# Oracle Dba Cloud Autonomous Oci

> USE THIS SKILL WHENEVER the user mentions Oracle Cloud / OCI, Autonomous Database (ADB / ATP / ADW / AJD / APEX), Autonomous DB monitoring or auto-patching, OCI Base Database Service / DB systems, cloud-managed backups / backup retention / long-term backups, ECPU/OCPU or storage auto-scaling, OCI IAM / database-access policy, the OCI CLI (`oci db ...`, `oci iam ...`), Exadata Cloud@Customer (ExaCC) / ExaDB-C / VM clusters, or cloud migration via Zero Downtime Migration (ZDM / zdmcli) or the OCI Database Migration Service (DMS) — EVEN IF they do not name the specific task. Covers Autonomous DB & Base DB provisioning (T2, dry-run-default), cloud backup configuration, auto-scaling configuration, OCI IAM policy-as-code (create/update), read-only ADB health and auto-patch monitoring, and the (plan-only, human-driven) Tier-3 runbooks for ExaCC management and cloud migration. Follows the oracle-dba-common contracts: SQLcl MCP saved connection dba_ai_conn for in-DB work, OCI CLI for control-plane host ops, Oracle Wal

- Skill: `shreyas70773/oracle-dba-cloud-autonomous-oci` (Agent Skill, multi-file: 21 files)
- Install (CLI): `npx skillmds@latest add shreyas70773/oracle-dba-cloud-autonomous-oci`
- Raw SKILL.md: https://api.skillmd.com/api/skills/shreyas70773/oracle-dba-cloud-autonomous-oci/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: Shreyas70773 (https://skillmd.com/u/shreyas70773)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/shreyas70773/oracle-dba-cloud-autonomous-oci

---

# Oracle DBA - Cloud / Autonomous (OCI)

Oracle on OCI for 19c and 23ai (EE; single-instance and Data Guard topologies; the same
contracts apply whether on-prem-managed or cloud-managed). In-DB observability runs through
the SQLcl MCP saved connection **`dba_ai_conn`**; cloud control-plane operations run through
the **OCI CLI** (host op — cannot go through SQLcl MCP, so these are `.sh`/`.ps1` "script"
mechanisms, later to front a guarded `oracle-dba-ops` MCP). Everything self-executing is
**T1 (observe)** or **T2 (reversible, dry-run-default)**. Provisioning-**terminate**, ExaCC
management, cloud **migration** (ZDM/DMS), and IAM policy **delete** are **T3** and live only
in `references/runbooks.md` — they print commands for a human and never self-execute.

Skill log segment: **`cloud-oci`** (logs to `/var/log/oracle-dba/cloud-oci/` on Linux,
`C:/ProgramData/oracle-dba/logs/cloud-oci/` on Windows).

## Scope & risk map

| Task | Level | Tier | Mechanism (script / sql / runbook path) | Idempotent? |
|------|-------|------|------------------------------------------|-------------|
| Autonomous DB monitoring | L1 | T1 | `scripts/checks/check_adb_health.sh` / `.ps1` + `sql/autonomous_db_monitoring.sql` (+ OCI CLI get) | yes — read-only (emits metrics + findings, never mutates) |
| Autonomous patching (auto-applied) — observe only | L1 | T1 | `scripts/checks/check_patch_status.sh` / `.ps1` + `sql/patch_status.sql` (+ OCI CLI maintenance get) | yes — read-only; ADB auto-patches, this only OBSERVES |
| Autonomous DB provisioning | L2 | T2 | `scripts/provision_autonomous_db.sh` / `.ps1` (OCI CLI `db autonomous-database create`) | yes — noop if an ADB with the same `--display-name` exists non-TERMINATED |
| OCI Base Database provisioning | L2 | T2 | `scripts/provision_base_db.sh` / `.ps1` (OCI CLI `db system launch`) | yes — noop if a DB system with the same `--display-name` exists non-TERMINATED |
| Cloud backup configuration | L2 | T2 | `scripts/configure_cloud_backup.sh` / `.ps1` (`--target adb\|base-db`) | yes — reads current retention; noop when it already matches desired (declarative) |
| Auto-scaling configuration | L2 | T2 | `scripts/configure_autoscaling.sh` / `.ps1` (ADB compute/storage flags) | yes — reads current flags; noop when already at desired state |
| OCI IAM / DB access policy management | L2 | T2 | `scripts/manage_iam_policy.sh` / `.ps1` (policy-as-code create/update) | yes — create-if-absent; noop when statements already equal the desired file; never deletes |
| Provision-**terminate** (ADB / Base DB / VM cluster) | lifecycle | **T3** | `references/runbooks.md#terminate-resource` | n/a — refused by the provision scripts |
| OCI IAM policy **removal** | structural | **T3** | `references/runbooks.md#iam-policy-remove` | n/a — refused by `manage_iam_policy` |
| Exadata Cloud@Customer (ExaCC) management | L3 | **T3** | `references/runbooks.md#exacc` | partial — scale-up reversible; storage scale-up & patch are one-way |
| Cloud migration (ZDM / DMS) | L3 | **T3** | `references/runbooks.md#zdm` | no — cutover/switchover is a point of no return |

## Preconditions

- **SQLcl MCP connection `dba_ai_conn`** is reachable and wallet-backed. All in-DB
  monitoring/inventory SQL (`sql/*.sql`) and prechecks run through it via `connect_db` /
  `Connect-Db`. On Autonomous DB this is the `ADMIN` (or least-privilege DBA) user via the
  downloaded wallet — never SYS/SYSTEM, and there is no SYSDBA on ADB Serverless. SYSDBA
  appears only inside a T3 runbook that explicitly states it, supplied interactively.
- **OCI CLI auth is configured on the host** for every control-plane op: `~/.oci/config`
  (API key) **or** an instance principal (`OCI_CLI_AUTH=instance_principal`). The OCI CLI
  is a **host op** — it cannot run through SQLcl MCP (restriction level 4), so it is wrapped
  in `.sh`/`.ps1`. Override the binary with `ODB_OCI_BIN` (path only, never creds).
- **Secrets resolve from the Oracle Wallet / OCI Vault. No plaintext anywhere.** DB ADMIN/
  SYS passwords for create/restore are passed only as a **Vault secret OCID**
  (`--admin-password-secret-id` via `ODB_ADMIN_PASSWORD_SECRET_OCID` /
  `ODB_BDB_PASSWORD_SECRET_OCID`); in `--execute` mode a missing secret OCID stops the
  script with `ERR_SECRET` (8). SSH keys for Base DB are **public** keys only
  (`ODB_BDB_SSH_PUBKEY_FILE` -> `*.pub`). Any argument matching a `user/pass@db` or
  `password=` pattern is rejected with `ERR_SECRET`.
- **Helpers are sourced from `_common`** (`scripts/lib.sh` / `lib.ps1`): `connect_db`,
  `log_event`, `emit_metric`, `require_dry_run`, `guard_blocked_dry_run`,
  `require_approval_token`, `precheck`, `postcheck`, `print_banner`. Not reinvented.
- **Logging**: structured `key=value` lines to `/var/log/oracle-dba/cloud-oci/cloud-oci.log`
  (Linux) / `C:/ProgramData/oracle-dba/logs/cloud-oci/cloud-oci.log` (Windows); skill
  segment `cloud-oci`.
- **T2 dry-run default**: every T2 script previews (`--dry-run`) and changes nothing unless
  given `--execute`. Provisioning is reversible (a resource can be terminated — a T3
  escape-hatch action); backup-retention, auto-scaling, and IAM policy edits are reversible
  declaratively. Routing follows `../references/INTEGRATION-PLAYBOOK.md`: in-DB SQL ->
  `sql/*.sql` via SQLcl MCP run-sql on `dba_ai_conn`; OCI control-plane -> `.sh`/`.ps1`
  ("script"); T3 -> runbook + approval token.

## Procedures

Scripts ship as behaviour-equivalent `.sh` (Linux) / `.ps1` (Windows) pairs. T2 scripts
default to `--dry-run`; pass `--execute` (or `-Execute`) to act. See each script's `--help`.

### Autonomous DB monitoring (T1)
- **Trigger**: continuous health/resource watch (every ~15 min); investigating an ADB slowdown.
- **Precheck**: none (read-only); the script self-probes `dba_ai_conn`.
- **Action**: `scripts/checks/check_adb_health.sh [--adb-ocid OCID] [--max-cpu-pct N] [--max-storage-pct N]` / `.ps1` + `sql/autonomous_db_monitoring.sql`.
- **Postcheck**: n/a — emits KEYVAL metrics (CPU%, max tbs%, blocked sessions, AAS, ADB lifecycle) + threshold findings (non-fatal).
- **Rollback note**: none — read-only.

### Autonomous patching (auto-applied) — observe only (T1)
- **Trigger**: daily, to confirm Oracle's auto-patch landed and the registry is clean; reconcile against the announced RU.
- **Precheck**: none (read-only).
- **Action**: `scripts/checks/check_patch_status.sh [--adb-ocid OCID] [--max-invalid N]` / `.ps1` + `sql/patch_status.sql`.
- **Postcheck**: n/a — emits applied-RU inventory, invalid-object/registry findings, OCI maintenance-window status.
- **Rollback note**: none — read-only. ADB patches itself; this skill never patches (any rollback is an Oracle-coordinated SR / patching-skill task).

### Autonomous DB provisioning (T2)
- **Trigger**: stand up a new ATP/ADW/AJD/APEX database in a compartment.
- **Precheck**: idempotency probe lists ADBs and matches `--display-name`; OCI CLI present; Vault password-secret OCID set for `--execute`.
- **Action**: `scripts/provision_autonomous_db.sh --execute --compartment-ocid OCID --display-name NAME --db-name NAME [--workload OLTP|DW|AJD|APEX] [--ecpu N] [--storage-gb N] [--db-version 19c|23ai] [--autoscale true|false]` / `.ps1`.
- **Postcheck**: the new ADB lifecycle state is `AVAILABLE`.
- **Rollback note**: reversible — terminate the ADB via `references/runbooks.md#terminate-resource` (T3; take a final long-term backup first).

### OCI Base Database provisioning (T2)
- **Trigger**: launch a new Base Database VM DB system (19c or 23ai) in a subnet/AD.
- **Precheck**: idempotency probe matches `--display-name`; OCI CLI present; Vault SYS-password secret + `*.pub` SSH key set for `--execute`.
- **Action**: `scripts/provision_base_db.sh --execute --compartment-ocid OCID --display-name NAME --db-name NAME --availability-domain AD --subnet-ocid OCID --hostname PREFIX [--shape S] [--cpu-core-count N] [--edition E] [--db-version 19.0.0.0|23.0.0.0] [--storage-gb N]` / `.ps1`.
- **Postcheck**: the new DB system lifecycle state is `AVAILABLE`.
- **Rollback note**: reversible — terminate the DB system via `#terminate-resource` (T3; terminates all DBs on it — take a final backup first).

### Cloud backup configuration (T2)
- **Trigger**: set/drift-correct automatic-backup retention for an ADB or a Base DB.
- **Precheck**: reads current retention; OCI CLI present; valid target + OCID.
- **Action**: `scripts/configure_cloud_backup.sh --target adb|base-db --execute [--retention-days N] [--adb-ocid OCID | --database-ocid OCID]` / `.ps1`.
- **Postcheck**: retention now equals the requested value.
- **Rollback note**: re-run with the prior `--retention-days`; declarative and reversible. (On-prem RMAN/scheduled backups live in the backup-and-recovery skill.)

### Auto-scaling configuration (T2)
- **Trigger**: enable/disable ADB compute (ECPU, burst to 3x) and/or storage auto-scaling.
- **Precheck**: reads current flags; OCI CLI present; valid ADB OCID.
- **Action**: `scripts/configure_autoscaling.sh --execute --adb-ocid OCID [--compute true|false] [--storage true|false]` / `.ps1`.
- **Postcheck**: compute (and, if set, storage) flags now match desired.
- **Rollback note**: online and reversible — toggle the flag back.

### OCI IAM / DB access policy management (T2)
- **Trigger**: apply policy-as-code governing who may manage/operate DB resources, Vault secrets, backups.
- **Precheck**: statements file exists; OCI CLI present; looks up the policy by `--name` and diffs statements (normalised).
- **Action**: `scripts/manage_iam_policy.sh --execute --compartment-ocid OCID --name NAME --statements-file PATH [--description TEXT]` / `.ps1` (create-if-absent, else update-statements).
- **Postcheck**: the policy exists and its statements equal the desired file.
- **Rollback note**: re-apply the prior statements file; declarative. **Deleting** a policy is T3 (`#iam-policy-remove`) — the T2 script refuses it. (CMU/EUS/IAM-DB integration is the security skill's domain, not this OCI-IAM layer.)

## Tier-3 runbooks

All **terminate / ExaCC / migration / policy-delete** work is Tier 3 and lives in
**`references/runbooks.md`**:
`#exacc` (Exadata Cloud@Customer management — VM-cluster scale, GI/DB RU via maintenance
runs, DB/DB-home create, node topology), `#zdm` (cloud migration via ZDM physical/logical
and OCI DMS), `#iam-policy-remove` (IAM policy delete escape hatch), and
`#terminate-resource` (terminate ADB / Base DB system / VM cluster escape hatch).

These runbooks **PRINT exact OCI-CLI / zdmcli / SQL commands for a human operator and NEVER
self-execute.** They are gated by `require_approval_token` / `Require-ApprovalToken`: an
automated agent's only sanctioned action is to print the relevant section and stop with
`ERR_APPROVAL` (6) until a human supplies a real change ticket/token (`--token <TICKET>` or
`ODB_APPROVAL_TOKEN`; placeholders rejected). The T2 scripts deliberately refuse the
destructive escape hatches (resource termination, IAM policy delete) and point to the
runbook instead. SYSDBA is a T3-only, interactively-supplied exception. When in doubt,
runbook.

See `references/version-notes.md` for 19c-vs-23ai behavioural deltas (the OCI control plane
is version-neutral — the Oracle release is always a parameter, never a different command).