Oracle Cloud Infrastructure (OCI) — Architect Associate Study Notes

Scope: These notes are based on the OCI Architect Certificate Examination.

Core Terminology and Definitions
Data Warehouse Concepts
Transparent Data Encryption (TDE)
Getting Started with OCI
OCI Compute Services
OCI Storage Services
Identity and Access Management (IAM)
OCI Database Services
OCI Security
Pricing and Billing
Advanced Compute — Professional Level
Advanced Storage — Professional Level

1. Core Terminology and Definitions

Database Terms

Term	Definition
Pluggable Database (PDB)	A portable set of schemas and objects that appears to an Oracle Net client as a non-CDB database.
Container Database (CDB)	An Oracle database that contains zero, one, or more pluggable databases.

Infrastructure and Design Terms

Term	Definition
Idempotent	A change or action that is not applied more than once. Tools first validate whether a task has already been completed before applying it, saving processing cycles and limiting impact on running resources.
Immutable	Infrastructure or services that are never modified in place. When troubleshooting or upgrading is needed, the resource is fully replaced rather than changed.
Ephemeral	Refers to impermanent resources or temporary resource assignments.
Stateless Application	An application built to avoid reliance on any single component for managing transactional or session-related information. Such applications often leverage immutable instances as part of their deployment strategy.
Infrastructure as Code (IaC)	The process of managing and provisioning cloud resources through machine-readable definition files, rather than through physical hardware configuration or interactive tools.
Zero-Rating	The practice of providing Internet access without financial cost under certain conditions — for example, by permitting access only to specific websites, by subsidizing the service with advertising, or by exempting certain websites from data allowances.
Canary Testing	The practice of releasing a code change to a small subset of users to observe how the new code performs compared to the version still running for the majority. Users are unaware they are receiving new code. This is implemented by routing traffic to a dedicated set of Canary servers or containers running the new release.

2. Data Warehouse Concepts

Why Data Warehousing?

Businesses need to bring raw data into a structured and clean form in order to perform meaningful analysis and make well-informed decisions. A Data Warehouse (DWH) is a centralized repository designed specifically for this purpose.

The standard workflow involves:

Extract data from source operational systems
Clean and Transform it into a consistent and usable format
Load it into the warehouse for reporting and analysis

Data Flow in a Data Warehouse Environment

The data warehouse ecosystem bridges two environments:

Operational Environment (OLTP): Operational databases such as Customer, Product, and Orders feed into business processes.
ETL Processes move and transform data from OLTP systems into the Data Warehouse.
Information Environment (OLAP): The Data Warehouse feeds into subject-specific Data Marts.
Data Mining, Analytics, and Decision Making flow back to inform Business and Enterprise Strategy.

Supported Capabilities

A Data Warehouse supports the following functions:

ETL — Extract, Transform, and Load
Data Mining — Discovery of patterns and relationships in large datasets
Statistical Analysis — Quantitative evaluation of business data
OLAP Tools — Multi-dimensional analytical queries for deeper insights

Metadata

Metadata is the blueprint of data — it describes the structure, format, and meaning of the underlying data.
It is also referred to as a Data Catalogue, Table of Contents, or DWH Roadmap.

Popular Data Warehouse Tools

Oracle Data Warehouse
MarkLogic
Amazon Redshift

OLTP vs. OLAP Comparison

Attribute	OLTP	OLAP
Transaction Type	Small, fast transactions (INSERT, UPDATE, DELETE)	Complex, multi-dimensional queries with aggregations
Data Nature	Operational — reflects real-time business events	Consolidated — sourced from multiple OLTP databases
Purpose	Records all events occurring in the business	Provides different views and perspectives of business events
Query Focus	Speed of individual operations	Depth of analysis and reporting

3. Transparent Data Encryption (TDE)

TDE is an Oracle database security feature that encrypts data stored on disk. It uses a master key that is stored outside the database in external storage, ensuring that the encryption key is physically separated from the data it protects.

How TDE Works

Data is transparently decrypted for the database engine and authorized users.
Applications interact with the data normally, without needing to manage any encryption or decryption logic.

Types of Encryption

Column Encryption — Encrypts specific sensitive columns within a table.
Tablespace Encryption — Encrypts an entire tablespace.

Two-Tiered Key Architecture

The most common TDE implementation is the Two-Tiered Key Architecture:

An external master key (stored outside the database) encrypts or decrypts a second internal key.
The internal data encryption key (DEK) in turn encrypts the actual data.
This layered approach provides an additional level of security and clear separation of key management from data storage.

4. Getting Started with OCI

The Five Benefits of Cloud Computing

The five core benefits of cloud computing can be remembered with the acronym OBRRM:

#	Benefit	Description
1	On-Demand Self-Service	Resources can be provisioned without requiring human interaction with the service provider.
2	Broad Network Access	Resources are accessible over the network using standard mechanisms from a wide variety of devices.
3	Rapid Elasticity	Resources can be scaled up or down quickly, often automatically, to match current demand.
4	Resource Pooling	Provider resources are pooled and dynamically assigned to serve multiple consumers using a multi-tenant model.
5	Measured Service	Resource usage is monitored, controlled, and reported — you pay only for what you consume.

Recovery Objectives

Term	Definition
RTO — Recovery Time Objective	How much downtime your business can tolerate. This is the maximum acceptable time to restore a service after a disruption.
RPO — Recovery Point Objective	How much data loss your business can tolerate. This is the maximum acceptable window of data that could be lost following a failure.

Availability and Resilience Terminology

Term	Description
High Availability (HA)	A design principle that ensures a system remains operational with minimal downtime.
Disaster Recovery (DR)	A set of policies and procedures to enable recovery from a catastrophic failure event.
Fault Tolerant	The ability of a system to continue operating correctly even when some of its components fail.
Scalability	The ability to handle increased workload by adding resources.
Horizontal Scaling (Scale Out / In)	Adding more instances or nodes to increase capacity (scale out), or removing them to reduce it (scale in).
Vertical Scaling (Scale Up / Down)	Increasing or decreasing the size (CPU, RAM) of an existing resource. Requires downtime as it involves a hardware-level change.
Elasticity	The ability to quickly and automatically adjust resource capacity up or down in response to changing demand.

CAPEX vs. OPEX

Model	Description
CAPEX (Capital Expenditure)	A large upfront investment to purchase and maintain physical infrastructure.
OPEX (Operational Expenditure)	Ongoing running costs such as service subscriptions, utility bills, and labour.

Cloud computing allows organizations to trade CAPEX for OPEX, shifting from large upfront hardware investments to predictable, usage-based operational costs.

OCI Physical Architecture

OCI is organized into a three-tier physical hierarchy:

Level	Description
Region	A geographic area containing one or more Availability Domains.
Availability Domain (AD)	A single, independent data center within a region.
Fault Domain (FD)	A logical grouping of hardware within an AD that provides anti-affinity isolation. Each AD contains exactly 3 Fault Domains. It acts as a logical data center within the AD.
Region Pair	A secondary geographic region used to replicate an entire AD when the primary region becomes unavailable.

Compartments

Compartments are the fundamental building block for organizing and controlling access to OCI resources.

Key characteristics:

A tenancy is also referred to as the root compartment.
Compartments can be nested up to 6 levels deep.
Each resource belongs to exactly one compartment — it cannot simultaneously exist in multiple compartments.
Resources in different compartments can communicate with each other.
Resources can be moved from one compartment to another.
Compartments can be created and deleted at any time.
Compartments are a global construct — resources from multiple regions can reside in the same compartment.
Quotas and budgets can be set per compartment to control resource consumption.
IAM policies can be written to grant specific users access to compartment resources.
Compartment cost and usage can be analyzed and monitored against budget thresholds.

5. OCI Compute Services

OCI provides the following compute deployment options:

Service	Description
Bare Metal (BM)	A dedicated physical server with no virtualization overhead. Ideal for maximum performance workloads.
Dedicated VM Hosts	A single-tenant physical server exclusively allocated to your organization for running virtual machines.
Virtual Machines (VM)	Multi-tenant virtualized instances sharing physical hardware. Fast to provision.
Container Engine (OKE)	Oracle Kubernetes Engine — a fully managed Kubernetes service for containerized workloads.
Functions	Serverless compute — the smallest deployable unit of logic in OCI.

OCI services follow a pay-as-you-go model. For Functions, you only pay for resources consumed during each invocation.

Off-Box Virtualization (Custom Silicon)

OCI uses custom silicon — a dedicated hardware card — to offload network and storage processing away from the main compute host. This design, called Off-Box Virtualization, results in:

Better compute performance (no virtualization overhead on the host CPU)
Lower latency for storage and network I/O
Stronger tenant isolation

Oracle Kubernetes Engine (OKE)

OCIR (Oracle Cloud Infrastructure Registry) is OCI’s managed Docker container registry.
OCIR is used to store and pull container images for OKE deployments.

Functions (Serverless)

Functions are purpose-built to do exactly one task — the smallest but most powerful compute unit in OCI.
They are serverless — no server management required. Stored as Docker images in a registry.
Can be invoked via the OCI CLI or an HTTP signed request.
Billing is based only on invocations and resources consumed during execution.

6. OCI Storage Services

Storage Services Comparison

Attribute	Local NVMe	Block Volume	File Storage	Object Storage	Archive Storage
Type	NVMe SSD (temporary)	NVMe SSD (persistent)	NFSv3 file system	Highly durable objects	Long-term archival
Access	Block	Block	File	Object	Object
Structure	Block level	Block level	Hierarchical	Unstructured	Unstructured
Durability	Non-persistent; survives reboots	Durable — multiple copies per AD	Durable — multiple copies per AD	Multiple copies across ADs	Multiple copies across ADs
Capacity	Terabytes+	Petabytes+	Exabytes+	Petabytes+	Petabytes+
Unit Size	51.2 TB (BM), 6.4–25.6 TB (VM)	50 GB to 32 TB/vol, 32 vols/instance	Up to 8 Exabytes	10 TB/object	10 TB/object
Use Cases	OLTP, NoSQL, Data Warehousing	Databases, VMFS, NTFS, boot disks	Oracle EBS, HPC, general file systems	Logs, images, videos	DB backups, long-term archival

6.1 Block Volume

Block Volume provides highly durable, persistent, network-attached block storage for OCI compute instances.

Each block is 512 bytes.
Replicas maintained across 3 Fault Domains — no RAID needed.
Supports automated scheduled backups.

Performance Tiers

Tier	VPUs/GB	IOPS/GB	Throughput	Best For
Basic	N/A	2	240 KB/s per GB	Large sequential I/O, streaming, log processing, Data Warehouses
Balanced	10	60	480 KB/s per GB	Mixed random and sequential I/O workloads
High Performance	20	75	600 KB/s per GB	I/O-intensive workloads — large databases

Size and Attachment Limits

Parameter	Value
Size Range	50 GB to 32 TB per volume
Max Volumes per Instance	32 volumes
Max Total Capacity	32 x 32 TB = approximately 1 Petabyte per instance

Backups

Complete point-in-time (PIT) snapshot of your Block Volume.
Encrypted and stored in Object Storage.
Can be restored to any AD within the same region.
Block Volumes can be copied across regions.

6.2 Local NVMe Storage

Local NVMe is physically attached to the compute host and delivers the highest available storage performance.

Attribute	Value
Latency	Less than 100 ms
IOPS	Up to 3 million IOPS
Persistence	Non-persistent, but survives instance reboots
OCI-Managed Backups	Not supported
Protocol	Block-based

Local NVMe has no OCI-managed backup or replication. Best suited for temporary, ultra-high-performance workloads.

6.3 File Storage Service (FSS)

FSS provides a managed, shared network file system using the NFSv3 protocol.

Full POSIX semantics and Network Lock Manager (NLM) support.
All data encrypted at rest using 128-bit encryption by default.
Up to 10,000 snapshots per file system.
Common use cases: Oracle EBS, HPC, and Big Data applications.

FSS Components

Component	Description
Mount Target	Highly available NFS endpoint in a chosen subnet. Has 3 private IPs — 2 for mount creation, 1 for HA.
Export	Controls NFS client access to file systems via a mount target.
Export Set	A collection of exports defining what file systems are accessible via NFSv3.
Export Options	Parameters that define the access level granted to NFS clients.
Snapshots	Point-in-time consistent views of a file system. Up to 10,000 per file system.

FSS Limits: up to 100 file systems per mount target. Each export must have a unique path.

Security List Rules Required for FSS

Direction	Protocol	Ports
Stateful Ingress	TCP	111, 2048–2050
Stateful Ingress	UDP	111, 2048
Stateful Egress	TCP	111, 2048–2050
Stateful Egress	UDP	111

Avoid NFS mount options WSIZE, RSIZE, or NOLOCK — these cause performance and file locking issues.

6.4 Object Storage

Object Storage provides highly durable, scalable, unstructured data storage via REST APIs.

256-bit AES encryption at rest.
Data stored across more than one AD for durability.
Data auto-repaired if corruption is detected.
Supports cross-region copy and strong consistency.

Core Concepts

Concept	Description
Object	Data plus its metadata. The fundamental storage unit.
Bucket	Logical container for objects. Names unique within a tenancy.
Namespace	Top-level container for all buckets and objects in a tenancy. Globally unique per tenancy, spans all regions and compartments.

Object URL format: /n/{namespace}/b/{bucket}/o/{object-name} Example: /n/mytenancy/b/event_photos/o/marathon/participants/p_21.jpg

Storage Tiers

Tier	Description
Standard (Hot)	Immediate access. Serves most recent data instantly. Cannot be downgraded to Archive.
Archive (Cold)	For rarely accessed data. Min retention: 90 days. Objects must be restored before download — TTFB after restore: 4 hours. Cannot be upgraded to Standard.

Pre-Authenticated Requests (PAR)

A PAR provides credential-free access to an object or bucket via a unique URL.

Setting	Options
Type	Bucket or Object
Permissions	Read / Write / Read and Write
Expiration	User-defined date and time

PARs can be revoked at any time.
Changing bucket visibility does not affect existing PARs.
PARs supported for Archive storage too.

Object Lifecycle Management

Rules auto-archive or delete objects after a set number of days.
Applied at bucket level or by object name prefix.
A delete rule always takes priority over an archive rule.
Rules can be enabled or disabled at any time.
Only two available actions: Archive or Delete.

Cross-Region Copy

Specify destination namespace, region, bucket, and overwrite permissions.
Must authorize Object Storage service to manage objects on your behalf.
Target bucket must already exist.
Cross-region copy from Archive Storage is not supported.

Required IAM policy: allow service objectstorage-us-ashburn-1 to manage object-family in tenancy

Multipart Uploads

Allows large objects to be uploaded in parallel parts to reduce upload time.

Parameter	Value
Minimum part size	10 MB
Maximum part size	50 GiB
Part numbers	1 to 10,000

Steps: (1) Create parts, (2) Initiate upload, (3) Upload parts, (4) Commit upload. Failed parts can be re-uploaded individually without restarting the entire upload.

CLI examples:

oci os object put -ns my-namespace -bn my-bucket --file path/to/file --part-size 200
oci os object bulk-upload -ns mynamespace -bn mybucket --src-dir path/to/directory
oci os object bulk-download -ns mynamespace -bn mybucket --download-dir path/to/dir
oci os object bulk-download -ns mynamespace -bn mybucket --download-dir path/to/dir --prefix myprefix
oci os object bulk-delete -ns mynamespace -bn mybucket
oci os object bulk-delete -ns mynamespace -bn mybucket --prefix myprefix

7. Identity and Access Management (IAM)

IAM controls who can access OCI resources and what they can do with them.

A Principal is an entity — a user or resource — that is authenticated to make requests.

Authentication vs. Authorization

Concept	Definition
Authentication	Verifying who you are. Methods: username/password, API signing keys, and auth tokens.
Authorization	Verifying that you have permission to access a specific resource.

IAM Policy Syntax

Policies are written in a human-readable format:

Allow <group> to <verb> <resource-type> in <location> where <conditions>

IAM Verbs

Verb	Access Type
inspect	List resources only
read	Inspect + retrieve user-specified metadata
use	Read + Update (actions vary by resource type). Does not include the ability to create or delete.
manage	Full permissions — all actions

Resource Type Families

Aggregate Resource Type	Individual Resource Types
all-resources	(all)
database-family	db-systems, db-nodes, db-homes, databases
instance-family	instances, instance-images, volume-attachments
object-family	buckets, objects
virtual-network-family	vcn, subnet, route-tables, security-lists
volume-family	volumes, volume-attachments, volume-backups
cluster-family	clusters, cluster-node-pool, cluster-work-requests
file-family	file-systems, mount-targets, export-sets
dns	dns-zones, dns-records, dns-traffic

Common Policy Examples

Network Admins manage a cloud network:

Allow group NetworkAdmins to manage virtual-network-family in tenancy

Users launch compute instances:

Allow group InstanceLaunchers to manage instance-family in compartment ABC
Allow group InstanceLaunchers to use volume-family in compartment ABC
Allow group InstanceLaunchers to use virtual-network-family in compartment XYZ

Compartment-Based Access Pattern

A common pattern is to create separate compartments for different resource categories (e.g., storage, network), create dedicated user groups for each, and then write policies granting each group access only to their relevant compartment.

8. OCI Database Services

OCI offers a range of managed database deployment options:

Option	Description
VM DB Systems	Fast provisioning of Oracle Database on virtual machines. Supports managed RAC.
BM DB Systems	Oracle Database on Bare Metal for maximum I/O performance.
RAC (Real Application Clusters)	Managed High Availability with up to 12-node VM RAC clusters.
Exadata DB Systems	Fully managed Exadata infrastructure — highest performance and scalability.
Autonomous — Shared (Multi-Tenant)	Self-Driving, Self-Securing, Self-Repairing database shared across customers.
Autonomous — Dedicated	Same autonomous capabilities but with infrastructure dedicated to a single customer.

DB Services Comparison

Attribute	VM DB	BM DB	Exadata DB	Autonomous Shared	Autonomous Dedicated
Management	Customer	Customer	Customer	Oracle	Oracle
Updates	Customer initiated	Customer initiated	Customer initiated	Automatic	Customer policy controlled
Scaling	Storage only (CPU fixed)	CPU only (storage fixed)	Within Exa CPU, across racks	Both CPU and Storage	Both CPU and Storage
Backups	Customer initiated	Customer initiated	Customer initiated	Automated	Automated
Storage	Block Storage	Local NVMe disks	Local disks + NVMe flash	Local disks + NVMe flash	Local disks + NVMe flash
RAC	Available (2-node)	Not Available	Available	Not Available	Not Available
Data Guard	Available	Available	Available*	Not Available	Not Available

*Data Guard on Exadata must be configured manually using native Oracle Database utilities. dbcli is not available on Exadata DB Systems.

Database Security Layers

Layer	Security Measures
Infrastructure Level	IAM, VCN, and Audit
Database Level	TDE, encrypted RMAN backups, Block Volume encryption

Data Guard

Oracle Data Guard provides a set of services that create, maintain, manage, and monitor one or more standby databases to enable Oracle Database to survive disasters and data corruptions.

Maintains continuous synchronization between primary and standby databases.
Active Data Guard provides additional data protection and offloads read workloads.
Available in Extreme Performance Edition and Exadata service.

Two Switchover Modes:

Mode	Description
Switchover	Planned, graceful migration — both primary and standby remain synchronized before the role switch.
Failover	Unplanned migration — used when the primary database is unavailable due to a failure.

Autonomous Database

Type	Full Name	Optimized For
ATP	Autonomous Transaction Processing	OLTP workloads
ADW	Autonomous Data Warehouse	Analytical and reporting workloads

Autonomous Database automates: backing up, patching, upgrading, and tuning — eliminating routine DBA tasks.

9. OCI Security

Shared Security Model

When moving from on-premises to the cloud, security responsibilities are divided:

Model	Responsibility
On-Premises	Customer is fully responsible for all layers — from networking to applications.
Security OF the Cloud	Oracle is responsible — physical data center security, hardware, software, and networking.
Security IN the Cloud	Customer is responsible — applications, data, runtime, middleware, OS, and identity management.

Customer responsibilities in OCI include:

Patching applications and the operating system
Identity and access management
Network security
Endpoint protection
Data classification and compliance

Four Security Domains

Domain	Use Cases	Services
Identity and Access Management	Manage user access and policies; MFA; SSO and federation	OCI IAM, MFA, Federation
Data Protection	Encryption at rest and in transit; discover, classify, and protect data; hardware key storage; centralized key management	Storage and DB services, Data Safe, Key Management
OS and Workload Management	Patch management; workload isolation	OS Management Service, Bare Metal, Dedicated VM Hosts
Infrastructure Protection	Network security controls; filter malicious web traffic; DDoS protection	VCN NSG, Security Lists, Web Application Firewall, Built-in DDoS

Data Protection by Service

Service	Protection Measures
Block Volume and File Storage	Encryption at rest, encryption in transit, Bring Your Own Key (BYOK)
Object Storage	BYOK, encryption at rest, Pre-Authenticated Requests (PAR)
Database	Transparent Database Encryption (TDE), Data Safe, Data Vault

HSM (Hardware Security Module) keys used in OCI meet FIPS 140-2 security level standards.

10. Pricing and Billing

Pricing Models

Model	Description
Pay As You Go (PAYG)	Pay for resources consumed with no upfront commitment.
Monthly Flex (Universal Credits)	Minimum commitment of $1,000 per month for 12 months. Offers discounts over PAYG. Unused credits roll forward.
Bring Your Own License (BYOL)	Apply existing Oracle software licenses to reduce OCI compute and database costs.

Factors That Impact Pricing

Resource Size — Larger resources cost more.
Resource Type — VM vs. Bare Metal; BYOL vs. managed databases; Functions vs. VM.
Data Transfer — Costs vary by direction and destination.
Pricing Consistency — OCI applies the same pricing globally across all regions.

Block Volume Pricing

Performance Plan	VPUs/GB	IOPS/GB
Basic	N/A	2
Balanced	10	60
High Performance	20	75

Data Transfer Costs

Scenario	Ingress	Egress
Between ADs in the same region	Free	Free
Between regions	Free	Charged
To/from the internet	Free	Charged (first 10 TB/month free)
DRG and FastConnect	Free	Free

Cost Monitoring and Control

Cost Analysis — Filter and analyze spend by date, tags, and compartments.
Budget Alerts — Set threshold rules on forecasted and actual spend.
Usage Reports — Can be automatically pushed to Object Storage buckets.
Cost Tracking Tags — Tag resources to categorize and track costs.
Only members of the admin group can view billing and cost reports.

11. Advanced Compute — Professional Level

Custom Images

Windows images cannot be downloaded or exported.
Custom images support boot disks only — attached block volumes are not included.
Custom images cannot exceed 300 GB.
Images can be stored in OCI Object Storage and referenced by their Image OCID.
A maximum of 25 custom images per compartment is allowed.
Custom images are free of charge.
You cannot run a clone and a backup simultaneously.

Image Import and Export

Images can be imported from or exported to OCI Object Storage.

Virtualization Modes

Mode	Description	Trade-offs
Emulation Mode	Fully emulated NIC, block boot, and legacy BIOS.	Compatible with a wide range of older/custom OS images. Performance is ~20% lower than Native mode.
Para-virtualized Mode	Driver-based virtualization for modern OS images. Current OCI default VM experience.	Offers maximum performance for modern OS. Incompatible with many older OS versions.
Native Mode (HVM)	Same as hardware virtualization. Balances performance and compatibility.	Minimal performance gap between virtio and iSCSI. Supports older and newer OS with virtio drivers.

Bring Your Own Image (BYOI)

BYOI enables you to bring your own version of an OS to OCI, provided the underlying hardware supports it.

Benefits:

Enables lift-and-shift cloud migration of existing workloads
Supports both legacy and modern operating systems
Encourages experimentation with different OS configurations
Increases overall infrastructure flexibility

Migration flow: On-Premises Server → qcow2 Image → Object Storage → Custom Image → OCI Instance

Note: You must comply with all licensing requirements when uploading and launching instances based on OS images you supply.

Bring Your Own Hypervisor (BYOH)

OCI Bare Metal instances support the following hypervisors for BYOH scenarios:

KVM
Hyper-V
Oracle VM

In a BYOH scenario, each guest VM can receive one or more secondary VNICs. When SR-IOV Virtual Functions (VF) are used, each VF can be configured with the VLAN tag and MAC address of a secondary VNIC. Each Shape has a limit on the number of VNICs it supports.

Compute Quotas

Quotas can be applied per compartment and per region to control resource usage.

Quota Policy Examples

# Limit VM standard shapes
set compute quota vm-standard2-1-count to 3 in compartment compartment01 where request.region = us-phoenix-1

# Limit dense I/O shapes
set compute quota vm-dense-io1-4-count to 10 in compartment <compartment-name> where request.region = us-phoenix-1

# Limit custom images
set compute quota custom-image-count to 5 in compartment <compartment-name> where request.region = us-phoenix-1

# Limit instance configurations
set compute-management quota config-count to 3 in compartment <compartment-name> where request.region = us-ashburn-1

# Limit instance pools
set compute-management quota pool-count to 3 in compartment <compartment-name> where request.region = us-ashburn-1

# Limit autoscaling configurations
set auto-scaling quota config-count to 2 in compartment <compartment-name> where request.region = us-ashburn-1

Quota policy examples can be generated directly from the OCI Console under Limits and Quotas using the Create Quota Policy Stub option.

Instance Configuration and Instance Pools

Instance Configuration allows you to define a template for VM deployment. It captures compute shape, image, network, and storage settings.

Steps to create an Instance Pool from a running instance:

Go to the instance → Actions → Create Instance Configuration
From the Instance Configuration, click Create Instance Pool
Specify the number of instances, Load Balancer backend sets, network settings, and Availability Domains (AD1, AD2, AD3 as needed)

Auto Scaling

Auto Scaling allows OCI to automatically adjust the number of instances in a pool based on performance metrics.

Configuration path: Compute → Auto Scaling Configuration → Create Auto Scaling Configuration

Key behaviors and settings:

The oldest instance in the pool is terminated first during scale-in.
Default cooldown period is 300 seconds (5 minutes).
Monitoring must be enabled on the instance pool to use Auto Scaling.
Scaling metrics can be based on CPU utilization or Memory utilization.
Scaling rules define the conditions and actions (e.g., add 2 instances if CPU > 70%, remove 2 if CPU < 70%).

Scaling rule example:

If CPU or Memory > 70%  → Add 2 instances
If CPU or Memory < 70%  → Remove 2 instances

To generate load for testing Auto Scaling:

sudo stress --cpu 8 -v --timeout 60s

Instance Console Connections

OCI provides two types of console access for instances:

Type	Description
Serial Console	Text-based terminal access — useful for debugging OS boot issues.
VNC Console	Graphical desktop access — useful for GUI-based OS troubleshooting.

Steps to connect:

Go to Console Connections for the instance.
Provide your system’s public key and generate the console connection keys.
Click the instance Action button and choose Connect to VNC or Connect to Serial.

Example SSH command for Serial Console connection:

ssh -o ProxyCommand='ssh -W %h:%p -p 443 \
  ocid1.instanceconsoleconnection...@instance-console.us-phoenix-1.oraclecloud.com' \
  ocid1.instance...

SSH Port: 443
Console Connection Server: instance-console.us-phoenix-1.oraclecloud.com

Note: The VM is shut down while a custom image is being created from it.

12. Advanced Storage — Professional Level

File Storage — Additional Details

iSCSI vs. Para-virtualized Attachment

Attachment Type	Characteristic
iSCSI	Higher performance — directly connected storage protocol.
Para-virtualized	Connected through the hypervisor — slightly lower performance but simpler to configure.

Generating Synthetic Load on an Instance

The stress package can be used to simulate load on a server for testing purposes:

sudo yum install stress -y
sudo stress --cpu 20 --timeout 420 &

Object Storage — Additional Details

Strong vs. Eventual Consistency

OCI Object Storage provides strong consistency — a write is immediately visible to all subsequent reads. This is in contrast to eventual consistency, where a read may temporarily return stale data after a write.

Object Storage Monitoring Namespaces

OCI uses different metric namespaces to monitor compute and storage resources:

Namespace	Scope
`oci_blockstore`	Boot and block volume metrics (Resource ID: Volume OCID)
`oci_vcn`	VNIC metrics (Resource ID: VNIC OCID)
`oci_computeagent`	Instance-level metrics aggregated across all related resources (Resource ID: Instance OCID)

End of OCI Study Notes — First 26 Pages