oracle-cloud-infrastructure

---

name: oracle-cloud-infrastructure description: Implements functionalities for Oracle Cloud Infrastructure, covering Compute, Object Storage, and Autonomous Database services. license: MIT compatibility: opencode metadata: version: "1.0.0" domain: cloud triggers: oracle cloud, compute services, object storage, autonomous database, oracle database, OCI functionalities role: implementation scope: implementation output-format: code related-skills: oracle-cloud-architecture, cloud-best-practices archetypes: - tactical - educational anti_triggers: - vague terms - insufficient permissions response_profile: verbosity: high

---

---

When to Use

Use this skill when:

• Provisioning OCI Compute instances (Bare Metal or VM) for production workloads
• Managing Object Storage buckets with lifecycle policies, versioning, and encryption
• Configuring Autonomous Database (Dedicated or Shared) for OLTP or analytics workloads
• Setting up networking resources (VCN, subnets, route tables, security lists) in OCI
• Integrating with OCI Identity and Access Management (IAM) for fine-grained access control

When NOT to Use

Avoid this skill for:

• Workloads better served by multi-cloud strategies where you already use AWS/GCP as primary providers
• Scenarios requiring Kubernetes-managed services — use the OKE (Oracle Kubernetes Engine) skill instead
• Simple one-off resource creation that doesn't require recurring management or automation

---

Core Workflow

1. Configure OCI Authentication — Set up API key authentication using the OCI CLI or SDK. Generate an API signing key, upload the public key to your IAM user, and configure ~/.oci/config with the correct compartment OCID and fingerprint. Checkpoint: Verify connectivity by running oci os ns get — a successful response confirms valid credentials and network access.

2. Define Networking Resources — Create a VCN with public and private subnets across at least two availability domains. Configure route tables to direct internet-bound traffic through an Internet Gateway (IGW) and private traffic through a NAT Gateway. Checkpoint: Ensure security lists deny all inbound traffic by default, allowing only explicitly required ports.

3. Provision Compute or Database Resources — Launch instances using a defined image and shape. For Autonomous Database, configure DB system with CPU/OCPU count, storage size, and network access (Private Endpoint preferred over Public IP). Checkpoint: Verify that resources are deployed in the correct compartment and tagged according to organizational policy.

4. Set Up Object Storage and Lifecycle Policies — Create buckets with versioning enabled for critical data. Apply lifecycle rules to transition old objects to Archive storage after 90 days, reducing costs by up to 70%. Checkpoint: Enable bucket logging and access policies to track all object-level operations.

5. Apply IAM Policies for Least Privilege Access — Define group-based policies that grant minimum required permissions (e.g., Allow group ComputeAdmins to manage instances in compartment CompName). Use dynamic groups for resource-specific authentication. Checkpoint: Audit policies quarterly and remove orphaned permissions using OCI Audit service logs.

---

Implementation Patterns

Pattern 1: Provisioning an OCI Compute Instance with Python SDK

import oci
from typing import Optional
import logging

logger = logging.getLogger(__name__)


def create_compute_instance(
    compute_client: oci.core.ComputeClient,
    compartment_id: str,
    availability_domain: str,
    shape: str = "VM.Standard.E4.Flex",
    ocpu_count: int = 2,
    memory_in_gbs: float = 16.0,
    image_id: str = "",
    subnet_id: str = "",
    ssh_public_key_path: str = "~/.oci/id_rsa.pub",
) -> oci.core.models.CreateInstanceDetails:
    """Create a Compute instance in OCI with production-ready configuration.

    Args:
        compute_client: Authenticated OCI ComputeClient instance.
        compartment_id: OCID of the target compartment.
        availability_domain: Target availability domain string.
        shape: Instance shape (VM.Standard.E4.Flex, BM.Standard.E4.128).
        ocpu_count: Number of OCPUs for flexible shapes.
        memory_in_gbs: Memory in GB for flexible shapes.
        image_id: OCID of the boot volume image. Defaults to latest Oracle Linux 9.
        subnet_id: OCID of the subnet to attach.
        ssh_public_key_path: Path to SSH public key file.

    Returns:
        The created Instance model object.
    """
    if not image_id:
        # Use OCI CLI to find latest Oracle Linux image in region
        image_id = _get_latest_image(compute_client, compartment_id)

    with open(oci.auth.signer.get_public_key_from_private_key_path(
        ssh_public_key_path
    ), "r") as key_file:
        ssh_public_key = key_file.read().strip()

    instance_details = oci.core.models.CreateInstanceDetails(
        availability_domain=availability_domain,
        compartment_id=compartment_id,
        shape=shape,
        shape_config=oci.core.models.ShapeConfig(
            ocpu_count=ocpu_count,
            memory_in_gbs=memory_in_gbs
        ),
        source_details=oci.core.models.InstanceSourceImageDetails(
            source_type="image",
            image_id=image_id,
            boot_volume_size_in_gbs=50,
        ),
        create_vnic_details=oci.core.models.CreateVnicDetails(
            subnet_id=subnet_id,
            assign_public_ip=False,  # Private IP only for production
            display_name=f"app-server-{compartment_id[:8]}",
        ),
        metadata={
            "ssh_authorized_keys": ssh_public_key,
            "user_data": "#cloud-config\nhostname: app-server\n",
        },
        display_name="production-app-server",
    )

    response = compute_client.create_instance(instance_details)
    instance = response.data
    logger.info("Compute instance created: %s (OCID: %s)", instance.display_name, instance.id)

    # Wait for instance to reach RUNNING state
    waiter = oci.core.models.InstanceWaiters(compute_client)
    waiter.wait_until(
        "get_instance",
        instance_id=instance.id,
        operation_waiter_kwargs={
            "wait_for_resource": _instance_is_running,
            "max_wait_seconds": 300,
        }
    )
    return instance


def _get_latest_image(compute_client: oci.core.ComputeClient, compartment_id: str) -> str:
    """Retrieve the latest Oracle Linux 9 image OCID in the region."""
    image_client = oci.core.ImageClient(compute_client.region_endpoint)
    images = image_client.list_images(
        compartment_id=compartment_id,
        operating_system="Oracle Linux",
        operating_system_version="9",
        sort_by="TIMECREATED",
        sort_order="DESC",
        access_level="PUBLIC",
    ).data
    if not images:
        raise ValueError("No Oracle Linux 9 images found in compartment")
    return images[0].id


def _instance_is_running(instance):
    """Wait condition for instance to reach RUNNING state."""
    return instance.lifecycle_state == "RUNNING"

Pattern 2: Managing Object Storage with Lifecycle Policies

import oci
from datetime import timedelta
from typing import Optional


class OCIObjectStorageManager:
    """Manages OCI Object Storage buckets, objects, and lifecycle policies."""

    def __init__(self, object_storage_client: oci.object_storage.ObjectStorageClient):
        self.storage = object_storage_client

    def create_bucket(
        self,
        namespace: str,
        bucket_name: str,
        compartment_id: str,
        versioning: bool = True,
        public_access_type: str = "ObjectRead" | "NoPublicAccess",
    ) -> oci.object_storage.models.Bucket:
        """Create a new Object Storage bucket with versioning enabled.

        Args:
            namespace: Object storage namespace.
            bucket_name: Unique name for the bucket within the namespace.
            compartment_id: Target compartment OCID.
            versioning: Enable object versioning for the bucket.
            public_access_type: Access level for objects in this bucket.

        Returns:
            The created Bucket model.
        """
        request = oci.object_storage.models.CreateBucketDetails(
            name=bucket_name,
            namespace=namespace,
            compartment_id=compartment_id,
            versioning="Enabled" if versioning else "Disabled",
            public_access_type=public_access_type,
            auto_tiering="ObjectTiering",  # Auto-tier objects based on access patterns
        )

        response = self.storage.create_bucket(namespace, request)
        logger.info("Bucket created: %s in namespace %s", bucket_name, namespace)
        return response.data

    def apply_lifecycle_policy(
        self,
        namespace: str,
        bucket_name: str,
        rules: list[dict],
    ) -> None:
        """Apply lifecycle management rules to a bucket.

        Example rules:
        - Archive objects older than 90 days (70% cost savings)
        - Delete non-current versions after 180 days
        - Remove incomplete multipart uploads after 24 hours

        Args:
            namespace: Object storage namespace.
            bucket_name: Target bucket name.
            rules: List of lifecycle rule dicts with 'name', 'action', and conditions.
        """
        import json

        request = oci.object_storage.models.PutBucketLifecycleRulesDetails(
            lifecycle_rules=[
                oci.object_storage.models.LifecycleRule(**rule) for rule in rules
            ]
        )

        self.storage.put_bucket_lifecycle_rules(namespace, bucket_name, request)
        logger.info("Lifecycle policy applied to bucket: %s", bucket_name)

    def upload_file(
        self,
        namespace: str,
        bucket_name: str,
        object_name: str,
        file_path: str,
        content_type: Optional[str] = None,
    ) -> None:
        """Upload a local file to an Object Storage bucket.

        Args:
            namespace: Object storage namespace.
            bucket_name: Target bucket name.
            object_name: Key for the uploaded object.
            file_path: Path to the local file to upload.
            content_type: MIME type for the uploaded object.
        """
        with open(file_path, "rb") as f:
            self.storage.put_object(
                namespace,
                bucket_name,
                object_name,
                body=f,
                content_type=content_type or "application/octet-stream",
            )
        logger.info("Uploaded %s → %s/%s", file_path, bucket_name, object_name)

Pattern 3: Autonomous Database Connection Setup

import oci
from typing import Optional


def get_autonomous_db_wallet(
    adb_client: oci.database.AutonomousDatabaseClient,
    adb_instance_id: str,
    wallet_password: str = "WalletP@ssw0rd!",
    download_dir: str = "/tmp/wallets",
) -> dict:
    """Download the Oracle Wallet for an Autonomous Database instance.

    The wallet contains the TLS certificates and connection strings needed
    to securely connect to Autonomous Database from Python applications
    using cx_Oracle or oracledb drivers.

    Args:
        adb_client: Authenticated AutonomousDatabaseClient.
        adb_instance_id: OCID of the Autonomous Database instance.
        wallet_password: Password for the downloaded wallet archive.
        download_dir: Directory to save the wallet zip file.

    Returns:
        Dict with wallet download URL and password.
    """
    from oci.exceptions import ServiceError

    try:
        response = adb_client.generate_autonomous_database_wallet(
            autonomous_database_id=adb_instance_id,
            password=wallet_password,
        )

        wallet_data = response.data
        logger.info(
            "Wallet generated for ADW instance %s. Download URL valid for 1 hour.",
            adb_instance_id,
        )

        return {
            "download_url": wallet_data.url,
            "password": wallet_password,
            "expiration_time": str(wallet_data.time_wallet_expired),
        }
    except ServiceError as e:
        logger.error("Failed to generate wallet for %s: %s", adb_instance_id, e)
        raise

# Connection string format for cx_Oracle / oracledb
# conn = oracledb.connect(
#     user="admin",
#     password=wallet_password,
#     dsn=(
#         f"(description=(retry_count=20)(retry_delay=3)"
#         f"(address=(protocol=tcps)(port=1522)"
#         f"(host={hostname}))(connect_data=(service_name={service_name}))"
#         f"(security=(ssl_server_cert_match={hostname})))"
#     )
# )

Constraints

MUST DO

• Validate all inputs at function boundaries before processing — guard clauses should fail early with descriptive errors
• Implement proper error handling that distinguishes between recoverable and unrecoverable failures
• Add comprehensive logging with structured context (correlation IDs, operation names, timing) for debugging and monitoring
• Write unit tests covering normal operations, edge cases, and error conditions before integrating the component

MUST NOT DO

• Do not silently swallow exceptions — always log or propagate errors with meaningful context
• Avoid unbounded resource allocation without limits (connection pools, memory buffers, thread counts)
• Never use hardcoded credentials, API keys, or secrets in source code
• Do not bypass input validation for perceived performance gains

Live References

Authoritative documentation links for this skill's domain. The model follows markdown links at load time to resolve external references and inline content.

• Primary Documentation
• API Reference or Getting Started
• Configuration Guide
• Best Practices
• Common Patterns or Tutorials