While IAM policies control who can access resources, and Cloud Guard can detect misconfigurations, Security Lists act as a virtual firewall at the subnet level. The most direct and foundational way to enforce ‘deny all public inbound by default’ is to configure the Security Lists in the Virtual Cloud Network (VCN) to block all inbound traffic from 0.0.0.0/0. This establishes a secure baseline, and specific rules can then be added to allow necessary traffic.

When an instance is running but unreachable on a specific port like SSH, the most common cause is a firewall rule issue. In OCI, security rules are enforced at the VNIC level by Security Lists (for the subnet) and Network Security Groups (attached to the VNIC). Checking the NSG rules first is a targeted approach, as NSGs are often used for application-specific security and are directly attached to the resource. The VNC console is a last-resort tool, not a first step.

Retention Rules are the native OCI Object Storage feature for enforcing legal and regulatory holds. They allow you to set duration-based or event-based rules that prevent objects from being deleted or overwritten for a specified period. Object Versioning helps with accidental deletion but doesn’t enforce immutability. Storage Tiers are for cost optimization, and PARs are for granting time-limited access.

This architecture follows OCI security best practices. The database resides in a private subnet without public IPs, eliminating direct internet exposure. Communication is initiated from the public subnet (web tier) to the private subnet (data tier). Using an NSG attached to the database VNIC provides granular, identity-based (at the subnet/VNIC level) firewall rules, allowing only the specific CIDR block of the web tier. This is more specific and manageable than relying solely on subnet-level Security Lists for this inter-tier communication.

In OCI IAM, verb semantics are crucial. The ‘manage’ verb typically includes full permissions (create, delete, move, update). The ‘use’ verb is the correct choice here, as it grants permissions to perform actions on an existing resource (like start, stop, restart, scale, clone) but explicitly excludes the ability to delete the resource or move it to another compartment. ‘Read’ and ‘inspect’ are lower-level permissions that do not allow for management operations.

Pre-Authenticated Requests (PARs) solve both the security and cost-tracking aspects. They provide time-limited, scoped access to objects without requiring the bucket to be public. By generating PARs from a backend service (not the mobile app itself), you maintain control, can track usage server-side, and can implement caching or CDN strategies. The PAR URLs are temporary, enhancing security over static public URLs. A Service Gateway is for OCI resource-to-resource traffic, not public internet access.

This approach embodies least privilege. A dynamic group defines *which* instances (e.g., by compartment or tag) can assume a role. Separate, granular policies then define *what* those instances can do. Granting ‘read’ on the specific secret (or secret-family) is sufficient to retrieve it, and ‘use’ on the specific stream allows for producing/consuming messages. A single broad policy (‘use on vaults and streams’) would grant excessive permissions. Instance Principal is the mechanism, but it must be paired with precise policies.

Block Volume Cross-Region Replication for Volume Groups is the native, managed OCI solution for this DR scenario. It provides crash-consistent, asynchronous replication of a group of volumes together (maintaining consistency across multiple volumes, like a boot and data volume), to a peer volume group in another region. This is automated, efficient (only changed blocks are replicated after the initial sync), and integrates with the console and APIs for failover/failback operations. Manual backups or custom scripts are error-prone and lack crash-consistency for multi-volume sets.

The OCI Audit service automatically logs all API calls (management plane operations) for OCI resources. Each audit event includes essential details such as the event time, the user or service principal that made the call, the type of event (e.g., ‘DeleteInstance’), the resource OCID, and the source IP address of the request. These logs are immutable and are the definitive source for answering ‘who did what, when, and from where’ for resource management actions. Flow Logs are for data plane (network traffic), not management actions.

While IAM policies control who can access resources, and Cloud Guard can detect misconfigurations, Security Lists act as a virtual firewall at the subnet level. The most direct and foundational way to enforce ‘deny all public inbound by default’ is to configure the Security Lists in the Virtual Cloud Network (VCN) to block all inbound traffic from 0.0.0.0/0. This establishes a secure baseline, and specific rules can then be added to allow necessary traffic.0