OCI Operations Associate key terms

A grouping of hardware inside an availability domain that shares a single physical infrastructure unit. Spreading instances across fault domains reduces the chance that one hardware failure affects multiple resources simultaneously.

One or more isolated data centers within a region, each with independent power and network. Distributing workloads across availability domains supports high availability and protects against localized outages.

A geographic area containing one or more availability domains. Regions are the top-level location boundary for deploying and organizing cloud resources and for meeting data residency needs.

A logical collection of regions that share the same identity and access management boundary. Resources are generally not shared across realms, which separates commercial and government cloud environments.

The secure, isolated root compartment that an organization receives when it subscribes to the cloud. All compartments, users, policies, and resources are created inside a tenancy.

A logical container used to organize and isolate resources for access control and cost tracking. Policies grant permissions at the compartment level, and compartments can be nested.

The top-level compartment automatically created with a tenancy. It contains all other compartments and resources, and policies written here apply broadly across the tenancy.

A human-readable statement that grants groups permission to perform specific actions on resources in a compartment or tenancy. Policies are the core mechanism of authorization.

A group whose membership is defined by matching rules on resource attributes rather than manual assignment. It is commonly used to let instances or services call APIs without stored credentials.

An identity that lets a compute instance authenticate to cloud APIs automatically, based on its membership in a dynamic group. It removes the need to store user credentials on the instance.

A quota on how much of a given resource a tenancy can create in a region, such as the number of instances or total cores. Limits can be increased by requesting an adjustment.

A policy that lets administrators set their own enforced maximums on resource usage within a compartment, below the service limit. It helps prevent accidental over-provisioning.

A template that defines the resources allocated to a compute instance, including the number of CPUs, amount of memory, and whether it uses a fixed or flexible configuration.

A compute shape whose CPU and memory can be configured independently within allowed ranges. It allows right-sizing workloads instead of paying for fixed resource bundles.

A virtual or bare metal compute resource running an operating system image. Instances are launched into a subnet, attached to a shape, and managed through lifecycle states.

The storage volume that contains the operating system image and is attached to an instance at launch. It persists independently of the instance and can be preserved or replaced.

Network-attached persistent storage that can be attached to compute instances as additional disks. Volumes can be detached and reattached, resized, and backed up independently.

A software-defined network that hosts subnets, route tables, gateways, and security rules. It provides the networking foundation for all resources in a region.

A contiguous range of IP addresses within a virtual cloud network that resources are launched into. Subnets can be public or private and are bound to a single availability domain or the region.

A set of stateless ingress and egress rules applied at the subnet level to control traffic. Every resource in the subnet inherits these rules unless overridden by stricter controls.

A set of stateful firewall rules that can be applied to specific virtual network interface cards rather than whole subnets. It enables granular, per-resource traffic control.

A collection of rules that determine where network traffic is directed from a subnet. Each rule maps a destination CIDR to a target gateway or private endpoint.

A highly available gateway that enables communication between a virtual cloud network and the public internet. It requires public IP addresses and matching route and security rules.

A gateway that lets resources in a private subnet initiate outbound internet connections without exposing them to inbound traffic. Return traffic is allowed automatically.

A gateway that provides private access to supported cloud services without routing traffic over the public internet. It keeps service traffic inside the cloud network backbone.

A container for storing objects and their metadata in a flat namespace. Buckets have configurable storage tiers, visibility, and lifecycle rules for automatic data management.

A rule set that automatically transitions or deletes objects after defined time periods. It reduces storage cost by moving infrequently accessed data to cheaper tiers.

A time-limited URL that grants access to a specific object or bucket without requiring credentials. It is useful for sharing data with external parties securely.

A point-in-time copy of a block or boot volume stored independently of the source. Backups can be used to restore data or to create new volumes.

A fully managed database service that automates provisioning, tuning, patching, and scaling. It offers serverless and dedicated deployment options with built-in high availability.

A managed database deployment on virtual machines or bare metal that gives control over the operating system and database configuration. It supports options such as Data Guard and RAC.

A disaster recovery feature that maintains a synchronized standby database in another location. It enables failover and switchover with minimal data loss.

A managed service for creating and controlling encryption keys and secrets. It centralizes key lifecycle management and separates key custody from the data being protected.

The top-level key in a vault that protects data encryption keys. It is never exported in plaintext and can be rotated on a schedule.

An encrypted credential or configuration value stored in a vault and retrieved by applications at runtime. Using secrets avoids hard-coding sensitive data in code or images.

A time-series measurement emitted by a resource, such as CPU utilization or network throughput. Metrics feed dashboards, alarms, and autoscaling decisions.

A rule that watches a metric against a threshold and triggers a notification or action when breached. Alarms can publish to a topic or invoke a function.

A publish-subscribe channel that delivers messages to subscribed endpoints such as email, HTTPS, or functions. It is commonly the destination for alarm and event messages.

A rule that matches resource state-change events and routes them to a target such as a function or stream. It enables reactive automation without polling.

A query syntax used to select, aggregate, and transform metrics for charts and alarms. It supports grouping, interval statistics, and mathematical expressions.

A policy that automatically adjusts the number of instances in an instance pool based on metrics or a schedule. It helps match capacity to demand while controlling cost.

A group of identical compute instances managed together from a single configuration. Pools support scaling, rolling replacement, and even distribution across fault domains.

A small, serverless code unit that runs on demand in response to events or HTTP calls. Functions scale automatically and are billed by execution time and resources consumed.

A managed service that exposes backend services such as functions through a stable HTTP endpoint. It handles routing, authentication, rate limiting, and request transformation.

A spending threshold set on a compartment or cost-tracking tag that triggers alerts when actual or forecast costs exceed it. Budgets support proactive cost control.

A tag applied to resources so their consumption can be grouped and analyzed in cost reports. It enables chargeback and identification of unowned spending.

A reporting tool that visualizes usage and spending by service, compartment, or tag over time. It supports filtering, forecasting, and export of cost data.

The practice of defining and provisioning resources through machine-readable configuration files rather than manual console actions. It enables repeatable, version-controlled deployments.

A managed service that runs plans and applies against Terraform configurations. It tracks state, supports drift detection, and applies changes across compartments consistently.

A Resource Manager object that groups a Terraform configuration, its variables, and its state. Jobs such as plan, apply, and destroy run against a stack.

An immutable record of API calls made against tenancy resources, including who made the request and when. It supports security investigations and compliance reporting.

The practice of attaching key-value metadata to resources for organization, automation, and cost allocation. Defined tags are governed by namespaces and can enforce policy conditions.