Oracle Cloud AR key terms

An isolated, fault-independent data center group inside an OCI region, with its own power and network. Distributing resources across ADs protects workloads from a single-site failure.

A grouping of hardware within a single availability domain. Placing instances in different fault domains reduces the chance that one hardware failure affects multiple instances.

A geographic area containing one or more availability domains. Choosing a region affects latency, data residency, service availability, and disaster-recovery options.

A compartment-level policy that enforces maximum-security settings, such as blocking public buckets or requiring encryption. Resources created inside must comply or creation fails.

A managed OCI service for creating and storing encryption keys and secrets. Keys can be hardware-backed, rotated, and used by other services through policies.

An encryption key the customer creates and controls in a vault, rather than one managed by Oracle. It enables key rotation and revocation, and key deletion makes data unreadable.

Protecting stored data by encrypting it on disk, using either Oracle-managed or customer-managed keys. It limits exposure if physical media or backups are compromised.

A service that inspects inbound HTTP traffic and blocks malicious patterns such as SQL injection or cross-site scripting. It can also enforce access rules and rate limits.

A set of security rules applied to a group of VNICs rather than a subnet. It lets you isolate tiers within one subnet and reference rules by NSG instead of IP ranges.

A set of stateless firewall rules attached to a subnet and applied to all VNICs in it. Rules are evaluated by source, destination, protocol, and port.

A private, software-defined network in a region, with its own CIDR block, subnets, route tables, and gateways. It is the foundation for most OCI networking.

A contiguous range of IP addresses inside a VCN, tied to one availability domain and marked public or private. Instances and other resources are launched into subnets.

A gateway that gives resources with public IP addresses bidirectional access to the internet. Without a route to it, a public subnet still cannot reach the internet.

A gateway that lets private-subnet resources initiate outbound internet connections while preventing unsolicited inbound traffic. It requires a route rule and no public IP.

A gateway that provides private access to supported OCI services, such as object storage, without traversing the internet. It works with service CIDR labels in route rules.

A virtual router that connects a VCN to on-premises networks, other VCNs, or a remote peering. It anchors FastConnect, site-to-site VPN, and VCN peering attachments.

A component that connects two VCNs in the same region over private addresses. Peering is not transitive, so each connected pair needs its own LPG and route rules.

A dedicated private network connection between an on-premises location and an OCI region. It offers predictable latency and higher bandwidth than internet-based VPN.

An encrypted IPsec tunnel over the public internet linking an on-premises network to a VCN through a DRG. It is cheaper than dedicated circuits but less predictable.

A per-subnet set of rules that decides where traffic for a destination CIDR is sent, such as to a gateway or peering. It is separate from security rules.

A compute shape whose OCPU count and memory can be chosen independently within limits. It allows right-sizing instances instead of picking fixed predefined shapes.

An instance shape that runs at a baseline CPU level and can burst above it using accumulated credits. It suits low-average, occasionally spiky workloads.

A virtual or bare metal compute resource launched in a subnet from an image. Its shape, image, and networking determine performance and connectivity.

An identity mechanism that lets an instance call OCI APIs without storing credentials, based on dynamic group membership. It removes secrets from application code.

A logical container used to organize and isolate resources for access control, quotas, and cost tracking. Policies and budgets are typically scoped to compartments.

The root compartment and account that owns all OCI resources for an organization. It holds the identity domain, administrators, and top-level policies.

A human-readable statement granting a group access to a resource type in a compartment, such as allow group Admins to manage instances. Policies are additive.

A group whose members are defined by matching rules on resource attributes, such as compartment or tag. It is commonly used to grant instances or functions API access.

A container for users, groups, and authentication settings within a tenancy. It supports federation, MFA, and separate identity stores for different user populations.

Trusting an external identity provider, such as Microsoft Entra ID or Okta, to authenticate users into OCI. It enables single sign-on and central user lifecycle management.

A key-value label attached to resources for organization, automation, or cost allocation. Defined tags use namespaces and can enforce values; freeform tags do not.

A spending threshold set on a compartment or tenancy that triggers alerts when forecast or actual cost crosses it. It supports cost governance but does not stop spending.

A reporting tool that breaks down spending by compartment, tag, service, or time period. It helps identify expensive resources and validate chargeback models.

A self-driving managed database that automates patching, tuning, scaling, and backups. It comes in serverless and dedicated deployments with workload options.

An Autonomous Database workload optimized for analytics and large scans. It uses columnar storage and automatic indexing rather than transaction-heavy tuning.

A managed virtual machine or bare metal host running Oracle Database, where you control the database and host configuration. It suits workloads needing full administrative control.

A container for objects in Object Storage, with a storage tier and optional versioning or lifecycle rules. Access is controlled by IAM policies and pre-authenticated requests.

A rule that automatically moves or deletes objects or backups after a set time. It reduces storage cost by transitioning infrequently accessed data to cheaper tiers.

A point-in-time copy of data or configuration stored separately from the source. Backups support recovery from corruption or deletion and should be tested regularly.

Copying data or backups to a bucket in another region automatically. It supports disaster recovery when an entire region becomes unavailable.

A time-series measurement emitted by OCI resources, such as CPU utilization or latency. Metrics feed alarms and dashboards for operational visibility.

A rule that watches a metric and triggers a notification or action when a threshold is breached. Alarms can publish to a topic or invoke a function.

A service that collects, stores, and searches logs from OCI resources and applications. Logs support auditing, troubleshooting, and security investigation.

A service that records API calls made against tenancy resources, including who made them and when. It is central to compliance and incident investigation.

A managed service that distributes traffic across backend servers using listeners and health checks. It can be public or private and supports flexible bandwidth shapes.

A publish-subscribe channel that delivers messages to subscribers such as email or functions. It is commonly the action target for alarms and events.