Create Oracle Cloud resources

Create a compartment

Compartments let you organize and control access to your cloud resources. It's a logical container that you can use to group related cloud resources together and let specific user groups access.

When you sign up for Oracle Cloud Infrastructure, Oracle creates your tenancy, which is the root compartment that holds all your cloud resources. You then create additional compartments within your tenancy and the corresponding policies to control access to the resources in each compartment.

To create a compartment:

Open the Oracle Cloud console navigation menu, and then click Identity & Security.
Under Identity, click Compartments. A list of the compartments you have access to is displayed.
Navigate to the compartment where you want to create the new compartment.
- To create the compartment in the tenancy (root compartment) click Create Compartment.
- To create the compartment in a compartment other than the tenancy (root compartment), click through the hierarchy of compartments until you reach the detail page of the compartment where you want to create the compartment. On the Compartment Details page, click Create Compartment.
In the Create Compartment dialog, complete the fields as follows:
1. For Name, enter a unique name for the compartment, no more than 100 characters (includes letters, numbers, periods, hyphens, and underscores). The name must be unique across all compartments in the tenancy. Avoid entering confidential information.
2. For Description, enter a description that helps distinguish the compartment from others.
3. For Parent Compartment, verify that this is the compartment where you want to create your compartment. To choose a different compartment, select one from the dropdown.
4. (Optional) For Tag Namespace, you can add a free-form tag to help you search for you resources in the Oracle Cloud console. Click + Another Tag to add more tags.
5. Click Create Compartment.

Your compartment appears in the Compartments list after it's created. You can now create policies and add resources to your compartment.

Create a Virtual Cloud Network and subnet

A virtual cloud network (VCN) is a network that you set up in the Oracle Cloud Infrastructure data centers in a particular region. A subnet is a subdivision of a VCN.

OCI GoldenGate requires a VCN and at least one private subnet with a NAT Gateway. A route table with a route rule redirecting traffic to the NAT Gateway for the private subnet must be available. If you want to enable connectivity using a public endpoint then a public subnet is also required and the VCN must include an Internet Gateway. A route table with a route rule redirecting traffic to the Internet Gateway for the public subnet must be available.

To create a VCN and subnet:

Open the Oracle Cloud console navigation menu, click Networking, and then select Virtual cloud networks.
On the Virtual Cloud Networks page, confirm the compartment selection, or select a different compartment.
From the Actions menu, select Start VCN Wizard.
In the Start VCN Wizard panel, select Create VCN with Internet Connectivity, and then click Start VCN Wizard.
On the Configuration page, under Basic information, enter a VCN name.
For Compartment, select the compartment in which to create this VCN.
Click Next.
On the Review and Create page, verify the configuration details, and then click Create.

Click View VCN Details to verify that both a Public and Private subnet were created.

Create users

Create users to add to groups that can access to your OCI GoldenGate resources.

Before you create users, understand that:

OCI GoldenGate deployment user management depends on whether your tenancy uses OCI IAM with Identity Domains or not. See Manage deployment users.
User names must be unique across all users within your tenancy
User names are unchangeable
Users have no permissions until they're placed in a group

To create users:

Open the Oracle Cloud console navigation menu, click Identity & Security, and then under Identity, click Domains.
On the Domains page, confirm the Compartment selection, or change to another compartment.
In the Domains list, click Default to access the default domain, or click Create Domain to createa new one.
Select the domain from the list.
On the Domains details page, click User management.
On the Users page, click Create user.
On the Create user page, complete the fields as follows:
1. Enter the user's First name, Last name, and Email address, which can also be used as the Username.
  
  Note
  
  The name must be unique across all users in the tenancy. You cannot change this value later. The user name cannot contain spaces, and can only consist of basic Latin letters (ASCII), numerals, hyphens, periods, underscores, +, and @.
2. For Groups, select the groups to assign the user to.
Click Create.

You can then add the user to a group and create policies that give the group access to your resources. For more information about users, see Managing users.

Create groups

A group is a collection of users who require the same type of access to a set of resources or compartments.

Before you create a group, understand that:

The group name must be unique within the tenancy.
The group name cannot be changed once created.
A group has no permissions unles you write at least one permission that gives the group permission to a tenancy or compartment.

To create a group:

Open the Oracle Cloud console navigation menu, click Identity & Security, and then under Identity, click Domains.
On the Domains page, confirm the Compartment selection, or change the compartment.
Select a domain from the list.
On the Domain details page, click User management.
Under Groups, click Create Group.
On the Create group page:
1. For Name, enter a unique name for the group.
  
  Note
  
  Once the group is created, you cannot change the name. The group name must be unique within the tenancy. The group name can be 1 to 100 alphanumeric characters long, upper or lowercase letters, and can contain periods, dashes, hyphens, but no spaces
2. For Description, enter a friendly description.
Select whether a User can request access to this group.
From the Users list, select the users to assign to this group.
Click Create.

A group doesn't have any permissions until you write a policy that gives the group permission to a compartment or tenancy. For more information about groups, see Managing groups.

Create policies

Policies define what actions members of a group can perform, and in which compartments.

You create policies using the Oracle Cloud console. In the Oracle Cloud console navigation menu, go to Identity & Security, and then under Identity, and click Policies. Policies are written in the following syntax:

allow group <identity-domain>/<group-name> to <verb> <resource-type> in <location> where <condition>

<identity-domain>: (Optional) If using OCI IAM for identity management, then include the identity domain of the user group. If omitted, then OCI uses the default domain.
<group-name>: The name of the user group you're giving permissions to
<verb>: Gives the group a certain level of access to a resource-type. As the verbs go from inspect to read to use to manage, the level of access increases and the permissions granted are cumulative.
To learn about the relationship between permissions and verbs, see Permissions.
<resource-type>: The type of resource you're giving a group permission to work with. There are individual resources, such as goldengate-deployments, goldengate-pipelines, and goldengate-connections, and there are resource families, such as goldengate-family, which includes the individual resources previously mentioned.
For more information, see resource-types.
<location>: Attaches the policy to a compartment or tenancy. You can specify a single compartment or compartment path by name or OCID, or specify tenancy to cover the entire tenancy.
<condition>: Optional. One or more conditions for which this policy will apply.

Learn more about policy syntax.

How to create a policy

To create a policy:

In the Oracle Cloud navigation menu, select Identity & Security, and then Policies.
Click Create Policy.
Enter a name and description for the policy.
Select the Compartment in which to create this policy.
In the Policy Builder section, select a Policy use case and common policy template, or use the manuel editor toenter a policy rule in the following format:
```
allow <subject> to <verb> <resource-type> in <location> where <condition>
```
Conditions are optional. See Details for Verbs + Resource-Type Combinations.
Click Create.

For more information about policies, see how policies work, policy syntax, and policy reference.

Minimum recommended policies

At minimum, you need policies to:

Allow users to use or manage GoldenGate resources, so that they can work with deployments and connections. For example:
```
allow group <identity-domain>/<group-name> to manage goldengate-family in <location>
```
Allow users to manage network resources, so that they can view and select compartments and subnets, and create and delete private endpoints when creating GoldenGate resources. For example:
```
allow group <identity-domain>/<group-name> to manage virtual-network-family in <location>
```
Optionally, you can further secure network resources using a combination of granular policies. See Policy Examples for Securing Network Resources.

Define a dynamic group for your GoldenGate deployments to access resources in your tenancy:

name: goldengate_deployments
Matching rule: ALL {resource.type = 'goldengatedeployment', resource.compartment.id = '<location>'}

If using GoldenGate pipelines, define a dynamic group for your pipelines to access resources in your tenancy:
```
name: goldengate_pipelines
Matching rule: ALL {resource.type = 'goldengatepipeline', resource.compartment.id = '<location>'}
```

Allow users to read the Identity and Access Management (IAM) user and group for validations in IAM enabled tenancies:

allow service goldengate to {idcs_user_viewer, domain_resources_viewer} in <location>

allow dynamic-group <dynamic-group-name> to {idcs_user_viewer, domain_resources_viewer} in <location>

Oracle Vault, to access customer managed encryption keys and password secrets. For example:

allow group <identity-domain>/<group-name> to manage secret-family in <location>
allow group <identity-domain>/<group-name> to use keys in <location>
allow group <identity-domain>/<group-name> to use vaults in <location>
allow dynamic-group <dynamic-group-name> to use keys in <location>
allow dynamic-group <dynamic-group-name> to use vaults in <location> 
allow dynamic-group <dynamic-group-name> to read secret-bundles in <location>

Depending on whether you intend to use the following services, you may also need to add policies for:

Oracle Databases, for your source and/or target databases. For example:

allow group <identity-domain>/<group-name> to read database-family in <location>

allow group <identity-domain>/<group-name> to read autonomous-database-family in <location>

Oracle Object Storage, to store manual OCI GoldenGate backups. For example:

allow group <identity-domain>/<group-name> to manage objects in <location>
allow dynamic-group <dynamic-group-name> to manage objects in <location>
allow group <identity-domain>/<group-name> to inspect buckets in <location>

OCI Logging, to access log groups. For example:

allow group <identity-domain>/<group-name> to read log-groups in <location>
allow group <identity-domain>/<group-name> to read log-content in <location>

Load Balancer, if you enable public access to the deployment console:

allow group <identity-domain>/<group-name> to manage load-balancers in <location>
allow group <identity-domain>/<group-name> to manage public-ips in <location> 
 
allow group <identity-domain>/<group-name> to manage network-security-groups in <location>
allow group <identity-domain>/<group-name> to manage vcns in <location> where ANY {request.operation = 'CreateNetworkSecurityGroup', request.operation = 'DeleteNetworkSecurityGroup'}

Work requests:

allow group <identity-domain>/<group-name> to inspect work-requests in <location>

The following statement gives a group permission to manage tag-namespaces and tags for workspaces:

allow group <identity-domain>/<group-name> to manage tag-namespaces in <location>

To add a defined tag, you must have permission to use the tag namespace. To learn more about tagging, see Resource Tags.

For more information and additional example policies, see OCI GoldenGate Policies.

Oracle Cloud Infrastructure Documentation