OCI Operations Associate: Oracle Cloud Infrastructure Operations

Oracle Cloud Infrastructure Operations

This domain tests how you structure and govern an OCI tenancy: compartments, IAM policies, tagging, regions, and operational tooling for day-to-day administration.

Core rules

• A tenancy is the root compartment. Every resource belongs to exactly one compartment, and compartments can nest. A policy written at a compartment applies to that compartment and its children; in tenancy targets the root and everything under it.
• Policy verbs matter: inspect (list), read (get), use (act on an existing resource), and manage (full create/update/delete). allow group Ops to manage instances in compartment Prod is broader than use instances.
• Tags come in two flavors: freeform tags (simple key/value, no governance) and defined tags (namespaces with a schema and optional tag defaults). Cost-tracking requires a defined tag key enabled for cost tracking.
• Regions and availability domains shape resource scope: VCNs and buckets are regional; block volumes are AD-specific.

Worked example

A team must launch and resize compute instances but only read block volumes in Prod. Create the group, add users, then write: allow group AppOps to manage instances in compartment Prod allow group AppOps to read volumes in compartment Prod The second statement does not grant manage, so the team cannot delete volumes. If they must attach volumes, add use volumes; attaching needs use on the volume plus permission to update the instance.

Traps

• Assuming manage in a parent compartment covers a sibling compartment; it does not.
• Confusing read with use: use is needed for actions such as attaching a volume or using a key.
• Using freeform tags for cost allocation; only defined tags enabled for cost tracking appear in cost reports.
• Treating AD-specific resources such as block volumes as regional.