OCI Architect Associate key terms

The top-level OCI account and root compartment that holds all of an organization's resources, users, policies, and billing, created when the account is signed up.

A logical container within a tenancy used to group and isolate resources so that IAM policies, quotas, and cost tracking can be scoped to a manageable boundary.

A human-readable IAM rule granting a group permission to perform actions on a resource type within a compartment or tenancy, for example allowing a group to manage instances.

An IAM group whose members are chosen by matching rules on resource attributes rather than by explicit user membership, enabling instances and services to be authorized automatically.

An authorization model that lets a compute instance call OCI APIs using its own identity, obtained from instance metadata, instead of a user's API signing key.

A container inside OCI IAM that holds users, groups, and sign-on settings; a tenancy has a default domain and can have additional ones for separate user populations.

Configuration that lets users authenticate to OCI through an external identity provider using SAML 2.0 or OIDC, with external group claims mapped to OCI groups for authorization.

A tag created by an administrator inside a namespace with a defined schema, used for cost tracking, conditional policies, and automation; values can be validated against allowed lists.

A spending threshold set on a compartment or tenancy that sends alerts, and optionally triggers actions, when actual or forecast costs exceed configured amounts.

A governance rule that limits how much of a resource family, such as OCPUs or block volume storage, can be created in a compartment, helping prevent runaway consumption.

A software-defined private network scoped to one OCI region, with its own CIDR blocks, subnets, route tables, and gateways that together define how resources communicate.

A contiguous IP address range inside a VCN, either public or private, to which instances and other resources are attached; security lists apply at this level.

A VCN gateway that allows traffic between public subnets and the internet; it requires a matching route rule and a public IP address on the resource.

A VCN gateway that lets resources in private subnets start outbound connections to the internet while blocking unsolicited inbound traffic, so no public IP is needed.

A VCN gateway that provides private access to supported Oracle services such as Object Storage, keeping that traffic off the internet and off the NAT gateway.

A virtual router that connects a VCN to on-premises networks through FastConnect or Site-to-Site VPN, and to other VCNs through remote peering.

A named set of security rules applied to selected VNICs instead of an entire subnet, giving instance-level control that follows a resource across subnets.

A set of stateless ingress and egress rules attached to a subnet that filter traffic for every VNIC in it; both request and response rules must be defined explicitly.

A dedicated private network connection between an on-premises location and OCI, offering higher, more predictable bandwidth and lower latency than an internet-based VPN.

A template describing the OCPUs, memory, and network bandwidth of a compute instance; flexible shapes let you pick OCPU and memory values within a range.

A reusable template capturing an instance's shape, image, metadata, and networking settings, used by instance pools to launch identical compute instances.

A policy that automatically adds or removes instances in an instance pool based on a metric threshold or a schedule, matching capacity to demand.

A container for objects in Object Storage with a regionally unique name, a default storage tier, and settings for versioning, lifecycle rules, and access.

A URL with an expiration and scope that grants temporary access to a bucket or object without OCI credentials, useful for sharing content with external users.

A set of rules that automatically archives, moves, or deletes stored data after a defined age, reducing cost without manual intervention.

A network-attached virtual disk for compute instances, offering performance tiers, backups, clones, and replication to another region or availability domain.

A fully managed Oracle database, serverless or dedicated, that patches, tunes, scales, and backs itself up automatically, with workload options tuned for transactions or analytics.

Oracle replication that keeps a synchronized standby copy of a database in another location for disaster recovery, and can serve read-only queries in some configurations.

A managed key and secret store that protects encryption keys in hardware security modules and supports rotation, with access controlled by IAM policies.

A compartment-level guardrail that enforces a maximum-security policy, such as blocking public buckets or unencrypted volumes, and denies actions that would violate it.

A posture management service that uses detectors and recipes to find risky or misconfigured resources, reports them as problems, and can remediate automatically through responders.

Metrics are time-series measurements published by OCI resources; alarms watch a metric against a threshold and send notifications or trigger actions when it is breached.

An isolated data center group within a region with independent power and networking; spreading resources across several of them protects workloads from a single-site failure.

A grouping of hardware within an availability domain; placing instances in different fault domains reduces the chance that one hardware failure affects the whole application.

Oracle's set of design guidance organized into pillars such as security, reliability, performance, cost, and operational excellence, used to review and improve cloud architectures.