OCI hierarchy
graph TD
TEN[Tenancy
your-company.oraclecloud.com] --> REG1[Region: ap-mumbai-1]
TEN --> REG2[Region: uk-london-1]
REG1 --> AD1[Availability Domain 1]
REG1 --> AD2[Availability Domain 2]
AD1 --> COMP1[Compartment: Production]
AD1 --> COMP2[Compartment: Development]
COMP1 --> OIC[OIC Instance]
COMP1 --> ATP[ATP Database]
COMP1 --> OBJ[Object Storage Bucket]
COMP2 --> OIC2[OIC Dev Instance]
style TEN fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
style COMP1 fill:#0f2d1f,stroke:#22C55E,color:#e2e8f0
style COMP2 fill:#1e293b,stroke:#F59E0B,color:#e2e8f0
IAM policy patterns for PaaS developers
# Allow OIC to read/write Object Storage:
Allow service integrations to manage objects
in compartment Production
where target.bucket.name = 'oic-staging'
# Allow OIC to use ATP database:
Allow service integrations to use database-connections
in compartment Production
# Allow dev team to manage OIC:
Allow group OIC-Developers to manage integrations
in compartment Development
# Read-only for auditors:
Allow group Auditors to inspect integrations
in tenancy
Essential OCI CLI commands for PaaS work
# Install OCI CLI
pip install oci-cli
# Configure (creates ~/.oci/config)
oci setup config
# List all OIC instances in a compartment
oci integration integration-instance list \
--compartment-id ocid1.compartment.oc1..xxxxx \
--query "data[].{Name:"display-name",State:"lifecycle-state"}"
# Upload a certificate to OCI Certificates service
oci certs-mgmt certificate create \
--compartment-id ocid1.compartment.oc1..xxxxx \
--name my-sftp-cert \
--certificate-config file://cert-config.json
# Download ATP wallet
oci db autonomous-database generate-wallet \
--autonomous-database-id ocid1.autonomousdatabase.oc1..xxxxx \
--password "WalletPassword123#" \
--file atp-wallet.zip
# Upload file to Object Storage
oci os object put \
--bucket-name oic-staging \
--file-to-upload report.csv \
--name /incoming/report.csv
OCI regions — choose correctly
| Region | Code | Good for |
|---|---|---|
| Mumbai | ap-mumbai-1 | India-based clients |
| London | uk-london-1 | UK/Europe clients |
| Dubai | me-dubai-1 | Middle East clients |
| Ashburn | us-ashburn-1 | US clients, largest region |
| Frankfurt | eu-frankfurt-1 | GDPR-sensitive EU data |
Always deploy OIC, ATP, and Oracle Fusion in the same region. Cross-region calls add 50-200ms latency per round-trip — enough to noticeably slow integrations.
Free tier for development
OCI Always Free includes:
- 2 AMD compute VMs (1 OCPU, 1GB RAM each) — enough for a Connectivity Agent
- 2 Autonomous Databases (20GB each) — development schema storage
- 10GB Object Storage — staging files for OIC
- OCI IAM — identity and access management
This covers a full OIC development stack at zero cost.