OCI Foundations Associate cheat sheet

IaaS provides compute, storage, and networking; PaaS adds managed runtimes and middleware; SaaS delivers complete applications over the internet.

An OCI region contains one or more availability domains; an availability domain contains one or more fault domains with independent power and network.

Fault domains group hardware within an availability domain to limit the impact of a single hardware failure.

RTO is the maximum acceptable downtime after a failure; RPO is the maximum acceptable data loss, both measured in time.

99.9% availability allows about 8.76 hours of downtime per year; 99.99% allows about 52.6 minutes.

The shared responsibility model assigns physical infrastructure security to the provider and data, identity, and configuration security to the customer.

Elasticity scales resources out or in with demand; horizontal scaling adds instances, vertical scaling changes shape size.

CapEx buys capacity up front; the cloud OpEx model bills consumption over time.

The tenancy is the root compartment; every OCI resource resides in exactly one compartment.

Compartments can be nested up to six levels deep, and policies attached to a parent apply to child compartments.

The home region is chosen at sign-up, hosts IAM, and cannot be changed; other regions can be subscribed later.

An OCID is an Oracle-assigned unique identifier for every OCI resource.

Management interfaces include the Console, CLI, SDKs, REST APIs, Terraform, and browser-based Cloud Shell.

Free Tier combines Always Free resources with a time-limited Free Trial credit balance.

Tags are freeform or defined; defined tags use namespaces and are validated against a schema.

Budgets set spending thresholds and can trigger alerts or automated actions.

Compute shapes are virtual machine, bare metal, or dedicated host; flexible shapes let you choose OCPUs and memory independently.

Preemptible instances cost less but can be terminated by OCI when capacity is reclaimed.

Block volumes are network-attached and persist independently of the instance; volume performance is set by VPUs per GB.

Object Storage uses buckets and objects with a flat namespace and offers Standard, Infrequent Access, and Archive tiers.

File Storage provides shared NFS file systems through mount targets in a subnet.

A VCN is regional and contains subnets that can be regional or availability-domain specific.

Internet gateway enables inbound and outbound public traffic; NAT gateway enables outbound-only private traffic; service gateway reaches OCI services privately; DRG connects on-premises or remote VCNs.

Security lists filter traffic at the subnet level; network security groups filter at the VNIC level; both are stateful.

A load balancer distributes traffic across backend sets and supports flexible minimum and maximum bandwidth.

Autonomous Database offers Transaction Processing (ATP) and Data Warehouse (ADW) workloads with automatic patching, tuning, and backups.

Autonomous Database is available as serverless or dedicated infrastructure and supports auto scaling of compute.

Autonomous Data Guard maintains a standby in another availability domain or region for disaster recovery.

A DB system runs on VM or bare metal shapes and requires the customer to manage OS and database patching.

Exadata Database Service provides scale-out compute with smart storage for the highest-performance workloads.

MySQL HeatWave combines MySQL with an in-memory analytics engine; NoSQL Database handles key-value workloads.

GoldenGate replicates data for migration and continuous availability between databases.

Data Safe provides database security assessment, auditing, masking, and sensitive data discovery.

Data at rest is encrypted by default with AES-256; data in transit is protected with TLS.

OCI Vault stores customer-managed keys and secrets, backed by FIPS 140-2 Level 3 hardware security modules.

Cloud Guard detects misconfigurations and threats across the tenancy and can trigger responder recipes.

Security zones deny actions that violate a security baseline, such as creating a public object storage bucket.

A bastion provides time-limited, audited SSH sessions to private instances without public IPs.

The Audit service records API activity in the tenancy, and log retention is configurable.

WAF filters malicious web traffic; DDoS protection is included at the edge.

MFA can be enforced for local users; federation delegates authentication to an external identity provider.

Policy syntax: Allow to in [where ].

Verbs increase in scope: inspect < read < use < manage; manage includes all permissions.

Policies attached to the tenancy apply to all compartments; policies attached to a compartment apply to it and its children.

Subjects are groups, dynamic groups, users, or service principals; users receive access through group membership.

A dynamic group matches instances by rule and grants instance principals access to OCI APIs.

Authentication proves identity; authorization is decided by IAM policies.

Federation uses SAML 2.0 with an external identity provider, and SCIM can synchronize users and groups.

Compartments isolate resources; a resource belongs to exactly one compartment and can be moved between them.

Compute and most resources are billed per second with a one-minute minimum; some services bill hourly or monthly.

Pricing models include Pay As You Go, Universal Credits (prepaid commitment with discount), and monthly invoicing.

Cost Estimator projects spend before deployment; Cost Analysis reports actual spend by compartment, tag, or service.

Budgets track spending against thresholds and can alert or stop resources.

Inbound data transfer is free; outbound internet data transfer is charged, with 10 TB per month included in Always Free.

Support levels are Basic (free, billing and account help only), Developer, Business, and Premier; paid tiers include technical support.

Business support provides 24/7 technical support with a one-hour response target for severity 1; Premier provides a 15-minute target.

Always Free resources include two AMD compute VMs, up to 4 OCPU and 24 GB Ampere A1, 200 GB block storage, and an Always Free Autonomous Database.