✦
OCI Complete Notes
Click any topic below to jump in
Global Infrastructure
Regions · Availability Domains · Fault Domains · Edge Services
IAM & Compartments
Users · Groups · Policies · Dynamic Groups · MFA
Compute Instances
Shapes · Images · SSH Keys · NSGs · VMs vs Bare Metal
Storage Services
Object · Block Volume · File Storage · Archive
Networking Basics
VCN · Subnets · Internet Gateway · NAT · CIDR
Load Balancer & Autoscaling
Flexible LB · Network LB · Instance Pools · Autoscaling
☁️ What is OCI?
Oracle Cloud Infrastructure (OCI) is Oracle's cloud platform offering compute, storage, database, networking, and security services. It is designed for enterprise workloads needing high performance, security, and compliance at a global scale.
2
OCI Global Infrastructure
Regions · Availability Domains · Fault Domains · Edge Services
🌍 Regions
- OCI has multiple Regions around the world
- A Region is a separate geographic area with independent infrastructure
- Choose based on latency, compliance, and business needs
- Examples: us-ashburn-1, eu-frankfurt-1, ap-mumbai-1, ap-sydney-1
🏢 Availability Domains (ADs)
- Each Region contains multiple ADs
- ADs are physically separate data centers within the Region
- Interconnected with high-bandwidth, low-latency network
🔲 Fault Domains (FDs)
- Each AD contains multiple Fault Domains
- FDs are isolated from each other to ensure fault isolation
- Distribute resources across FDs for high availability
⚡ Edge Services
- Brings OCI capabilities closer to users
- Includes: OCI DNS, CDN, WAF, Load Balancing
- Improves performance, availability, and security globally
Region Structure
Region
↓
Availability Domain 1
Availability Domain 2
Availability Domain 3
↓
FD 1-1
FD 1-2
FD 1-3
💡 Remember
- Region → multiple Availability Domains
- Availability Domain → multiple Fault Domains
- Fault Domains provide isolation within an AD
- Distribute resources across FDs and ADs
✅ Best Practice
- Deploy resources across multiple ADs and Fault Domains
- Use OCI services like Load Balancer, DNS, CDN, WAF
- Choose Region based on users, compliance, and data residency
3
IAM & Compartments
Identity & Access Management
👤 Users
An individual who signs in to OCI. Users belong to one or more groups.
👥 Groups
A collection of users. Permissions are assigned to groups, not individual users.
📁 Compartments
A way to organize and isolate resources in a tenancy. They form a hierarchy (root at top).
📋 Policies
Rules that define what groups (or dynamic groups) can do on which resources.
☁️ Dynamic Groups
Groups that contain resources (like instances) based on matching rules (tags, lifecycle state).
📱 MFA
Adds an extra layer of security at sign-in using a second factor (e.g., authenticator app).
How IAM Works
User signs in (MFA)
→
Belongs to Group
→
Group has Policy
→
Scoped to Compartment
→
Access Resources
📋 Policy Example
Allow group Developers to manage instances in compartment App
Allow = action type · group Developers = who · manage instances = what · compartment App = where
💡 Remember
- Policies evaluated at authorization time
- Permissions flow down the compartment hierarchy
- Deny is implicit — if no policy allows it, access is denied
- Use groups, not individual users, in policies
✅ Best Practices
- Organize tenancy with a clear compartment strategy
- Use dynamic groups for resource-based use cases
- Enforce MFA for all users
- Follow least privilege: grant only what is needed
- Review and audit policies regularly
4
Compute Instances
VMs · Bare Metal · Shapes · Images · SSH Keys · NSGs
📐 Shapes
Define the CPU, memory, and network resources of the instance.
Examples: VM.Standard.E4.Flex, VM.Standard3.Flex, BM.Standard.E4
💿 Images
Templates that include the OS and pre-installed software to boot the instance.
Examples: Oracle Linux, Ubuntu, Windows Server, Marketplace Images
🔑 SSH Keys
Provide secure access. Public key added at launch; private key kept with you.
🛡️ Network Security Groups
Virtual firewalls controlling inbound/outbound traffic at the VNIC level.
🌐 Public IP
Optional. Allows internet access to your instance. Can be assigned at launch or later.
⚙️ VCN / Subnet
Instance is placed in a subnet within a Virtual Cloud Network for network isolation.
Compute Launch Flow
1. Image (OS template)
↓
2. Shape (CPU/RAM)
↓
3. VCN / Subnet
↓
4. SSH Key
↓
5. NSG
↓
🚀 Instance
| Feature | Virtual Machines | Bare Metal |
|---|---|---|
| Infrastructure | Virtualized (OCI) | Dedicated physical |
| Tenancy | Shared hosts | Your tenancy only |
| Performance | High, flexible | Ultra-high |
| Virt Layer | Yes | None |
| Best For | General workloads | HPC, SW licensing |
| Scaling | Quick & easy | Manual |
✅ Best Practices
- Use least-privilege NSG rules
- Access via SSH keys, not passwords
- Keep OS and software up to date
- Use Flexible Shapes to optimize cost
- Monitor instances and set alarms
5
Storage Services
Object · Block Volume · File Storage · Archive Storage
🪣 Object Storage
- Store/retrieve data as objects
- Highly durable and scalable
- Use: objects, backups, data lakes
- Access: REST API / SDK / CLI
💽 Block Volume
- Raw block storage attached to compute instance
- Low latency and high performance
- Use: compute storage, high performance workloads, databases
📂 File Storage
- Managed NFS file system
- Shared access over NFS
- Use: shared NFS files, lift-and-shift, content repos
❄️ Archive Storage
- Long-term data retention
- Infrequent access
- Use: compliance archives, historical data
- Cost: Very Low
| Criteria | Object Storage | Block Volume | File Storage | Archive Storage |
|---|---|---|---|---|
| Type | Object | Block | File (NFS) | Archive |
| Access | REST API / SDK / CLI | Attached to compute | NFS (v3) | REST API / SDK / CLI |
| Performance | High throughput, large sequential | Low latency, High IOPS | Moderate, good for shared | Low (infrequent) |
| Cost | Low | Moderate | Moderate | Very Low |
✅ Best Practices
- Use Object Storage for unstructured data at scale
- Use Block Volumes for latency-sensitive workloads
- Use File Storage for shared data across instances
- Use Archive Storage for data you rarely need but must keep
6
Networking Basics
VCN · Subnets · Internet Gateway · NAT · Route Tables · CIDR
🌐 VCN (Virtual Cloud Network)
- Your isolated, private network in OCI
- You define the IP address range (CIDR)
- Contains subnets, route tables, gateways, security rules
🔀 Internet Gateway
- Horizontally scaled, redundant, highly available
- Enables communication between VCN and Internet
🗺️ Route Table
- Defines where network traffic is directed
- Subnets reference a route table to determine next hop
🔒 NAT Gateway
- Allows private subnet resources to connect outbound
- Prevents unsolicited inbound connections
🟢 Public Subnet
Has a route to an Internet Gateway. Resources can be reached from the Internet.
🔴 Private Subnet
No direct route to Internet Gateway. Resources are not reachable from the Internet.
Quick CIDR Reference
| Prefix | Usable IPs (approx.) | Example |
|---|---|---|
| /16 | 65,534 | 10.0.0.0/16 |
| /24 | 254 | 10.0.1.0/24 |
| /26 | 62 | 10.0.1.0/26 |
| /28 | 14 | 10.0.1.0/28 |
| /32 | 1 | 10.0.1.10/32 |
🏗️ Traffic Flow Rules
- Inbound public: Internet → Internet Gateway → Public Subnet → Resource
- Outbound private: Private Subnet → NAT Gateway → Internet Gateway → Internet
- VCN local: Stays within 10.0.0.0/16 (uses Local route)
💡 Key Takeaway
Use public subnets for internet-facing resources. Use private subnets for backend workloads. Route tables + gateways make it work!
7
Load Balancer & Autoscaling
Flexible LB · Network LB · Instance Pools · Autoscaling · High Availability
⚖️ Why Load Balancer?
- Distributes incoming traffic across healthy backend instances
- Improves availability, reliability and scalability
- Performs health checks and removes unhealthy instances
- Single entry point for applications
🌐 Flexible Load Balancer (Layer 7)
- Operates at Layer 7 (HTTP/HTTPS)
- Advanced routing: Path-based, Host-based, Header-based
- SSL/TLS offload, WAF, URL rewrite
- Ideal for modern web applications
⚡ Network Load Balancer (Layer 4)
- Operates at Layer 4 (TCP/UDP)
- High performance and low latency
- Supports connection draining, source IP preservation
- Ideal for high-throughput applications and APIs
🔄 Autoscaling
- Automatically adjusts the number of instances in the pool
- Based on Monitoring metrics and Alarm thresholds
- Scale out when load increases, scale in when load decreases
Autoscaling Flow
Health Checks
→
Monitoring (OCI)
→
Alarms (Thresholds)
→
Autoscaling (Instance Pool)
| Aspect | Flexible Load Balancer | Network Load Balancer |
|---|---|---|
| Layer | Layer 7 (Application) | Layer 4 (Transport) |
| Use Case | Web apps, APIs, HTTP/HTTPS | High performance, TCP/UDP |
| Routing | Path, Host, Header-based | IP address, Port (L4) |
| Performance | Optimized for features | Ultra-high performance |
| TLS | TLS termination supported | TLS pass-through only |
💡 Remember
- Use Flexible LB for Layer 7 features
- Use Network LB for maximum performance
- Always use Instance Pools across Fault Domains
- Autoscaling + Health Checks = Resilient Apps
✅ Best Practices
- Enable Health Checks on the backend
- Set appropriate Alarm thresholds
- Distribute instances across all Fault Domains
- Regularly review Monitoring and scaling policies
8
OCI DNS & Traffic Management
DNS Basics · Zones · Record Types · Health Checks · Traffic Management
🌐 DNS Basics
- Translates domain names to IP addresses
- OCI DNS is global, highly available, authoritative
- Foundation for name resolution and traffic management
📦 DNS Zones
- Container for your domain and records
- Types: Primary Zone (Read/Write), Secondary Zone (Read-Only)
- Zones are replicated globally by OCI
📝 Record Types
- A — IPv4 address
- AAAA — IPv6 address
- CNAME — Alias
- MX — Mail exchange
- TXT — Text record
❤️ Health Checks
- Monitor health of application endpoints
- Protocols: HTTP, HTTPS, TCP (ping), and more
- Results used for traffic steering decisions
🚦 Traffic Management
🌍 Geolocation
Route users to the best region based on geographic location
🔄 Failover
Auto-route to healthy endpoints if primary becomes unavailable
⚖️ Load Balancing
Distribute traffic across multiple healthy endpoints
Domain Flow (End-to-End)
User
Requests domain name (app.example.com)
Resolver
Validates and forwards DNS query
OCI DNS
Resolves query, applies traffic management policies
App Endpoint
Returns best healthy endpoint IP
Response
User connects and receives response
💡 Remember
- OCI DNS is authoritative and global
- Zones hold your domains and records
- Health checks power intelligent traffic steering
- Traffic Management improves availability and UX
✅ Best Practices
- Use appropriate record types for each need
- Enable Health Checks for critical endpoints
- Use Geolocation, Failover, and Load Balancing together
- Monitor health and review policies regularly