OCI Operations Associate cheat sheet

Compartments form a tenancy-wide hierarchy; policies attached to a compartment inherit downward, never upward, so place broad grants high and least-privilege grants low.

Policy verb ladder: inspect (list resources) < read (get individual resources) < use (work with existing resources) < manage (create/update/delete). Each higher verb includes all lower ones.

A policy statement syntax is: Allow to in where . Subject may be group, dynamic-group, or service.

Dynamic groups match principals by matching rules on instance or resource attributes; they are required for instance principals and for services acting on your behalf.

Identity domains: the default domain holds IAM users/groups; federation with an external IdP uses SAML 2.0, and SCIM provisioning keeps users/groups synchronized.

Region and availability domain (AD) are fault domains: a region contains one or more ADs, and each AD has independent power, cooling, and network; fault domains subdivide an AD.

Resource tagging: freeform tags are untyped key/value pairs; defined tags use namespaces and tag defaults, and can be enforced with a tag default plus policy condition.

Service limits and quotas are per-tenancy, per-region; check the Limits, Quotas and Usage page before scaling, and request limit increases ahead of planned growth.

Audit service retains events per tenancy; search by compartment, time range, and principal, and export to Object Storage for long-term retention beyond the console window.

Compute shapes: flexible shapes let you set OCPUs and memory independently within a range; fixed shapes have preset OCPU/memory ratios and cannot be resized arbitrarily.

Boot volume replacement preserves the instance OCID and private IP; terminating an instance can optionally preserve the boot volume, which is the safe default for recovery.

Instance metadata service is reachable at 169.254.169.254; instance principals use it to obtain short-lived certificates for calling OCI APIs without stored keys.

VNIC and IP: a primary VNIC holds the primary private IP; secondary private IPs and secondary VNICs let one instance host multiple addresses; public IPs are either ephemeral or reserved.

Security lists apply at the subnet level and are stateful; network security groups (NSGs) apply at the VNIC level and are also stateful. Use NSGs for granular, per-workload rules.

Route tables choose the next hop per CIDR; a route to an internet gateway enables public traffic, a NAT gateway enables outbound-only, and a service gateway reaches OCI services privately.

Load balancer shapes: flexible shapes set minimum/maximum bandwidth; listeners define protocol/port, backend sets define health checks, and the LB spans ADs for high availability.

VCN peering: local peering connects VCNs in the same region; remote peering connects across regions via DRG. Peered VCNs must not have overlapping CIDR ranges.

Block volume performance is set by VPUs/GB: Lower Cost, Balanced, Higher Performance, and Ultra High Performance tiers scale IOPS and throughput per GB attached.

Object Storage tiers: Standard, Infrequent Access, Archive, and tiered lifecycle rules move objects automatically; Archive has retrieval latency and minimum storage duration.

Block volume backups are incremental after the first full backup; volume groups take crash-consistent backups of multiple volumes together.

File Storage uses mount targets inside a subnet; NFS export options control client source CIDR and read/write access per export.

Autonomous Database: serverless vs dedicated infrastructure; auto-scaling scales OCPUs up to 3x; Autonomous Data Guard provides standby for cross-region or same-region failover.

DB systems (VM/BM) use Data Guard for standby; backups go to Object Storage and support point-in-time recovery within the retention window.

Vault service: master encryption keys (MEKs) and data encryption keys (DEKs); keys are software- or HSM-protected, and rotation creates a new key version while old versions decrypt.

Key policies and key version retirement matter: disabling a key blocks decryption; schedule deletion with a waiting period because deletion is irreversible.

Metrics are namespace-scoped (for example oci_computeagent); alarms evaluate a metric against a threshold over a window and fire notifications via the Notifications service topics.

Alarm states: OK, FIRING, and RESET; a Muting rule suppresses notifications during maintenance windows without deleting the alarm.

Logging: service logs capture control-plane events; custom logs ingest application output via the Unified Monitoring Agent; log groups organize retention.

Events service rules match on event type and attributes, then trigger actions such as Functions, Notifications, or Streaming - the basis for event-driven automation.

Resource Manager (Terraform) stacks store state; plans show drift, applies reconcile state; use it for repeatable, version-controlled infrastructure.

Cost analysis: budgets set spending thresholds with alert rules at percentages; cost-tracking tags (defined tags with cost-tracking enabled) attribute spend by workload.

FinOps levers: right-size flexible shapes, use autoscaling, stop idle instances, move cold data to Archive, and use reserved capacity or annual commitments for steady load.

Usage reports in Object Storage give per-resource, per-tag cost detail; join them with cost-tracking tags to build chargeback reports.