Regions and Availability Domains are the fundamental OCI constructs that define the physical and logical deployment of resources. For compliance with data residency laws, selecting the correct geographic Region is the first and most critical decision. Availability Domains within a Region provide fault tolerance while keeping data within the required jurisdiction. While compartments, tagging, and policies are essential for organization and access control, they operate within the framework established by the chosen Region.

For a Compute instance to be directly reachable from the public internet via SSH, it must be placed in a public subnet. A public subnet has a route table rule directing traffic to an Internet Gateway. If the subnet is private, the instance will have no direct public IP path, even if the security list rules are correct. IAM policies govern user permissions, not network packet flow. The OS firewall is a possibility, but the network path is the primary prerequisite to check.

OCI Autonomous Database is designed for simple, push-button operations. Scaling compute (OCPUs) up or down can be done online with minimal to zero downtime, often automatically managed by the service. This is a key differentiator from other managed services like MySQL or Exadata, where scaling compute typically involves more manual steps, longer lead times, or planned downtime. NoSQL is not a relational database service for this transactional workload.

The policy uses a conditional clause (`where request.permission=’OBJECT_READ’`) to restrict the broad `manage objects` verb. The `manage objects` verb inherently includes many permissions (e.g., OBJECT_READ, OBJECT_WRITE, OBJECT_DELETE). The condition filters this, so the group is only allowed to perform actions where the requested permission is specifically OBJECT_READ. This is a precise way to grant read-only access to objects using a broader verb.

Volume Backups are point-in-time, region-specific copies of a block volume that are stored in Object Storage. They are ideal for cost-effective DR for non-critical workloads. You pay primarily for storage, not continuous data transfer. Restoring a backup to a new volume in a different region meets the “few hours” recovery objective. Volume Cloning is fast but within the same region. Volume Group Replication provides a robust, continuous cross-region DR solution but is more complex and costly, better suited for production.

The root cause is the function’s execution duration exceeding its configured timeout. OCI Functions allows you to configure the maximum duration a function can run before being terminated. Increasing this timeout value to accommodate the slow external API (e.g., to 60 seconds) is the direct solution. Increasing memory does not affect timeout. Network placement (private subnet) doesn’t solve the timeout. Asynchronous invocation might change how the caller experiences the delay but does not alter the function’s own maximum execution time limit.

The OCI Audit service is specifically designed for this purpose. It automatically captures IAM and service-level events across your tenancy. Crucially, these logs are immutable, cannot be altered or deleted by any user (including administrators), and are retained by Oracle for at least 365 days as per the service’s default policy. While you can route logs to Object Storage with WORM, the Audit service provides this compliance-grade retention and immutability out-of-the-box for audit trails.

Network Security Groups (NSGs) are the recommended, stateful, and granular way to define security rules based on dynamic groupings of instances (VNICs). Attaching an NSG to the app servers and another to the DB servers, with an ingress rule in the DB NSG specifying the app server NSG as the source, is a secure and maintainable design. Security Lists are stateless and subnet-based, which is less granular. Internet/NAT Gateways are for public internet access. A Service Gateway is for accessing OCI public services (like Object Storage) privately, not for inter-subnet communication.

OCI Container Instances are a serverless compute offering specifically for running containers. They launch quickly (fast cold start), can scale to zero (you only pay when the container is running), and abstract away the underlying VM management. OKE is for orchestrating many containers and has higher overhead. Oracle Functions is for event-driven function code, not generic containers. Manual Docker on VMs does not offer the serverless, scale-to-zero, or fast provisioning characteristics.

Regions and Availability Domains are the fundamental OCI constructs that define the physical and logical deployment of resources. For compliance with data residency laws, selecting the correct geographic Region is the first and most critical decision. Availability Domains within a Region provide fault tolerance while keeping data within the required jurisdiction. While compartments, tagging, and policies are essential for organization and access control, they operate within the framework established by the chosen Region.0