OCI Developer Professional cheat sheet

OCI CLI authentication precedence: command-line flags override the profile selected by --profile, which overrides the OCI_CLI_PROFILE environment variable, which overrides the DEFAULT profile in ~/.oci/config; OCI_CLI_CONFIG_FILE relocates the config file itself.

Instance principals let code on a compute instance call OCI APIs with no keys in the config file: the SDK/CLI builds a request to the instance metadata service, signs it with the instance certificate, and exchanges it for a short-lived security token; the instance must be in a dynamic group with a matching policy.

Resource principals extend the same keyless model to Functions, OKE workloads, and other OCI resources; the dynamic group rule must match the resource type (for example instance.id, resource.compartment.id, or request.principal.type).

SDK retry defaults: OCI SDKs retry HTTP 429, 500, 502, 503, and 504 with exponential backoff plus jitter; configure via retry_configuration (max_attempts, retry_condition) on the client builder, and set a per-call timeout rather than relying on defaults for long operations.

Pagination: list operations return opaque page tokens; keep calling with the next_page value until it is null. Do not construct page tokens or assume stable ordering across pages.

Work Requests (GET /workRequests/{id}) track the progress of asynchronous control-plane operations such as launching an instance; the initial call returns 202 Accepted with the work request OCID in the opc-work-request-id header and a location header.

Compartment scoping: every resource has a compartment OCID; policies grant access by compartment, and tenancy-level resources (like IAM policies) live in the root compartment. SDK calls that omit compartment_id fail with a 400 for compartment-scoped list operations.

Object Storage parity: PutObject and GetObject use entity tags (ETags) for conditional writes; use if-match with the ETag to prevent lost updates, and multipart uploads (createMultipartUpload, uploadPart, commitMultipartUpload) for objects above roughly 100 MB.

OCI Vault secrets: fetch a secret bundle with getSecretBundle, which returns the base64-encoded content plus the version number; rotate by creating a new secret version and reading the latest by stage (CURRENT, PENDING, PREVIOUS).

Functions: a function is packaged as a Docker image pushed to OCIR; the function's memory setting determines CPU allocation (roughly 1 OCPU per 1 GB of memory), and the timeout is configurable up to the service maximum.

OCI Functions invocation: the Fn project CLI (fn invoke) targets the local Fn server, while OCI Functions uses the OCI CLI or SDK invokeFunction endpoint; function context is provided via the FN_* environment variables and the function's configuration map.

OCI Container Registry (OCIR): image references are formatted as .ocir.io//:; authentication uses an auth token as the password with the username / (or oracleidentitycloudservice/ for federated users).

API Gateway: routes map a path and HTTP method to a backend (HTTP, Functions, or Object Storage); request/response policies (authentication, rate limiting, CORS, header transformation) are attached per route, and deployments are versioned so you can roll back by redeploying a prior version.

Logging and Observability: the Logging service ingests custom logs through the unified monitoring agent or the PutLogs API; Service Connector Hub moves logs/objects between services (for example Logging to Object Storage) without custom code.

Notifications: publish to a topic with the PublishMessage API; subscriptions can be email, HTTPS, PagerDuty, Slack, or Functions, and delivery is at-least-once, so consumers must be idempotent.

Streaming: producers write records with PutMessages keyed by a partition key; consumers use a cursor (getMessages with a cursor) and commit offsets. Records in a stream are retained per the stream's retention setting (default 24 hours).