Oracle Dba Cloud Autonomous Oci

Oracle DBA - Cloud / Autonomous (OCI)

Oracle on OCI for 19c and 23ai (EE; single-instance and Data Guard topologies; the same contracts apply whether on-prem-managed or cloud-managed). In-DB observability runs through the SQLcl MCP saved connection dba_ai_conn; cloud control-plane operations run through the OCI CLI (host op — cannot go through SQLcl MCP, so these are .sh/.ps1 "script" mechanisms, later to front a guarded oracle-dba-ops MCP). Everything self-executing is T1 (observe) or T2 (reversible, dry-run-default). Provisioning-terminate, ExaCC management, cloud migration (ZDM/DMS), and IAM policy delete are T3 and live only in references/runbooks.md — they print commands for a human and never self-execute.

Skill log segment: cloud-oci (logs to /var/log/oracle-dba/cloud-oci/ on Linux, C:/ProgramData/oracle-dba/logs/cloud-oci/ on Windows).

Scope & risk map

Preconditions

• SQLcl MCP connection dba_ai_conn is reachable and wallet-backed. All in-DB monitoring/inventory SQL (sql/*.sql) and prechecks run through it via connect_db / Connect-Db. On Autonomous DB this is the ADMIN (or least-privilege DBA) user via the downloaded wallet — never SYS/SYSTEM, and there is no SYSDBA on ADB Serverless. SYSDBA appears only inside a T3 runbook that explicitly states it, supplied interactively.
• OCI CLI auth is configured on the host for every control-plane op: ~/.oci/config (API key) or an instance principal (OCI_CLI_AUTH=instance_principal). The OCI CLI is a host op — it cannot run through SQLcl MCP (restriction level 4), so it is wrapped in .sh/.ps1. Override the binary with ODB_OCI_BIN (path only, never creds).
• Secrets resolve from the Oracle Wallet / OCI Vault. No plaintext anywhere. DB ADMIN/ SYS passwords for create/restore are passed only as a Vault secret OCID (--admin-password-secret-id via ODB_ADMIN_PASSWORD_SECRET_OCID / ODB_BDB_PASSWORD_SECRET_OCID); in --execute mode a missing secret OCID stops the script with ERR_SECRET (8). SSH keys for Base DB are public keys only (ODB_BDB_SSH_PUBKEY_FILE -> *.pub). Any argument matching a user/pass@db or password= pattern is rejected with ERR_SECRET.
• Helpers are sourced from _common (scripts/lib.sh / lib.ps1): connect_db, log_event, emit_metric, require_dry_run, guard_blocked_dry_run, require_approval_token, precheck, postcheck, print_banner. Not reinvented.
• Logging: structured key=value lines to /var/log/oracle-dba/cloud-oci/cloud-oci.log (Linux) / C:/ProgramData/oracle-dba/logs/cloud-oci/cloud-oci.log (Windows); skill segment cloud-oci.
• T2 dry-run default: every T2 script previews (--dry-run) and changes nothing unless given --execute. Provisioning is reversible (a resource can be terminated — a T3 escape-hatch action); backup-retention, auto-scaling, and IAM policy edits are reversible declaratively. Routing follows ../references/INTEGRATION-PLAYBOOK.md: in-DB SQL -> sql/*.sql via SQLcl MCP run-sql on dba_ai_conn; OCI control-plane -> .sh/.ps1 ("script"); T3 -> runbook + approval token.

Procedures

Scripts ship as behaviour-equivalent .sh (Linux) / .ps1 (Windows) pairs. T2 scripts default to --dry-run; pass --execute (or -Execute) to act. See each script's --help.

Autonomous DB monitoring (T1)

• Trigger: continuous health/resource watch (every ~15 min); investigating an ADB slowdown.
• Precheck: none (read-only); the script self-probes dba_ai_conn.
• Action: scripts/checks/check_adb_health.sh [--adb-ocid OCID] [--max-cpu-pct N] [--max-storage-pct N] / .ps1 + sql/autonomous_db_monitoring.sql.
• Postcheck: n/a — emits KEYVAL metrics (CPU%, max tbs%, blocked sessions, AAS, ADB lifecycle) + threshold findings (non-fatal).
• Rollback note: none — read-only.

Autonomous patching (auto-applied) — observe only (T1)

• Trigger: daily, to confirm Oracle's auto-patch landed and the registry is clean; reconcile against the announced RU.
• Precheck: none (read-only).
• Action: scripts/checks/check_patch_status.sh [--adb-ocid OCID] [--max-invalid N] / .ps1 + sql/patch_status.sql.
• Postcheck: n/a — emits applied-RU inventory, invalid-object/registry findings, OCI maintenance-window status.
• Rollback note: none — read-only. ADB patches itself; this skill never patches (any rollback is an Oracle-coordinated SR / patching-skill task).

Autonomous DB provisioning (T2)

• Trigger: stand up a new ATP/ADW/AJD/APEX database in a compartment.
• Precheck: idempotency probe lists ADBs and matches --display-name; OCI CLI present; Vault password-secret OCID set for --execute.
• Action: scripts/provision_autonomous_db.sh --execute --compartment-ocid OCID --display-name NAME --db-name NAME [--workload OLTP|DW|AJD|APEX] [--ecpu N] [--storage-gb N] [--db-version 19c|23ai] [--autoscale true|false] / .ps1.
• Postcheck: the new ADB lifecycle state is AVAILABLE.
• Rollback note: reversible — terminate the ADB via references/runbooks.md#terminate-resource (T3; take a final long-term backup first).

OCI Base Database provisioning (T2)

• Trigger: launch a new Base Database VM DB system (19c or 23ai) in a subnet/AD.
• Precheck: idempotency probe matches --display-name; OCI CLI present; Vault SYS-password secret + *.pub SSH key set for --execute.
• Action: scripts/provision_base_db.sh --execute --compartment-ocid OCID --display-name NAME --db-name NAME --availability-domain AD --subnet-ocid OCID --hostname PREFIX [--shape S] [--cpu-core-count N] [--edition E] [--db-version 19.0.0.0|23.0.0.0] [--storage-gb N] / .ps1.
• Postcheck: the new DB system lifecycle state is AVAILABLE.
• Rollback note: reversible — terminate the DB system via #terminate-resource (T3; terminates all DBs on it — take a final backup first).

Cloud backup configuration (T2)

• Trigger: set/drift-correct automatic-backup retention for an ADB or a Base DB.
• Precheck: reads current retention; OCI CLI present; valid target + OCID.
• Action: scripts/configure_cloud_backup.sh --target adb|base-db --execute [--retention-days N] [--adb-ocid OCID | --database-ocid OCID] / .ps1.
• Postcheck: retention now equals the requested value.
• Rollback note: re-run with the prior --retention-days; declarative and reversible. (On-prem RMAN/scheduled backups live in the backup-and-recovery skill.)

Auto-scaling configuration (T2)

• Trigger: enable/disable ADB compute (ECPU, burst to 3x) and/or storage auto-scaling.
• Precheck: reads current flags; OCI CLI present; valid ADB OCID.
• Action: scripts/configure_autoscaling.sh --execute --adb-ocid OCID [--compute true|false] [--storage true|false] / .ps1.
• Postcheck: compute (and, if set, storage) flags now match desired.
• Rollback note: online and reversible — toggle the flag back.

OCI IAM / DB access policy management (T2)

• Trigger: apply policy-as-code governing who may manage/operate DB resources, Vault secrets, backups.
• Precheck: statements file exists; OCI CLI present; looks up the policy by --name and diffs statements (normalised).
• Action: scripts/manage_iam_policy.sh --execute --compartment-ocid OCID --name NAME --statements-file PATH [--description TEXT] / .ps1 (create-if-absent, else update-statements).
• Postcheck: the policy exists and its statements equal the desired file.
• Rollback note: re-apply the prior statements file; declarative. Deleting a policy is T3 (#iam-policy-remove) — the T2 script refuses it. (CMU/EUS/IAM-DB integration is the security skill's domain, not this OCI-IAM layer.)

Tier-3 runbooks

All terminate / ExaCC / migration / policy-delete work is Tier 3 and lives in references/runbooks.md: #exacc (Exadata Cloud@Customer management — VM-cluster scale, GI/DB RU via maintenance runs, DB/DB-home create, node topology), #zdm (cloud migration via ZDM physical/logical and OCI DMS), #iam-policy-remove (IAM policy delete escape hatch), and #terminate-resource (terminate ADB / Base DB system / VM cluster escape hatch).

These runbooks PRINT exact OCI-CLI / zdmcli / SQL commands for a human operator and NEVER self-execute. They are gated by require_approval_token / Require-ApprovalToken: an automated agent's only sanctioned action is to print the relevant section and stop with ERR_APPROVAL (6) until a human supplies a real change ticket/token (--token <TICKET> or ODB_APPROVAL_TOKEN; placeholders rejected). The T2 scripts deliberately refuse the destructive escape hatches (resource termination, IAM policy delete) and point to the runbook instead. SYSDBA is a T3-only, interactively-supplied exception. When in doubt, runbook.

See references/version-notes.md for 19c-vs-23ai behavioural deltas (the OCI control plane is version-neutral — the Oracle release is always a parameter, never a different command).