OCI Architect Associate cheat sheet

Policy syntax is: allow to in [where ]. The verb hierarchy, least to most privileged, is inspect, read, use, manage.

A policy attached to a compartment applies to that compartment and all of its child compartments, but never to its parent or siblings.

Compartments nest up to six levels below the tenancy root, and every resource belongs to exactly one compartment.

Dynamic group rules match attributes such as instance.compartment.id, instance.id, and resource tags, letting matching resources call OCI APIs without stored credentials.

Principal types include local users, federated users, instance principals, resource principals (Functions), and service principals, and each authenticates differently.

Federation with a SAML 2.0 identity provider maps IdP groups to OCI groups; password policy and MFA are then enforced by the identity provider.

Cross-tenancy access requires a policy in each tenancy that uses the endorse verb and references the other tenancy's OCID.

API signing keys authenticate a user to the OCI REST API, while auth tokens are used for Swift-compatible Object Storage and Container Registry access.

A tenancy administrator policy is typically 'allow group Admins to manage all-resources in tenancy', and manage implies inspect, read, and use.

A VCN uses IPv4 CIDR blocks between /16 and /30; blocks must not overlap with VCNs that need to communicate, and one VCN can hold multiple CIDR blocks.

A subnet is either regional (spanning all availability domains) or AD-specific, and it is public only when its route table sends 0.0.0.0/0 to an internet gateway.

Internet gateway allows inbound and outbound internet traffic; NAT gateway allows outbound only; service gateway reaches OCI services without internet; DRG connects to on-premises and remote VCNs.

Route tables choose the longest matching prefix; security lists apply at the subnet level and NSGs at the VNIC level, and both are stateful.

A VNIC can belong to up to five NSGs within its VCN, and NSG rules are evaluated independently of security list rules.

Local peering gateways connect VCNs in the same region; remote peering requires a DRG in each region and transit routing builds hub-and-spoke topologies.

Each site-to-site IPSec VPN connection is provisioned with two tunnels terminating on OCI VPN endpoints for redundancy.

Private DNS zones resolve inside a VCN, the Internet Resolver handles external names, and custom resolvers forward queries to on-premises DNS servers.

FastConnect or IPSec VPN terminates on a DRG, and DRG v2 supports transit routing between multiple VCNs and on-premises networks.

Flexible VM shapes let you choose OCPU count and memory independently within a per-shape range; one OCPU equals two x86 vCPUs.

Stopping an instance preserves its boot volume and stops OCPU billing while boot volume storage charges continue; terminating deletes the boot volume unless preservation is selected.

The instance metadata service at 169.254.169.254 provides user data for cloud-init plus instance OCID, region, and other identity details.

Instance configurations capture shape, image, metadata, and networking, and instance pools launch instances from them with manual or autoscaling policies.

Autoscaling policies can be metric-based (for example CPU utilization) or schedule-based and act on an instance pool.

Oracle Cloud Agent plugins supply monitoring, logging, OS management, vulnerability scanning, and bastion access, and are enabled per instance.

Bare metal instances run on dedicated hardware, while dedicated VM hosts isolate VM instances on hardware reserved for one tenancy.

Preemptible instances cost less but can be reclaimed when capacity is needed; reserved capacity guarantees capacity in a specific availability domain.

During infrastructure maintenance, VM instances are live-migrated, while bare metal instances are reboot-migrated.

Object Storage buckets are regional and replicated across availability domains in the region, and objects are encrypted at rest by default.

Object Storage tiers are Standard, Infrequent Access, and Archive; Archive is lowest cost and imposes a minimum retention period and retrieval delay.

Lifecycle policies move or delete objects by prefix, pattern, or age, while auto-tiering moves objects between Standard and Infrequent Access based on access.

Pre-authenticated requests grant time-limited access to a specific bucket or object without OCI credentials, scoped to read or write.

Block volume performance is chosen by VPU/GB tier: Lower Cost, Balanced (the default), Higher Performance, and Ultra High Performance.

A block volume attaches to one instance at a time unless it is a shareable volume, which requires a cluster-aware file system.

Volume groups back up several block or boot volumes together to produce a crash-consistent set, and backups can be full or incremental.

File Storage provides NFSv3 file systems mounted through a mount target in a subnet, with export options restricting source CIDR and permissions.

Local NVMe storage available on some shapes is ephemeral and is lost when the instance is stopped or terminated.

Autonomous Database is offered as Serverless (shared infrastructure) or Dedicated (Exadata infrastructure), each with public or private endpoints.

Autonomous Database takes automated backups retained for up to 60 days, and manual backups can be kept longer.

Autonomous Database scales compute (OCPUs or ECPUs) online without downtime and grows storage automatically as data is added.

ADB access control lists restrict connections to specified IP ranges or VCNs, and clients connect with TLS or mTLS using a downloaded wallet.

Base Database Service DB systems come in VM, bare metal, and Exadata variants and contain DB home and database resources with optional RAC.

Active Data Guard keeps a standby open read-only while redo is applied, offloading reporting from the primary database.

DB system backups are written to Object Storage, and automatic backups are configured per database with a retention policy.

Autonomous Data Guard provides a standby Autonomous Database in another region for cross-region disaster recovery.

Managed database options include Autonomous Database, Base Database Service, MySQL HeatWave, and NoSQL Database, each suited to different workload types.

All OCI data at rest is encrypted by default; customer-managed keys are supplied by Vault, which is backed by hardware security modules.

Vault stores encryption keys and secrets, supports key rotation, and lets applications retrieve secrets through the API when policy allows.

Cloud Guard uses detectors to identify misconfigured or risky resources and responder recipes to remediate or notify automatically.

Security zones attach a security-zone recipe to a compartment and block actions that would create noncompliant resources, such as public buckets.

WAF inspects HTTP traffic against OWASP-style attacks and attaches to a load balancer or edge, while Network Firewall filters VCN traffic at the packet level.

Bastion provides time-limited, audited SSH sessions to private instances without public IPs or self-managed jump hosts.

Vulnerability Scanning Service scans hosts agent-based or agentless and scans container images in Container Registry for known CVEs.

Audit records all API activity in a tenancy, keeps events visible for 90 days in the console, and can archive them to Object Storage for longer retention.

Budgets track actual and forecast spend for a compartment or tag and can fire alerts or trigger actions such as stopping instances.

Compartment quotas cap how much of a resource family a compartment can create, use the set verb, and require manage quota permission.

Freeform tags are simple key-value pairs, while defined tags belong to a tag namespace with a schema and can be used in policy conditions and cost tracking.

Tag defaults automatically apply a defined tag to resources created in a compartment, and security zones can require specific tag values.

Cost-tracking tags must be activated before their spend appears in cost analysis, budgets, and cost reports.

Cloud Advisor generates recommendations for cost, security, performance, and availability, each with an estimated impact and effort.

Limits are tenancy-wide maximums for a resource family, and quotas partition those limits among compartments.

OCI Organizations links child tenancies to a parent tenancy for consolidated billing and centralized governance.

Monitoring ingests metrics at one-minute resolution by default, and an alarm evaluates a metric statistic against a threshold over a chosen interval and window.

An alarm transitions between OK and FIRING and publishes to a Notifications topic, whose subscriptions include email, HTTPS, PagerDuty, Slack, and Functions.

The Monitoring agent plugin on an instance publishes custom and OS metrics; without it only hypervisor-level metrics are visible.

Logging collects audit logs, service logs, and custom logs into log groups that can be searched or routed to Object Storage or Streaming.

Service Connector Hub moves data between services, for example sending logs or metrics to Object Storage or a stream.

APM provides distributed tracing and synthetic monitoring, using an APM agent to instrument application code.

Health Checks probe endpoints from multiple vantage points and can update DNS records to fail traffic over.

Dashboards visualize metrics and are compartment-scoped resources shared through IAM policies.

Availability domains are isolated data centers within a region, each containing three fault domains, and a region has one or more availability domains.

High availability designs spread instances across availability domains, while single-AD workloads use fault domains to survive hardware failure.

DR patterns ordered by increasing cost and decreasing RTO are backup and restore, pilot light, warm standby, and active-active multi-region.

FastConnect offers private dedicated or partner-hosted links up to 100 Gbps per virtual circuit, while IPSec VPN runs over the public internet.

A DRG attaches to a VCN and terminates FastConnect and IPSec VPN; DRG v2 supports transit routing among VCNs and on-premises networks.

Oracle Cloud Migrations discovers on-premises assets and replicates them into OCI as compute instances.

Zero Downtime Migration and GoldenGate move databases with minimal downtime, with GoldenGate replicating ongoing changes after the initial load.

Data Transfer appliances copy very large datasets offline when network transfer would take too long, and Object Storage also supports offline import.

OCI Well-Architected pillars are security and compliance, reliability, performance, cost optimization, and operational excellence.