OCI Developer Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Instance principal authentication

A keyless OCI authentication method where a compute instance proves its identity to the metadata service and exchanges a signed request for a short-lived token, authorized through a dynamic group and IAM policy.

Resource principal authentication

A keyless OCI authentication method for OCI-managed resources such as Functions and OKE workloads; the resource is authorized via a dynamic group rule matching its type and compartment.

OCI CLI config precedence

Command-line flags override --profile, which overrides OCI_CLI_PROFILE, which overrides the DEFAULT profile in ~/.oci/config; OCI_CLI_CONFIG_FILE changes the config file location.

SDK retry conditions

OCI SDKs retry HTTP 429, 500, 502, 503, and 504 responses with exponential backoff and jitter; tune behavior with retry_configuration max_attempts and retry_condition on the client.

List pagination tokens

OCI list operations return an opaque next_page value; callers repeat the request with that token until it is null, and must not construct or interpret tokens themselves.

Work request tracking

Asynchronous control-plane operations return 202 Accepted with a work request OCID; poll GET /workRequests/{id} to observe status, percent complete, and any error details.

Compartment scoping rule

Most OCI resources belong to a compartment identified by an OCID; IAM policies grant access per compartment, and list calls missing compartment_id return HTTP 400 for compartment-scoped resources.

Object Storage conditional writes

PutObject supports if-match with an object's ETag to prevent lost updates; mismatched ETags cause the write to fail, so concurrent writers must re-read before retrying.

Multipart upload flow

Large objects are uploaded via createMultipartUpload, repeated uploadPart calls, then commitMultipartUpload; abortMultipartUpload discards parts, and incomplete uploads consume storage until aborted.

Vault secret bundle retrieval

getSecretBundle returns base64-encoded secret content with a version number; rotation adds a new version, and reads can select a stage such as CURRENT, PENDING, or PREVIOUS.

Functions memory to CPU ratio

In OCI Functions, the configured memory determines CPU allocation, roughly one OCPU per gigabyte of memory; timeout and memory are set per function and bounded by service limits.

Functions invocation context

A running function receives invocation metadata through FN_* environment variables and its configuration map; the handler reads the input stream and writes the response to stdout.

OCIR image reference format

OCI Container Registry image references use <region-key>.ocir.io/<tenancy-namespace>/<repository>:<tag>; the region key differs from the full region identifier, so copy it from the console.

OCIR authentication token

Pushing to OCIR uses an OCI auth token as the password; the username is <tenancy-namespace>/<user-email>, or oracleidentitycloudservice/<email> for federated identity users.

API Gateway route specification

An API Gateway route binds a path and HTTP method to a backend such as an HTTP endpoint, Function, or Object Storage bucket, with per-route policies for authentication, rate limiting, and transformation.

API Gateway deployment versioning

Deployments are immutable snapshots of an API Gateway specification; creating a new deployment activates it, and redeploying a prior version rolls back routing and policy changes.

Service Connector Hub

A serverless data-movement service that reads from a source such as Logging or Object Storage and writes to a target, optionally applying a filter, without custom integration code.

Custom logs ingestion

The Logging service accepts custom log records through the unified monitoring agent on compute instances or directly via the PutLogs API, grouped under a log and log group.

Notifications delivery semantics

Publishing to an OCI Notifications topic delivers to all subscriptions with at-least-once semantics; duplicate deliveries are possible, so subscribers should process messages idempotently.

Streaming cursor consumption

Consumers read OCI Streaming records with getMessages using a cursor tied to a partition; they commit offsets after processing, and uncommitted records can be re-read within retention.

Streaming partition keys

Producers supply a partition key when publishing; records with the same key land in the same partition, preserving per-key order while allowing parallel consumption across partitions.

Dynamic group matching rules

Dynamic groups contain resources whose matching rules reference attributes like instance.id, resource.compartment.id, or request.principal.type; only matching resources receive the group's policies.

IAM policy statement syntax

Policies use Allow <subject> to <verb> <resource-type> in <location> where <condition>; subjects are groups or dynamic groups, and location is a compartment or tenancy.

Functions Docker image packaging

A function is built into a Docker image and pushed to OCIR; the function definition references that image, and updating the image requires updating the function to pick it up.

OCI SDK client configuration

Clients are built from a ConfigFile or Config object holding tenancy, user, fingerprint, key file, and region; the region determines the service endpoint unless an endpoint is overridden.

API signing key fingerprint

Requests are signed with the user's private API key; the corresponding public key is uploaded to IAM and identified by a fingerprint recorded in the CLI config file.

Instance metadata service

A link-local HTTP endpoint on compute instances that exposes instance identity and certificates; instance principal libraries use it to obtain short-lived tokens without stored credentials.

Functions configuration map

Key-value settings attached to a function or application and exposed to the handler as environment variables; changing them does not require rebuilding the container image.

Object versioning

When enabled on a bucket, overwrites and deletes create new object versions instead of destroying data; reads default to the latest version, and specific versions can be fetched or restored.

Pre-authenticated request

A PAR grants time-limited access to an Object Storage object or bucket through a generated URL; it can be object-scoped, bucket-scoped, or used for write access without OCI credentials.

Resource tagging for cost tracking

Freeform and defined tags applied to resources are used by cost reports and IAM policy conditions; defined tags come from namespaces and support validation against allowed values.

Health check endpoint pattern

A lightweight endpoint returning success when dependencies like database or Vault access are reachable; load balancers and OKE probes use it to decide whether to route traffic.