• A compartment is a logical container that can hold OCI resources such as compute instances, block volumes, virtual cloud networks, etc. Compartments help you organize and control access to your resources based on business needs or security requirements3
• By default, your tenancy comes with a root compartment that is the parent of all other compartments in your tenancy. You cannot delete the root compartment, but you can create subcompartments within it to further organize your resources3
• Compartments can be used to logically separate OCI resources, not physically separate them. Resources within one compartment can interact with resources in other compartments, as long as the appropriate policies and network configurations are in place. For example, you can attach a compute instance in one compartment to a virtual cloud network in another compartment, or grant access to a user group in one compartment to manage resources in another compartment34

Oracle Cloud Infrastructure Marketplace is an online store that offers solutions specifically for customers of Oracle Cloud Infrastructure. In the Oracle Cloud Infrastructure Marketplace catalog, you can find listings for two types of solutions from Oracle and trusted partners: images and stacks. These listing types include different categories of applications. Also, some listings are free and others require payment.

Images are templates of virtual hard drives that determine the operating system and software to run on an instance. You can deploy image listings on an Oracle Cloud Infrastructure Compute instance. Marketplace also offers stack listings. Stacks represent definitions of groups of Oracle Cloud Infrastructure resources that you can act on as a group. Each stack has a configuration consisting of one or more declarative configuration files. With an image or a stack, you have a customized, more streamlined way of getting started with a publisher's software.

Archive storage is the most cost effective for archive data

The Universal Credits pricing model allows customers to use prepaid credits for any eligible cloud service. This gives customers the flexibility to switch between services or regions as needed without having to renegotiate contracts2

Customer and Oracle's responsibilities can be divided into the following areas:

Physical Security: Oracle is responsible for protecting the global infrastructure that runs all of the services offered in Oracle Cloud Infrastructure. This infrastructure consists of the hardware, software, networking, and facilities that run Oracle Cloud Infrastructure services.

Identity and Access Management (IAM): As with all Oracle cloud services, you should protect your cloud access credentials and set up individual user accounts. You are responsible for managing and reviewing access for your own employee accounts and for all activities that occur under your tenancy. Oracle is responsible for providing effective IAM services such as identity management, authentication, authorization, and auditing.

Workload Security: You are responsible for protecting and securing the operating system and application layers of your compute instances from attacks and compromises. This protection includes patching applications and operating systems, operating system configuration, and protection against malware and network attacks. Oracle is responsible for providing secure images that are hardened and have the latest patches. Also, Oracle makes it simple for you to bring the same third-party security solutions that you use today.

Data Classification and Compliance: You are responsible for correctly classifying and labeling your data and meeting any compliance obligations. Also, you are responsible for auditing your solutions to ensure that they meet your compliance obligations.

Host Infrastructure Security: You are responsible for securely configuring and managing your compute (virtual hosts, containers), storage (object, local storage, block volumes), and platform (database configuration) services. Oracle has a shared responsibility with you to ensure that the service is optimally configured and secured. This responsibility includes hypervisor security and the configuration of the permissions and network access controls required to ensure that hosts can communicate correctly and that devices are able to attach or mount the correct storage devices.

Network Security: You are responsible for securely configuring network elements such as virtual networking, load balancing, DNS, and gateways. Oracle is responsible for providing a secure network infrastructure.

Client and Endpoint Protection: Your enterprise uses various hardware and software systems, such as mobile devices and browsers, to access your cloud resources. You are responsible for securing all clients and endpoints that you allow to access Oracle Cloud Infrastructure services.

The Oracle Cloud Infrastructure Domain Name System (DNS) service lets you create and manage your DNS zones. You can create zones, add records to zones, and allow Oracle Cloud Infrastructure's edge network to handle your domain's DNS queries.

Oracle Functions is a fully managed, multi-tenant, highly scalable, on-demand, Functions-as-a-Service platform. It is built on enterprise-grade Oracle Cloud Infrastructure and powered by the Fn Project open source engine. Use Oracle Functions (sometimes abbreviated to just Functions) when you want to focus on writing code to meet business needs.

The serverless and elastic architecture of Oracle Functions means there's no infrastructure administration or software administration for you to perform. You don't provision or maintain compute instances, and operating system software patches and upgrades are applied automatically. Oracle Functions simply ensures your app is highly-available, scalable, secure, and monitored. With Oracle Functions, you can write code in Java, Python, Node, Go, and Ruby (and for advanced use cases, bring your own Dockerfile, and Graal VM). You can then deploy your code, call it directly or trigger it in response to events, and get billed only for the resources consumed during the execution.

The cost of running a virtual machine instance in Oracle Cloud Infrastructure depends on several factors, such as the size, shape, region, and operating system of the instance. The number of virtual machines running does not impact the cost of each individual instance1

Web Application Firewall (WAF) is the Oracle Cloud Infrastructure service that is designed to protect web applications from various types of malicious attacks, such as SQL injection and cross-site scripting. WAF is a cloud-based service that inspects incoming web traffic and blocks any requests that are malicious or do not comply with predefined rules. WAF helps users secure their web applications from common web exploits and application-layer attacks.

Exadata DB Systems are not available as part of Oracle Cloud Free Tier. Exadata DB Systems are a premium service that provides the highest levels of performance and availability for Oracle Database workloads. Oracle Cloud Free Tier includes a set of Always Free services that never expire, and a 30-day trial with US$300 of free credit to use on all eligible OCI services1. The Always Free services include two Oracle Autonomous Databases, two AMD Compute VMs, up to four instances of ARM Ampere A1 Compute, and other services1.

Service Plane is NOT an SLA provided by OCI. See the table below:

Storing and managing encryption keys and secrets is not a feature provided by Oracle Cloud Infrastructure Security Zones. Security Zones are compartments that enforce strict security policies on resources created within them. Security Zones help you prevent misconfigurations that could weaken your security posture or violate compliance requirements. Security Zones automatically apply predefined recipes of security policies based on best practices6. To store and manage encryption keys and secrets, you need to use Vault5.

CapEx is Capital expenditures comprise major purchases that will be used in the future.

OpEx Operating expenditures (expenses) represent day-to-day costs that are necessary to keep a business running.

Archive storage is the storage tier in Oracle Cloud Infrastructure Object Storage service that is designed for rarely accessed data that can be restored within hours. Archive storage is the lowest-cost storage tier that offers durable and secure long-term data retention. Archive storage is suitable for data that is accessed less than once a year, such as compliance records, historical data, or backups.

A NAT gateway gives cloud resources without public IP addresses access to the internet without exposing those resources to incoming internet connections.

You can create and manage resources in the following ways:

Oracle Cloud Infrastructure ConsoleThe Console is an intuitive, graphical interface that lets you create and manage your instances, cloud networks, and storage volumes, as well as your users and permissions. See Using the Console.

Oracle Cloud Infrastructure APIsThe Oracle Cloud Infrastructure APIs are typical REST APIs that use HTTPS requests and responses. See API Requests.

SDKsSeveral Software Development Kits are available for easy integration with the Oracle Cloud Infrastructure APIs, including SDKs for Java, Ruby, and Python. For more information, see Developer Resources.

Command Line Interface (CLI)You can use a command line interface with some services. For more information, see Developer Resources.

TerraformOracle supports Terraform. Terraform is "infrastructure-as-code" software that allows you to define your infrastructure resources in files that you can persist, version, and share. For more information, see Getting Started with the Terraform Provider.

AnsibleOracle supports the use of Ansible for cloud infrastructure provisioning, orchestration, and configuration management. Ansible allows you to automate configuring and provisioning your cloud infrastructure, deploying and updating software assets, and orchestrating your complex operational processes. For more information, see Getting Started with Ansible for Oracle Cloud Infrastructure.

Resource ManagerResource Manager is an Oracle Cloud Infrastructure service that allows you to automate the process of provisioning your Oracle Cloud Infrastructure resources. It helps you install, configure, and manage resources using the "infrastructure-as-code" model. For more information, see Overview of Resource Manager.

IAM Group is A collection of users who all need the same type of access to a particular set of resources or compartment.

IAM DYNAMIC GROUP is A special type of group that contains resources (such as compute instances) that match rules that you define (thus the membership can change dynamically as matching resources are created or deleted). These instances act as "principal" actors and can make API calls to services according to policies that you write for the dynamic group.

Budgets can be used to set thresholds for your Oracle Cloud Infrastructure spending. You can set alerts on your budget to let you know when you might exceed your budget, and you can view all of your budgets and spending from one single place in the Oracle Cloud Infrastructure console.

You can set up a single IPSec VPN with a simple layout that you might use for a proof of concept (POC).

You can do Costs Analysis in OCI and you can group and filter the cost by Tags or compartments

To filter costs by dates

To filter costs by tags

To filter costs by compartments

To remove a compartment or tag filter

The following are capabilities of the OCI Data Catalog service:

• It provides a repository of searchable metadata. Data Catalog harvests metadata from data sources across the OCI ecosystem and on-premises to create an inventory of data assets. This helps data consumers easily find the data they need for analytics4.
• It enables enrichment of the metadata. Data Catalog allows users to add business metadata such as business terms, tags, custom properties, and annotations to data assets. This helps provide more insight and context into the data5.
• It can automate harvesting of data. Data Catalog supports on-demand or schedule-based automatic harvesting to ensure the data catalog always has up-to-date information4.

Network File System (NFS) is the file protocol that Oracle Cloud Infrastructure File Storage Service uses to enable file sharing across instances. NFS is a distributed file system protocol that allows a user on a client computer to access files over a network in a manner similar to how local storage is accessed. The File Storage service supports the NFS version 3.0 protocol with Network Lock Manager (NLM) for file locking functionality2.

The Ultra High Performance level is the only OCI Block Volume performance level that can meet the requirement of at least 105 IOPS/GB and 100,000 IOPS per volume. The Ultra High Performance level is recommended for workloads with the highest I/O requirements, requiring the best possible performance. With this option, you can purchase between 30 – 120 VPUs (volume performance units) per GB/month. The VPUs determine the baseline performance of the volume, as well as the maximum burst performance. The Ultra High Performance level offers the following performance characteristics: 1

• Baseline IOPS/GB: 75
• Maximum IOPS/GB: 300
• Maximum IOPS per volume: 480,000
• Baseline throughput/GB: 0.6 MB/s
• Maximum throughput/GB: 2.4 MB/s
• Maximum throughput per volume: 3,680 MB/s

To achieve the requirement of at least 105 IOPS/GB, you need to purchase at least 45 VPUs/GB. To achieve the requirement of 100,000 IOPS per volume, you need to have a volume size of at least 334 GB. Therefore, the Ultra High Performance level can satisfy both requirements with a minimum volume size of 334 GB and a minimum VPUs/GB of 45.

The other performance levels (Balanced, Higher Performance, and Lower Cost) cannot meet the requirement of at least 105 IOPS/GB and 100,000 IOPS per volume. The Balanced level offers 10 VPUs/GB, with a baseline of 60 IOPS/GB and a maximum of 75 IOPS/GB. The Higher Performance level offers 20 VPUs/GB, with a baseline of 75 IOPS/GB and a maximum of 150 IOPS/GB. The Lower Cost level offers 2 VPUs/GB, with a baseline of 2 IOPS/GB and a maximum of 10 IOPS/GB. None of these levels can provide the required performance for the workload1

Here is the official list of all industry standards that OCI complies with : https://www.oracle.com/in/cloud/cloud-infrastructure-compliance/

https://www.oracle.com/cloud/what-is-iaas/

What Is IaaS?

Infrastructure as a service (IaaS) is a type of cloud service model in which computing resources are hosted in the cloud. Businesses can use the IaaS model to shift some or all of their use of on-premises or colocated data center infrastructure to the cloud, where it is owned and managed by a cloud provider. These infrastructure elements can include compute, network, and storage hardware as well as other components and software.

In the IaaS model, the cloud provider owns and operates the hardware and software and also owns or leases the data center. When you have an IaaS solution, you rent the resources like compute or storage, provision them when needed, and pay for the resources your organization consumes. For some resources such as compute, you’ll pay for the resources you use. For others such as storage, you’ll pay for capacity.

How Does IaaS Work?

In a typical IaaS model, a business—which can be of any size—consumes services like compute, storage, and databases from a cloud provider. The cloud provider offers those services by hosting hardware and software in the cloud. The business will no longer need to purchase and manage its own equipment, or space to host the equipment, and the cost will shift to a pay-as-you-go model. When the business needs less, it pays for less. And when it grows, it can provision additional computing resources and other technologies in minutes.

In contrast, in a traditional on-premises scenario, a business manages and maintains its own data center. The business must invest in servers, storage, software, and other technologies, and hire an IT staff or contractors to purchase, manage, and upgrade all the equipment and licenses. The data center has to be built to meet peak demand, even though sometimes workloads decline and those resources stand idle. Conversely, if the business grows quickly, the IT department might struggle to keep up.

https://www.oracle.com/assets/paas-iaas-pub-cld-srvs-pillar-4021422.pdf

Enterprises demand more than just availability from their cloud infrastructure. Mission-critical workloads also require consistent performance, and the ability to manage, monitor, and modify resources running in the cloud at any time. Only Oracle offers end-to-end SLAs covering performance, availability, manageability of services.

Compartment and Cost-tracking tag are two valid targets for setting up OCI budgets. Budgets are set on cost-tracking tags or compartments (including the root compartment) to track all spending in that cost-tracking tag or for that compartment and its children2. You can create alerts on your budget to receive email notifications based on actual or forecasted spending thresholds2.

Data backup frequency is not a component of an identity and access management (IAM) policy statement in Oracle Cloud Infrastructure. An IAM policy statement is a rule that grants or denies access to a specific type of resource in a specific compartment. An IAM policy statement consists of four components: an action verb, a resource-type, a location, and an optional condition.

When creating a compartment, you must provide a name for it (maximum 100 characters, including letters, numbers, periods, hyphens, and underscores) that is unique within its parent compartment. You must also provide a description, which is a non-unique, changeable description for the compartment, from 1 through 400 characters. Oracle will also assign the compartment a unique ID called an Oracle Cloud ID.

You can create subcompartments in compartments to create hierarchies that are six levels deep.

A key benefit of using Oracle Cloud Infrastructure Autonomous Database is that it reduces database management overhead by automating tasks such as provisioning, patching, tuning, backup, recovery, and scaling. This allows customers to focus on their core business rather than database administration6

Nano instance is not a type of instance offered by the Oracle Cloud Infrastructure Compute service. The types of instances offered by the Compute service are bare metal, virtual machine, dedicated virtual machine host, and flexible virtual machine host. A nano instance is a type of instance offered by AWS EC2 service that provides a small amount of consistent CPU resources and allows users to increase CPU capacity in short bursts when additional cycles are available.

Oracle Cloud Infrastructure offers two distinct storage class tiers to address the need for both performant, frequently accessed "hot" storage, and less frequently accessed "cold" storage. Storage tiers help you maximize performance where appropriate and minimize costs where possible.

1) Use Object Storage for data to which you need fast, immediate, and frequent access. Data accessibility and performance justifies a higher price to store data in the Object Storage tier.

2) Use Archive Storage for data to which you seldom or rarely access, but that must be retained and preserved for long periods of time. The cost efficiency of the Archive Storage tier offsets the long lead time required to access the data. For more information, see Overview of Archive Storage.

The Oracle Cloud Infrastructure Object Storage service is an internet-scale, high-performance storage platform that offers reliable and cost-efficient data durability. The Object Storage service can store an unlimited amount of unstructured data of any content type, including analytic data and rich content, like images and videos.

With Object Storage, you can safely and securely store or retrieve data directly from the internet or from within the cloud platform. Object Storage offers multiple management interfaces that let you easily manage storage at scale. The elasticity of the platform lets you start small and scale seamlessly, without experiencing any degradation in performance or service reliability.

Object Storage is a regional service and is not tied to any specific compute instance. You can access data from anywhere inside or outside the context of the Oracle Cloud Infrastructure, as long you have internet connectivity and can access one of the Object Storage endpoints. Authorization and resource limits are discussed later in this topic.

Object Storage also supports private access from Oracle Cloud Infrastructure resources in a VCN through a service gateway. A service gateway allows connectivity to the Object Storage public endpoints from private IP addresses in private subnets. For example, you can back up DB systems to an Object Storage bucket over the Oracle Cloud Infrastructure backbone instead of over the internet. You can optionally use IAM policies to control which VCNs or ranges of IP addresses can access Object Storage. See Access to Oracle Services: Service Gateway for details.

Object Storage is Always Free eligible. For more information about Always Free resources, including additional capabilities and limitations, see Oracle Cloud Infrastructure Free Tier.

The following list summarizes some of the ways that you can use Object Storage.

Oracle Cloud Infrastructure Autonomous Database is based on Oracle Database, the world’s leading relational database management system. It leverages the features and capabilities of Oracle Database to provide a fully managed, self-driving, self-securing, and self-repairing database service6

NVMe stands for non-volatile memory express. It is a storage protocol created to fasten the transfer of data between enterprise and client systems and solid-state drives (SSDs) over a computer’s high-speed Peripheral Component Interconnect Express bus. The characteristics are:

1) Local NVMe is NVMe SSD-based temporary storage.

2) It is the locally-attached NVMe devices to the OCI compute instance

3) It is used very high storage performance requirements, lots of throughput, lots of IOPS, local storage and when you don’t want to go out on network

4) Oracle does not protect in any way through RAID, or snapshots, or backup out of the box and data is not encrypted at rest.

A fault domain is a grouping of hardware and infrastructure within an availability domain. Each availability domain contains three fault domains. Fault domains provide anti-affinity: they let you distribute your instances so that the instances are not on the same physical hardware within a single availability domain. A hardware failure or Compute hardware maintenance event that affects one fault domain does not affect instances in other fault domains. In addition, the physical hardware in a fault domain has independent and redundant power supplies, which prevents a failure in the power supply hardware within one fault domain from affecting other fault domains.

To control the placement of your compute instances, bare metal DB system instances, or virtual machine DB system instances, you can optionally specify the fault domain for a new instance or instance pool at launch time. If you don't specify the fault domain, the system selects one for you. Oracle Cloud Infrastructure makes a best-effort anti-affinity placement across different fault domains, while optimizing for available capacity in the availability domain. To change the fault domain for an instance, terminate it and launch a new instance in the preferred fault domain.

Use fault domains to do the following things:

Protect against unexpected hardware failures or power supply failures.

Protect against planned outages because of Compute hardware maintenance.

DATA ENCRYPTION

Protect customer data at-rest and in-transit in a way that allows customers to meet their security and compliance requirements for cryptographic algorithms and key management

The Oracle Cloud Infrastructure Block Volume service always encrypts all block volumes, boot volumes, and volume backups at rest by using the Advanced Encryption Standard (AES) algorithm with 256-bit encryption. By default all volumes and their backups are encrypted using the Oracle-provided encryption keys. Each time a volume is cloned or restored from a backup the volume is assigned a new unique encryption key.

The File Storage service encrypts all file system and snapshot data at rest. By default all file systems are encrypted using Oracle-managed encryption keys. You have the option to encrypt all of your file systems using the keys that you own and manage using the Vault service.

Object Storage employs 256-bit Advanced Encryption Standard (AES-256) to encrypt object data on the server. Each object is encrypted with its own data encryption key. Data encryption keys are always encrypted with a master encryption key that is assigned to the bucket. Encryption is enabled by default and cannot be turned off. By default, Oracle manages the master encryption key.

The Oracle Cloud Infrastructure Load Balancing service provides automated traffic distribution from one entry point to multiple servers reachable from your virtual cloud network (VCN). The service offers a load balancer with your choice of a public or private IP address, and provisioned bandwidth.

A load balancer improves resource utilization, facilitates scaling, and helps ensure high availability. You can configure multiple load balancing policies and application-specific health checks

to ensure that the load balancer directs traffic only to healthy instances. The load balancer can reduce your maintenance window by draining traffic from an unhealthy application server before you remove it from service for maintenance.

HOW LOAD BALANCING WORKS:

The Load Balancing service enables you to create a public or private load balancer within your VCN. A public load balancer has a public IP address that is accessible from the internet. A private load balancer has an IP address from the hosting subnet, which is visible only within your VCN. You can configure multiple listeners

for an IP address to load balance transport Layer 4 and Layer 7 (TCP and HTTP) traffic. Both public and private load balancers can route data traffic to any backend server that is reachable from the VCN.

1) Public Load Balancer

To accept traffic from the internet, you create a public load balancer. The service assigns it a public IP address that serves as the entry point for incoming traffic. You can associate the public IP address with a friendly DNS name through any DNS vendor.

A public load balancer is regional in scope. If your region includes multiple availability domains, a public load balancer requires either a regional subnet (recommended) or two availability domain-specific (AD-specific) subnets, each in a separate availability domain. With a regional subnet, the Load Balancing service creates a primary load balancer and a standby load balancer, each in a different availability domain, to ensure accessibility even during an availability domain outage. If you create a load balancer in two AD-specific subnets, one subnet hosts the primary load balancer and the other hosts a standby load balancer. If the primary load balancer fails, the public IP address switches to the secondary load balancer. The service treats the two load balancers as equivalent and you cannot specify which one is "primary".

Whether you use regional or AD-specific subnets, each load balancer requires one private IP address from its host subnet. The Load Balancing service supplies a floating public IP address to the primary load balancer. The floating public IP address does not come from your backend subnets.

If your region includes only one availability domain, the service requires just one subnet, either regional or AD-specific, to host both the primary and standby load balancers. The primary and standby load balancers each require a private IP address from the host subnet, in addition to the assigned floating public IP address. If there is an availability domain outage, the load balancer has no failover.

2) Private Load Balancer

To isolate your load balancer from the internet and simplify your security posture, you can create a private load balancer. The Load Balancing service assigns it a private IP address that serves as the entry point for incoming traffic.

When you create a private load balancer, the service requires only one subnet to host both the primary and standby load balancers. The load balancer can be regional or AD-specific, depending on the scope of the host subnet. The load balancer is accessible only from within the VCN that contains the host subnet, or as further restricted by your security rules.

The assigned floating private IP address is local to the host subnet. The primary and standby load balancers each require an extra private IP address from the host subnet.

If there is an availability domain outage, a private load balancer created in a regional subnet within a multi-AD region provides failover capability. A private load balancer created in an AD-specific subnet, or in a regional subnet within a single availability domain region, has no failover capability in response to an availability domain outage.

https://www.oracle.com/cloud/cloud-infrastructure-compliance/

https://docs.oracle.com/en/cloud/paas/atp-cloud/index.html

Oracle Cloud Infrastructure is hosted in regions and availability domains. A region is a localized geographic area, and an availability domain is one or more data centers located within a region. A region is composed of one or more availability domains. Most Oracle Cloud Infrastructure resources are either region-specific, such as a virtual cloud network, or availability domain-specific, such as a compute instance. Traffic between availability domains and between regions is encrypted. Availability domains are isolated from each other, fault tolerant, and very unlikely to fail simultaneously. Because availability domains do not share infrastructure such as power or cooling, or the internal availability domain network, a failure at one availability domain within a region is unlikely to impact the availability of the others within the same region.

The availability domains within the same region are connected to each other by a low latency, high bandwidth network, which makes it possible for you to provide high-availability connectivity to the internet and on-premises, and to build replicated systems in multiple availability domains for both high-availability and disaster recovery.

Oracle is adding multiple cloud regions around the world to provide local access to cloud resources for our customers. To accomplish this quickly, we’ve chosen to launch regions in new geographies with one availability domain.

As regions require expansion, we have the option to add capacity to existing availability domains, to add additional availability domains to an existing region, or to build a new region. The expansion approach in a particular scenario is based on customer requirements as well as considerations of regional demand patterns and resource availability.

For any region with one availability domain, a second availability domain or region in the same country or geo-political area will be made available within a year to enable further options for disaster recovery that support customer requirements for data residency where they exist.

Oracle Functions is the OCI service that can be used for running serverless applications. Oracle Functions is a fully managed, multi-tenant, highly scalable, on-demand, Functions-as-a-Service platform. It is built on enterprise-grade Oracle Cloud Infrastructure and powered by the Fn Project open source engine4.

Dimensions are defined as qualifiers used for filtering group metric data presented in the OCI Monitoring service. Dimensions are key-value pairs that provide additional information about a metric, such as resource ID, region, availability domain, fault domain, shape, image, etc. Dimensions allow you to narrow down the scope of your metric queries and alarms by specifying which resources or attributes you want to monitor. For example, you can use dimensions to filter the CPU utilization metric by instance ID or shape.

In Oracle Cloud Infrastructure, you can set up email alerts to receive notifications when budget thresholds are reached. Email alerts are sent to users who are subscribed to a budget alert rule, which specifies the percentage or amount of budget consumption that triggers the alert. Email alerts help users monitor and control their cloud spending.