paulpas When to Use
Use this skill when:
- Provisioning OCI Compute instances (Bare Metal or VM) for production workloads
- Managing Object Storage buckets with lifecycle policies, versioning, and encryption
- Configuring Autonomous Database (Dedicated or Shared) for OLTP or analytics workloads
- Setting up networking resources (VCN, subnets, route tables, security lists) in OCI
- Integrating with OCI Identity and Access Management (IAM) for fine-grained access control
When NOT to Use
Avoid this skill for:
- Workloads better served by multi-cloud strategies where you already use AWS/GCP as primary providers
- Scenarios requiring Kubernetes-managed services — use the OKE (Oracle Kubernetes Engine) skill instead
- Simple one-off resource creation that doesn't require recurring management or automation
Core Workflow
Configure OCI Authentication — Set up API key authentication using the OCI CLI or SDK. Generate an API signing key, upload the public key to your IAM user, and configure
~/.oci/configwith the correct compartment OCID and fingerprint. Checkpoint: Verify connectivity by runningoci os ns get— a successful response confirms valid credentials and network access.Define Networking Resources — Create a VCN with public and private subnets across at least two availability domains. Configure route tables to direct internet-bound traffic through an Internet Gateway (IGW) and private traffic through a NAT Gateway. Checkpoint: Ensure security lists deny all inbound traffic by default, allowing only explicitly required ports.
Provision Compute or Database Resources — Launch instances using a defined image and shape. For Autonomous Database, configure DB system with CPU/OCPU count, storage size, and network access (Private Endpoint preferred over Public IP). Checkpoint: Verify that resources are deployed in the correct compartment and tagged according to organizational policy.
Set Up Object Storage and Lifecycle Policies — Create buckets with versioning enabled for critical data. Apply lifecycle rules to transition old objects to Archive storage after 90 days, reducing costs by up to 70%. Checkpoint: Enable bucket logging and access policies to track all object-level operations.
Apply IAM Policies for Least Privilege Access — Define group-based policies that grant minimum required permissions (e.g.,
Allow group ComputeAdmins to manage instances in compartment CompName). Use dynamic groups for resource-specific authentication. Checkpoint: Audit policies quarterly and remove orphaned permissions using OCI Audit service logs.
Implementation Patterns
Pattern 1: Provisioning an OCI Compute Instance with Python SDK
import oci
from typing import Optional
import logging
logger = logging.getLogger(__name__)
def create_compute_instance(
compute_client: oci.core.ComputeClient,
compartment_id: str,
availability_domain: str,
shape: str = "VM.Standard.E4.Flex",
ocpu_count: int = 2,
memory_in_gbs: float = 16.0,
image_id: str = "",
subnet_id: str = "",
ssh_public_key_path: str = "~/.oci/id_rsa.pub",
) -> oci.core.models.CreateInstanceDetails:
"""Create a Compute instance in OCI with production-ready configuration.
Args:
compute_client: Authenticated OCI ComputeClient instance.
compartment_id: OCID of the target compartment.
availability_domain: Target availability domain string.
shape: Instance shape (VM.Standard.E4.Flex, BM.Standard.E4.128).
ocpu_count: Number of OCPUs for flexible shapes.
memory_in_gbs: Memory in GB for flexible shapes.
image_id: OCID of the boot volume image. Defaults to latest Oracle Linux 9.
subnet_id: OCID of the subnet to attach.
ssh_public_key_path: Path to SSH public key file.
Returns:
The created Instance model object.
"""
if not image_id:
# Use OCI CLI to find latest Oracle Linux image in region
image_id = _get_latest_image(compute_client, compartment_id)
with open(oci.auth.signer.get_public_key_from_private_key_path(
ssh_public_key_path
), "r") as key_file:
ssh_public_key = key_file.read().strip()
instance_details = oci.core.models.CreateInstanceDetails(
availability_domain=availability_domain,
compartment_id=compartment_id,
shape=shape,
shape_config=oci.core.models.ShapeConfig(
ocpu_count=ocpu_count,
memory_in_gbs=memory_in_gbs
),
source_details=oci.core.models.InstanceSourceImageDetails(
source_type="image",
image_id=image_id,
boot_volume_size_in_gbs=50,
),
create_vnic_details=oci.core.models.CreateVnicDetails(
subnet_id=subnet_id,
assign_public_ip=False, # Private IP only for production
display_name=f"app-server-{compartment_id[:8]}",
),
metadata={
"ssh_authorized_keys": ssh_public_key,
"user_data": "#cloud-config\nhostname: app-server\n",
},
display_name="production-app-server",
)
response = compute_client.create_instance(instance_details)
instance = response.data
logger.info("Compute instance created: %s (OCID: %s)", instance.display_name, instance.id)
# Wait for instance to reach RUNNING state
waiter = oci.core.models.InstanceWaiters(compute_client)
waiter.wait_until(
"get_instance",
instance_id=instance.id,
operation_waiter_kwargs={
"wait_for_resource": _instance_is_running,
"max_wait_seconds": 300,
}
)
return instance
def _get_latest_image(compute_client: oci.core.ComputeClient, compartment_id: str) -> str:
"""Retrieve the latest Oracle Linux 9 image OCID in the region."""
image_client = oci.core.ImageClient(compute_client.region_endpoint)
images = image_client.list_images(
compartment_id=compartment_id,
operating_system="Oracle Linux",
operating_system_version="9",
sort_by="TIMECREATED",
sort_order="DESC",
access_level="PUBLIC",
).data
if not images:
raise ValueError("No Oracle Linux 9 images found in compartment")
return images[0].id
def _instance_is_running(instance):
"""Wait condition for instance to reach RUNNING state."""
return instance.lifecycle_state == "RUNNING"
Pattern 2: Managing Object Storage with Lifecycle Policies
import oci
from datetime import timedelta
from typing import Optional
class OCIObjectStorageManager:
"""Manages OCI Object Storage buckets, objects, and lifecycle policies."""
def __init__(self, object_storage_client: oci.object_storage.ObjectStorageClient):
self.storage = object_storage_client
def create_bucket(
self,
namespace: str,
bucket_name: str,
compartment_id: str,
versioning: bool = True,
public_access_type: str = "ObjectRead" | "NoPublicAccess",
) -> oci.object_storage.models.Bucket:
"""Create a new Object Storage bucket with versioning enabled.
Args:
namespace: Object storage namespace.
bucket_name: Unique name for the bucket within the namespace.
compartment_id: Target compartment OCID.
versioning: Enable object versioning for the bucket.
public_access_type: Access level for objects in this bucket.
Returns:
The created Bucket model.
"""
request = oci.object_storage.models.CreateBucketDetails(
name=bucket_name,
namespace=namespace,
compartment_id=compartment_id,
versioning="Enabled" if versioning else "Disabled",
public_access_type=public_access_type,
auto_tiering="ObjectTiering", # Auto-tier objects based on access patterns
)
response = self.storage.create_bucket(namespace, request)
logger.info("Bucket created: %s in namespace %s", bucket_name, namespace)
return response.data
def apply_lifecycle_policy(
self,
namespace: str,
bucket_name: str,
rules: list[dict],
) -> None:
"""Apply lifecycle management rules to a bucket.
Example rules:
- Archive objects older than 90 days (70% cost savings)
- Delete non-current versions after 180 days
- Remove incomplete multipart uploads after 24 hours
Args:
namespace: Object storage namespace.
bucket_name: Target bucket name.
rules: List of lifecycle rule dicts with 'name', 'action', and conditions.
"""
import json
request = oci.object_storage.models.PutBucketLifecycleRulesDetails(
lifecycle_rules=[
oci.object_storage.models.LifecycleRule(**rule) for rule in rules
]
)
self.storage.put_bucket_lifecycle_rules(namespace, bucket_name, request)
logger.info("Lifecycle policy applied to bucket: %s", bucket_name)
def upload_file(
self,
namespace: str,
bucket_name: str,
object_name: str,
file_path: str,
content_type: Optional[str] = None,
) -> None:
"""Upload a local file to an Object Storage bucket.
Args:
namespace: Object storage namespace.
bucket_name: Target bucket name.
object_name: Key for the uploaded object.
file_path: Path to the local file to upload.
content_type: MIME type for the uploaded object.
"""
with open(file_path, "rb") as f:
self.storage.put_object(
namespace,
bucket_name,
object_name,
body=f,
content_type=content_type or "application/octet-stream",
)
logger.info("Uploaded %s → %s/%s", file_path, bucket_name, object_name)
Pattern 3: Autonomous Database Connection Setup
import oci
from typing import Optional
def get_autonomous_db_wallet(
adb_client: oci.database.AutonomousDatabaseClient,
adb_instance_id: str,
wallet_password: str = "WalletP@ssw0rd!",
download_dir: str = "/tmp/wallets",
) -> dict:
"""Download the Oracle Wallet for an Autonomous Database instance.
The wallet contains the TLS certificates and connection strings needed
to securely connect to Autonomous Database from Python applications
using cx_Oracle or oracledb drivers.
Args:
adb_client: Authenticated AutonomousDatabaseClient.
adb_instance_id: OCID of the Autonomous Database instance.
wallet_password: Password for the downloaded wallet archive.
download_dir: Directory to save the wallet zip file.
Returns:
Dict with wallet download URL and password.
"""
from oci.exceptions import ServiceError
try:
response = adb_client.generate_autonomous_database_wallet(
autonomous_database_id=adb_instance_id,
password=wallet_password,
)
wallet_data = response.data
logger.info(
"Wallet generated for ADW instance %s. Download URL valid for 1 hour.",
adb_instance_id,
)
return {
"download_url": wallet_data.url,
"password": wallet_password,
"expiration_time": str(wallet_data.time_wallet_expired),
}
except ServiceError as e:
logger.error("Failed to generate wallet for %s: %s", adb_instance_id, e)
raise
# Connection string format for cx_Oracle / oracledb
# conn = oracledb.connect(
# user="admin",
# password=wallet_password,
# dsn=(
# f"(description=(retry_count=20)(retry_delay=3)"
# f"(address=(protocol=tcps)(port=1522)"
# f"(host={hostname}))(connect_data=(service_name={service_name}))"
# f"(security=(ssl_server_cert_match={hostname})))"
# )
# )
Constraints
MUST DO
- Validate all inputs at function boundaries before processing — guard clauses should fail early with descriptive errors
- Implement proper error handling that distinguishes between recoverable and unrecoverable failures
- Add comprehensive logging with structured context (correlation IDs, operation names, timing) for debugging and monitoring
- Write unit tests covering normal operations, edge cases, and error conditions before integrating the component
MUST NOT DO
- Do not silently swallow exceptions — always log or propagate errors with meaningful context
- Avoid unbounded resource allocation without limits (connection pools, memory buffers, thread counts)
- Never use hardcoded credentials, API keys, or secrets in source code
- Do not bypass input validation for perceived performance gains
Live References
Authoritative documentation links for this skill's domain. The model follows markdown links at load time to resolve external references and inline content.