner or colocation. It offers predictable latency and bypasses the public internet.

An IPsec tunnel over the internet that connects an on-premises network to a VCN through a dynamic routing gateway. It is quick to deploy but depends on internet quality for latency and throughput.

A virtual router that attaches to a VCN and provides the attachment point for FastConnect, site-to-site VPN, and remote peering. Route tables and attachments determine which paths are usable.

A connection between dynamic routing gateways in different regions that lets VCNs communicate privately across regions. It requires matching route rules and non-overlapping CIDR ranges.

A VCN component used to peer two VCNs in the same region so resources can communicate over private addresses. Peering is not transitive, so each desired path needs its own peering and routes.

A virtual network interface card attached to a compute instance that carries its private IP addresses and security group membership. An instance can have multiple VNICs for separation of traffic.

An isolated data center group within a region that has independent power and network infrastructure. Distributing resources across availability domains protects workloads from a single facility failure.

A grouping of hardware within a single availability domain that shares no single point of failure with other fault domains. Placing instances in different fault domains reduces correlated outages.

A template that defines the CPU, memory, and optional GPU or network characteristics of a compute instance. Shapes are grouped as standard, flexible, dense I/O, GPU, and specialized families.

A shape whose OCPU count and memory can be chosen independently within allowed limits. It lets teams right-size instances and change resources later without switching to a different shape family.

A saved template of instance settings such as shape, image, subnet, and metadata that can be reused to launch instances or drive an instance pool. It keeps deployments consistent and repeatable.

A managed group of identical compute instances that can scale automatically based on metrics or a schedule. The service replaces unhealthy members and spreads them across fault domains.

The block storage volume that holds an instance's operating system and is attached when the instance launches. It persists independently of the instance lifecycle unless explicitly deleted.

Network-attached durable storage that can be attached to a compute instance as a disk. It supports resizing, cloning, and replication across availability domains for durability and migration.

A storage class for object data with different cost and retrieval characteristics, such as standard, infrequent access, archive, and deep archive. Lifecycle rules can move objects between tiers automatically.

A rule set that automatically transitions or deletes objects and volumes when age or other criteria are met. It reduces manual cleanup and keeps storage spending aligned with data value.

A time-limited URL that grants access to a specific Object Storage object or bucket without requiring OCI credentials. It is useful for sharing with external parties but must be scoped and expired carefully.

A shared, hierarchical storage service that many compute instances can mount at once over NFS. It suits workloads needing a common directory with POSIX semantics rather than object APIs.

The network endpoint in a subnet through which clients mount a file system over NFS. Its subnet and security rules determine which instances can reach the share.