{"id":881,"date":"2026-04-16T13:09:24","date_gmt":"2026-04-16T13:09:24","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-base-database-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-data-management\/"},"modified":"2026-04-16T13:09:24","modified_gmt":"2026-04-16T13:09:24","slug":"oracle-cloud-base-database-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-data-management","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-base-database-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-data-management\/","title":{"rendered":"Oracle Cloud Base Database Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Data Management"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Data Management<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p><strong>What this service is<\/strong><br\/>\nBase Database is Oracle Cloud Infrastructure (OCI) managed infrastructure for running <strong>Oracle Database<\/strong> on dedicated <strong>virtual machine (VM)<\/strong> or <strong>bare metal<\/strong> database systems, where Oracle manages the underlying OCI infrastructure lifecycle and you manage the database configuration and (to varying degrees) patching and operations.<\/p>\n\n\n\n<p><strong>Simple explanation (one paragraph)<\/strong><br\/>\nIf you want the control and compatibility of a traditional Oracle Database deployment (OS-level access on the DB host, familiar tooling, full database feature set depending on edition), but you also want cloud provisioning, cloud networking, cloud monitoring, and cloud-integrated backups, Base Database is OCI\u2019s core \u201crun Oracle Database on dedicated compute\u201d service.<\/p>\n\n\n\n<p><strong>Technical explanation (one paragraph)<\/strong><br\/>\nBase Database (often referenced in official docs as <strong>Oracle Base Database Service<\/strong>) provisions <strong>DB systems<\/strong> (VM or bare metal) inside your OCI <strong>VCN<\/strong> and <strong>subnet<\/strong>, creates <strong>Database Homes<\/strong> (Oracle software images), and then creates <strong>Databases<\/strong> (CDB\/PDB depending on version\/config). It integrates with OCI Identity and Access Management (IAM), KMS\/Vault for encryption keys, Object Storage for backups, OCI networking controls (security lists\/NSGs), and OCI Monitoring\/Logging. You can scale compute and storage within service constraints and optionally implement higher availability and disaster recovery using Oracle database technologies (for example, Data Guard), depending on version\/edition and your design.<\/p>\n\n\n\n<p><strong>What problem it solves<\/strong><br\/>\nBase Database solves the gap between self-managed Oracle Database on IaaS and fully autonomous databases: it provides <strong>fast provisioning, cloud-native integration, and predictable operational boundaries<\/strong> while preserving <strong>administrative control, compatibility, and customization<\/strong> that many enterprise Oracle workloads require.<\/p>\n\n\n\n<blockquote>\n<p>Naming note (important): In OCI, you may see this offering referred to as <strong>\u201cOracle Base Database Service\u201d<\/strong> and the main resource type as <strong>\u201cDB System.\u201d<\/strong> Older Oracle \u201cDatabase Cloud Service\u201d terminology from Oracle Cloud \u201cClassic\u201d is a different generation and should not be confused with OCI Base Database. Verify the latest naming in the official docs: https:\/\/docs.oracle.com\/en-us\/iaas\/base-database\/home.htm<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Base Database?<\/h2>\n\n\n\n<p><strong>Official purpose<\/strong><br\/>\nBase Database is the OCI service for deploying Oracle Database on dedicated VM or bare metal DB systems with OCI-managed infrastructure constructs and cloud integrations, while allowing customers to manage database configuration and day-to-day DBA activities.<\/p>\n\n\n\n<p><strong>Core capabilities (high level)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Provision Oracle Database on <strong>VM DB systems<\/strong> or <strong>Bare Metal DB systems<\/strong><\/li>\n<li>Create and manage <strong>Database Homes<\/strong> (Oracle software installations) and <strong>Databases<\/strong><\/li>\n<li>Configure <strong>network placement<\/strong> in your VCN\/subnets and control access with NSGs\/security lists<\/li>\n<li>Use <strong>automatic backups<\/strong> (stored in OCI Object Storage) and on-demand backups (service-dependent)<\/li>\n<li>Apply <strong>patching<\/strong> workflows for database and (in some cases) grid\/host components depending on DB system type and your chosen approach<\/li>\n<li>Integrate with OCI security and governance: IAM policies, compartments, tagging, Vault\/KMS (for encryption keys), Audit, Monitoring<\/li>\n<\/ul>\n\n\n\n<p><strong>Major components (what you actually create\/manage in OCI)<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>DB System<\/strong>: The database host(s) on VM or bare metal. This is the main infrastructure resource.<\/li>\n<li><strong>Database Home<\/strong>: The Oracle Database software image installed on the DB system (e.g., a specific Oracle Database version\/patch level).<\/li>\n<li><strong>Database<\/strong>: The database instance\/configuration created within a Database Home.<\/li>\n<li><strong>Networking<\/strong>: VCN, subnet, NSG\/security lists, route tables, DNS settings, optional private endpoints and bastion patterns.<\/li>\n<li><strong>Backups<\/strong>: Automatic backups and related retention (stored in Object Storage; details depend on configuration and region\/service capabilities\u2014verify in official docs).<\/li>\n<\/ul>\n\n\n\n<p><strong>Service type<\/strong><br\/>\nA <strong>managed database infrastructure service<\/strong> (sometimes described as \u201cDBaaS on dedicated compute\u201d)\u2014not serverless and not multi-tenant autonomous. You typically have OS access (SSH) to the DB host for VM\/bare metal DB systems and you manage many DBA tasks.<\/p>\n\n\n\n<p><strong>Scope (regional\/global\/project\/account)<\/strong><br\/>\nBase Database is <strong>regional<\/strong> in OCI and deployed into specific <strong>Availability Domains (ADs)<\/strong> (where applicable) within a region. Resources are organized by <strong>tenancy \u2192 compartment \u2192 region<\/strong>. Networking is within a region (VCN is regional), and DR designs may use cross-region replication\/standby patterns.<\/p>\n\n\n\n<p><strong>How it fits into the Oracle Cloud ecosystem<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Oracle Cloud Networking (VCN)<\/strong> provides isolation, routing, and access controls.<\/li>\n<li><strong>OCI Object Storage<\/strong> is commonly used for backups.<\/li>\n<li><strong>OCI Vault (KMS)<\/strong> can be used for key management (e.g., TDE key management patterns).<\/li>\n<li><strong>OCI Bastion<\/strong> provides secure administrative access patterns without public IPs.<\/li>\n<li><strong>OCI Monitoring, Logging, Events, Notifications<\/strong> support operational observability and automation.<\/li>\n<li><strong>Oracle Autonomous Database<\/strong> is a separate service for managed\/autonomous operation; Base Database is chosen when you need more control.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Base Database?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Licensing flexibility<\/strong>: Depending on your needs, you can choose <strong>Bring Your Own License (BYOL)<\/strong> or <strong>License Included<\/strong> models (availability depends on region\/edition\u2014verify in pricing and docs).<\/li>\n<li><strong>Compatibility and control<\/strong>: Many commercial applications require specific Oracle versions\/options or DBA-level control that autonomous offerings may not fit.<\/li>\n<li><strong>Faster time to provision<\/strong> than building everything manually on compute instances, while still keeping a \u201ctraditional Oracle DB\u201d operational model.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dedicated compute<\/strong> (VM or bare metal) for predictable performance and isolation.<\/li>\n<li><strong>OCI-native networking<\/strong> (private subnets, NSGs, service gateways) that aligns with enterprise landing zones.<\/li>\n<li><strong>Database Home lifecycle<\/strong> management (versioning and patching workflows) instead of manually managing Oracle installs on raw VMs.<\/li>\n<li><strong>Integration with Oracle database HA\/DR technologies<\/strong> (capabilities depend on edition\/version and design; verify current support in docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Repeatable provisioning<\/strong> (console, API, CLI, Terraform) aligned with infrastructure-as-code.<\/li>\n<li><strong>Backups integrated with OCI<\/strong> (Object Storage) with policy-driven retention.<\/li>\n<li><strong>Compartment-based governance<\/strong> and tagging for chargeback\/showback.<\/li>\n<li><strong>Monitoring<\/strong> via OCI services and Oracle database tooling.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Private networking by default<\/strong> (recommended): run DBs without public IPs and control access through bastion + NSGs.<\/li>\n<li><strong>Encryption<\/strong>: Oracle Database Transparent Data Encryption (TDE) patterns, plus OCI encryption at rest for storage, and TLS for in-transit connections (implementation depends on your configuration).<\/li>\n<li><strong>Auditability<\/strong>: OCI Audit for API calls and database auditing at the DB level.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Scale within service constraints by selecting appropriate shapes and storage sizing.<\/li>\n<li>Bare metal options for high I\/O and predictable latency.<\/li>\n<li>Performance tuning remains under DBA control (SGA\/PGA, indexing, partitioning, etc.).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose Base Database<\/h3>\n\n\n\n<p>Choose Base Database when you need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Database with <strong>OS\/DBA-level control<\/strong><\/li>\n<li>Specific <strong>Oracle versions<\/strong> or configurations<\/li>\n<li><strong>Private network<\/strong> deployment with controlled connectivity<\/li>\n<li>A path to <strong>HA\/DR<\/strong> using Oracle technologies while staying on OCI-managed infrastructure constructs<\/li>\n<li>Infrastructure-as-code provisioning and standardized environments (dev\/test\/prod)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose Base Database<\/h3>\n\n\n\n<p>Avoid Base Database when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You want <strong>minimal DBA overhead<\/strong> and fully managed tuning\/patching (consider Autonomous Database).<\/li>\n<li>You don\u2019t require Oracle Database specifically (consider OCI MySQL HeatWave, PostgreSQL offerings, or open-source on compute).<\/li>\n<li>You need <strong>serverless auto-scaling<\/strong> semantics or extremely simple operational model.<\/li>\n<li>Your team cannot support <strong>DBA responsibilities<\/strong> (patch planning, backups validation, parameter tuning, upgrades).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Base Database used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services (core banking integrations, risk systems)<\/li>\n<li>Telecommunications (billing, subscriber systems)<\/li>\n<li>Healthcare and life sciences (claims, EMR integrations)<\/li>\n<li>Retail and e-commerce (orders, inventory, CRM backends)<\/li>\n<li>Manufacturing and logistics (ERP, supply chain)<\/li>\n<li>Public sector (records systems, compliance-heavy workloads)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Platform engineering teams running shared database platforms<\/li>\n<li>DBA teams modernizing Oracle estates to cloud<\/li>\n<li>DevOps\/SRE teams operating app + database stacks with IaC<\/li>\n<li>Security and compliance teams enforcing network isolation and audit controls<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Commercial packaged applications that require Oracle Database<\/li>\n<li>OLTP systems with strict integrity and concurrency requirements<\/li>\n<li>Mixed OLTP + reporting (with careful workload management)<\/li>\n<li>Multi-schema enterprise systems with complex PL\/SQL logic<\/li>\n<li>Integration hubs and operational data stores<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>2-tier and 3-tier enterprise applications (app servers \u2192 database)<\/li>\n<li>Hub-and-spoke networks with shared services and centralized security<\/li>\n<li>Multi-environment landing zones (dev\/test\/stage\/prod separated by compartments and VCNs)<\/li>\n<li>Hybrid connectivity (on-prem \u2194 OCI via FastConnect\/VPN) for phased migrations<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Lift-and-shift from on-prem Oracle to OCI with minimal changes<\/li>\n<li>Re-platforming with improved network security (private subnets, bastion)<\/li>\n<li>Consolidation of multiple smaller databases into fewer standardized DB systems (within resource limits)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dev\/test<\/strong>: Smaller shapes, shorter backup retention, scheduled downtime acceptable<\/li>\n<li><strong>Production<\/strong>: Private endpoints, strict NSG rules, automated backups, monitoring\/alerting, HA\/DR design, controlled patch windows, defined RPO\/RTO<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic Base Database scenarios. Each includes the problem, why Base Database fits, and a short example.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Lift-and-shift an on-prem Oracle OLTP database<\/strong>\n   &#8211; <strong>Problem:<\/strong> You need to migrate quickly with minimal code changes and maintain DBA control.\n   &#8211; <strong>Why Base Database fits:<\/strong> Traditional Oracle deployment model with cloud provisioning and OCI networking.\n   &#8211; <strong>Example:<\/strong> Move a 4 TB OLTP database from on-prem to OCI VM DB system; keep same schema\/PLSQL; integrate with on-prem via FastConnect.<\/p>\n<\/li>\n<li>\n<p><strong>Run a packaged enterprise application that mandates Oracle Database<\/strong>\n   &#8211; <strong>Problem:<\/strong> Vendor requires Oracle Database version\/config and rejects autonomous models.\n   &#8211; <strong>Why this fits:<\/strong> You control OS\/database configuration and patch cadence.\n   &#8211; <strong>Example:<\/strong> ERP backend requires specific database patch level and initialization parameters; you standardize DB Homes across environments.<\/p>\n<\/li>\n<li>\n<p><strong>Private database in a regulated network zone<\/strong>\n   &#8211; <strong>Problem:<\/strong> Compliance mandates no public DB endpoints and strict east-west controls.\n   &#8211; <strong>Why this fits:<\/strong> Deploy DB system in private subnet, restrict with NSGs, administer via OCI Bastion.\n   &#8211; <strong>Example:<\/strong> Claims processing database only reachable from app subnet; DB admin uses bastion port forwarding with MFA.<\/p>\n<\/li>\n<li>\n<p><strong>Standardize dev\/test database provisioning<\/strong>\n   &#8211; <strong>Problem:<\/strong> Teams wait days for DB environments; manual installs create drift.\n   &#8211; <strong>Why this fits:<\/strong> Repeatable DB system + Database Home creation, consistent baseline images.\n   &#8211; <strong>Example:<\/strong> Terraform module provisions a VM DB system and creates a database per team with tags for cost allocation.<\/p>\n<\/li>\n<li>\n<p><strong>Centralized shared database platform for multiple apps<\/strong>\n   &#8211; <strong>Problem:<\/strong> Many apps need Oracle; each running a separate VM is expensive and inconsistent.\n   &#8211; <strong>Why this fits:<\/strong> Consolidate multiple schemas\/databases on a standardized DB system (within resource constraints).\n   &#8211; <strong>Example:<\/strong> Platform team runs a DB system per environment; apps connect via private endpoints and distinct users\/roles.<\/p>\n<\/li>\n<li>\n<p><strong>High-performance transactional system needing dedicated I\/O<\/strong>\n   &#8211; <strong>Problem:<\/strong> Latency-sensitive transactions require predictable performance.\n   &#8211; <strong>Why this fits:<\/strong> Bare metal DB system options and dedicated resources.\n   &#8211; <strong>Example:<\/strong> Trading order system uses bare metal with tuned storage and network paths.<\/p>\n<\/li>\n<li>\n<p><strong>Implement DR with standby databases (Data Guard pattern)<\/strong>\n   &#8211; <strong>Problem:<\/strong> Business requires recovery in another AD\/region.\n   &#8211; <strong>Why this fits:<\/strong> Oracle HA\/DR tooling can be used with OCI network design.\n   &#8211; <strong>Example:<\/strong> Primary in Region A, standby in Region B; planned switchover for patching and DR drills. (Verify support matrix in docs.)<\/p>\n<\/li>\n<li>\n<p><strong>Database modernization with OCI Observability<\/strong>\n   &#8211; <strong>Problem:<\/strong> On-prem monitoring is fragmented; you want unified alerts.\n   &#8211; <strong>Why this fits:<\/strong> Integrate with OCI Monitoring\/Alarms and optionally Database Management service.\n   &#8211; <strong>Example:<\/strong> Alarms on CPU, storage, and DB performance KPIs; notifications to on-call.<\/p>\n<\/li>\n<li>\n<p><strong>Secure analytics staging database<\/strong>\n   &#8211; <strong>Problem:<\/strong> You need a staging area for sensitive data before loading to analytics.\n   &#8211; <strong>Why this fits:<\/strong> Private networking and encryption patterns; controlled access.\n   &#8211; <strong>Example:<\/strong> Data ingestion lands in Object Storage; ETL runs on private compute; writes to Base Database staging schema.<\/p>\n<\/li>\n<li>\n<p><strong>Application migration where OS-level scripts are required<\/strong>\n   &#8211; <strong>Problem:<\/strong> App depends on OS-level jobs, custom agents, or filesystem integrations.\n   &#8211; <strong>Why this fits:<\/strong> VM\/bare metal DB system supports more traditional ops patterns than fully managed services.\n   &#8211; <strong>Example:<\/strong> Legacy batch jobs run on DB host with OS scheduling, generating files consumed by downstream systems. (Use caution; prefer app-tier jobs when possible.)<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<blockquote>\n<p>Feature availability can depend on region, database version, edition, and whether you use VM DB systems or bare metal. Always verify specifics in the official documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/base-database\/home.htm<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">6.1 DB Systems (VM and Bare Metal)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Provisions dedicated database servers in OCI.<\/li>\n<li><strong>Why it matters:<\/strong> Isolation and predictable performance.<\/li>\n<li><strong>Practical benefit:<\/strong> Aligns with traditional DBA operations and performance tuning.<\/li>\n<li><strong>Caveats:<\/strong> You are responsible for many operational tasks (patch planning, configuration, access control).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.2 Database Homes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Manages Oracle Database software images installed on the DB system.<\/li>\n<li><strong>Why it matters:<\/strong> Separates software lifecycle from database lifecycle.<\/li>\n<li><strong>Practical benefit:<\/strong> Easier patching\/upgrade workflows with reduced drift.<\/li>\n<li><strong>Caveats:<\/strong> Home management still requires planning; patching can require downtime depending on strategy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.3 Database Creation and Management<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Creates database instances\/configurations within a Database Home.<\/li>\n<li><strong>Why it matters:<\/strong> Standardized provisioning and metadata tracked in OCI.<\/li>\n<li><strong>Practical benefit:<\/strong> Consistent creation across environments; clear resource ownership in compartments.<\/li>\n<li><strong>Caveats:<\/strong> Advanced configurations (e.g., certain HA modes) may require additional steps and expertise.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.4 Networking in Your VCN\/Subnet<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Places DB systems in your private network and applies OCI network controls.<\/li>\n<li><strong>Why it matters:<\/strong> Enterprise security boundaries and routing control.<\/li>\n<li><strong>Practical benefit:<\/strong> You can enforce \u201cno public DB\u201d designs and limit access to app tiers.<\/li>\n<li><strong>Caveats:<\/strong> Misconfigured NSGs\/routes are a top cause of connectivity and backup failures.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.5 Automatic Backups to OCI Object Storage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Enables scheduled backups stored in OCI Object Storage (service-managed integration).<\/li>\n<li><strong>Why it matters:<\/strong> Foundational for recovery and compliance.<\/li>\n<li><strong>Practical benefit:<\/strong> Durable storage, lifecycle policies, and cross-region strategies (where implemented).<\/li>\n<li><strong>Caveats:<\/strong> Backup retention and capabilities vary\u2014verify current backup features and costs in docs\/pricing.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.6 Encryption and Key Management (TDE + OCI Vault patterns)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Supports encryption at rest using Oracle Database TDE; OCI Vault can be used for key management patterns.<\/li>\n<li><strong>Why it matters:<\/strong> Meets security\/compliance requirements for sensitive data.<\/li>\n<li><strong>Practical benefit:<\/strong> Reduced risk from storage compromise; centralized key governance.<\/li>\n<li><strong>Caveats:<\/strong> Key rotation and wallet\/key management require careful runbooks; verify exact integration steps in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.7 IAM Integration (Compartments, Policies, Tagging)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Controls who can create\/manage DB systems, homes, and databases.<\/li>\n<li><strong>Why it matters:<\/strong> Prevents unauthorized provisioning and changes.<\/li>\n<li><strong>Practical benefit:<\/strong> Separation of duties (network team vs DBA team vs app team).<\/li>\n<li><strong>Caveats:<\/strong> Over-broad policies are common; use least privilege and compartment boundaries.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.8 Observability (Monitoring, Alarms, Logging, Audit)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> OCI Monitoring provides metrics; Logging\/Audit capture events and API calls.<\/li>\n<li><strong>Why it matters:<\/strong> You need proactive detection (storage full, CPU saturation, failed backups).<\/li>\n<li><strong>Practical benefit:<\/strong> Standardize alerting into on-call workflows.<\/li>\n<li><strong>Caveats:<\/strong> Database-level logs\/metrics may require additional configuration and services (e.g., Database Management). Verify what is included by default.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.9 Patching and Maintenance Workflows<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Supports patching of Database Homes and potentially infrastructure components depending on system type.<\/li>\n<li><strong>Why it matters:<\/strong> Security and stability.<\/li>\n<li><strong>Practical benefit:<\/strong> Oracle-provided patch images reduce manual patch friction.<\/li>\n<li><strong>Caveats:<\/strong> Patching can cause downtime; plan maintenance windows and test in lower environments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.10 High Availability \/ Disaster Recovery Patterns (Technology-dependent)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Enables you to implement HA\/DR using Oracle database technologies (for example, Data Guard) where supported.<\/li>\n<li><strong>Why it matters:<\/strong> Business continuity.<\/li>\n<li><strong>Practical benefit:<\/strong> Better RPO\/RTO than backup-only strategies.<\/li>\n<li><strong>Caveats:<\/strong> Configuration complexity and cost; confirm support matrix for your DB version\/edition and OCI region strategy.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level service architecture<\/h3>\n\n\n\n<p>Base Database uses OCI resource constructs:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>You choose a <strong>compartment<\/strong> and <strong>region<\/strong>.<\/li>\n<li>You deploy (or select) a <strong>VCN<\/strong> and <strong>subnet<\/strong>.<\/li>\n<li>You create a <strong>DB system<\/strong> (VM\/bare metal) in that subnet.<\/li>\n<li>On that DB system you create a <strong>Database Home<\/strong> (Oracle binaries).<\/li>\n<li>Within the home you create a <strong>Database<\/strong> (your instance \/ CDB\/PDB arrangement).<\/li>\n<li>You connect from your application tier (Compute, OKE, on-prem) over private IP.<\/li>\n<li>Backups (if enabled) are stored in <strong>OCI Object Storage<\/strong>, typically reached via a <strong>Service Gateway<\/strong> for private subnets.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane (OCI API\/Console\/CLI\/Terraform):<\/strong><br\/>\n  Creates and updates DB system resources, applies IAM policies, tracks lifecycle states.<\/li>\n<li><strong>Data plane (SQL\/Net traffic):<\/strong><br\/>\n  Application traffic flows from client\/app tier to DB private IP (TCP 1521 by default for Oracle listener; your port may differ).<\/li>\n<li><strong>Backup traffic:<\/strong><br\/>\n  DB host communicates to Object Storage endpoints. For private subnet designs, traffic should go through an OCI <strong>Service Gateway<\/strong> (recommended) or NAT\/Internet Gateway (less preferred).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related OCI services (common ones)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Networking:<\/strong> VCN, Subnets, NSGs, Security Lists, Route Tables, Service Gateway, NAT Gateway, DRG (for FastConnect\/VPN).<\/li>\n<li><strong>Identity and governance:<\/strong> IAM, Compartments, Tagging, OCI Audit.<\/li>\n<li><strong>Security:<\/strong> OCI Vault (KMS), Security Zones (if used), Bastion.<\/li>\n<li><strong>Operations:<\/strong> OCI Monitoring, Alarms, Notifications, Events, Logging.<\/li>\n<li><strong>Storage:<\/strong> Object Storage (backup), Block Volume (underlying DB system storage).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>At minimum you need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A working <strong>VCN\/subnet<\/strong> with appropriate routing and security rules<\/li>\n<li>A <strong>compartment<\/strong> with permissions<\/li>\n<li><strong>Quota<\/strong> available for database resources in that region<\/li>\n<li>Network path to Object Storage endpoints if backups are enabled (service gateway recommended)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI IAM<\/strong> controls management operations (create DB system, update DB home, etc.).<\/li>\n<li><strong>Database authentication<\/strong> is separate (database users\/passwords, optionally enterprise identity integrations depending on your setup).<\/li>\n<li><strong>OS access<\/strong> (SSH) is controlled by:<\/li>\n<li>Whether the DB system has public IP (not recommended for production)<\/li>\n<li>Subnet routing + NSGs\/security lists<\/li>\n<li>SSH keys and bastion patterns<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DB system is deployed into a <strong>subnet<\/strong> and receives private IP addresses.<\/li>\n<li>Recommended: <strong>private subnet<\/strong> without public IPs.<\/li>\n<li>Access patterns:<\/li>\n<li>Application tier in same VCN or peered VCN<\/li>\n<li>On-prem via DRG + FastConnect\/VPN<\/li>\n<li>Admin access via OCI Bastion (port forwarding for SQL*Net, SSH sessions)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable and standardize:<\/li>\n<li>OCI <strong>Monitoring<\/strong> alarms for CPU, storage, memory (where available), and backup failure indicators<\/li>\n<li><strong>Audit<\/strong> reviews for DB system lifecycle changes<\/li>\n<li>Tagging for environment, owner, cost center, and data classification<\/li>\n<li>For deeper database performance insights, evaluate OCI <strong>Database Management<\/strong> (service availability and licensing considerations may apply\u2014verify in official docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Simple architecture diagram (learning\/lab)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  Dev[Developer Laptop] --&gt;|SSH to Bastion| Bastion[OCI Bastion]\n  Bastion --&gt;|Port forward 1521| DB[Base Database\\nVM DB System\\nPrivate Subnet]\n  App[Compute Instance\\n(SQL client)] --&gt;|SQL*Net 1521| DB\n  DB --&gt;|Backups| OS[OCI Object Storage]\n  DB -.-&gt;|Metrics\/Events| Mon[OCI Monitoring\/Alarms]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Production-style architecture diagram (reference)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph RegionA[OCI Region A]\n    subgraph VCN[VCN - Hub and Spoke]\n      subgraph AppSubnet[Private App Subnet]\n        LB[Load Balancer (optional)]\n        App1[App Server 1]\n        App2[App Server 2]\n      end\n\n      subgraph DBSubnet[Private DB Subnet]\n        DBP[Base Database\\nPrimary DB System]\n      end\n\n      subgraph SecOps[Security\/Operations]\n        Bastion[OCI Bastion]\n        Vault[OCI Vault \/ KMS]\n        Mon[OCI Monitoring + Alarms]\n        Audit[OCI Audit]\n      end\n\n      SGW[Service Gateway]\n      DRG[DRG to On-Prem \/ Other Regions]\n      OS[Object Storage\\n(Backups)]\n    end\n  end\n\n  subgraph RegionB[OCI Region B (DR)]\n    subgraph VCNB[VCN\/DR Network]\n      DBS[Base Database\\nStandby DB System]\n      OSB[Object Storage\\n(Backups\/Replication)]\n    end\n  end\n\n  LB --&gt; App1\n  LB --&gt; App2\n  App1 --&gt;|SQL*Net| DBP\n  App2 --&gt;|SQL*Net| DBP\n\n  Bastion --&gt;|Admin access| DBP\n  Vault --&gt;|Key governance| DBP\n  DBP --&gt;|Backups via SGW| OS\n  DBP -.-&gt; Mon\n  DBP -.-&gt; Audit\n\n  DBP --&gt;|DR link (e.g., Data Guard)\\nVerify support\/config| DBS\n  DBS --&gt; OSB\n  DRG --&gt; VCNB\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Tenancy and account requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Oracle Cloud (OCI) tenancy<\/strong><\/li>\n<li>Access to a target <strong>region<\/strong> where Base Database is available<br\/>\n  (Service availability varies by region\u2014verify in OCI docs and the console service list.)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>You need IAM permissions to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create\/manage DB systems, database homes, and databases<\/li>\n<li>Create\/use networking resources (VCN\/subnets\/NSGs) or at least select existing ones<\/li>\n<li>Use Object Storage for backups (depending on how permissions are modeled)<\/li>\n<\/ul>\n\n\n\n<p>OCI policies vary by organization. As a starting point for a lab, many teams use a compartment-scoped policy like:<\/p>\n\n\n\n<pre><code class=\"language-text\">Allow group &lt;YourGroup&gt; to manage database-family in compartment &lt;YourCompartment&gt;\nAllow group &lt;YourGroup&gt; to use virtual-network-family in compartment &lt;YourCompartment&gt;\nAllow group &lt;YourGroup&gt; to manage object-family in compartment &lt;YourCompartment&gt;\nAllow group &lt;YourGroup&gt; to read vaults in compartment &lt;YourCompartment&gt;\nAllow group &lt;YourGroup&gt; to use keys in compartment &lt;YourCompartment&gt;\n<\/code><\/pre>\n\n\n\n<p>Adjust to least privilege for production. For official IAM patterns, verify in OCI IAM documentation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A paid tenancy or credits sufficient to create DB systems.<\/li>\n<li>Base Database is not generally \u201cfree\u201d because it uses dedicated compute\/storage.<br\/>\n  OCI Free Tier eligibility for database services varies\u2014verify current Free Tier offerings: https:\/\/www.oracle.com\/cloud\/free\/<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CLI\/SDK\/tools needed (for this tutorial)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Console access (primary)<\/li>\n<li>Optional: <strong>OCI Cloud Shell<\/strong> (recommended)<br\/>\n  Includes OCI CLI preinstalled in many regions (verify in console).<\/li>\n<li>A SQL client on a compute instance (recommended for private DB lab):<\/li>\n<li><strong>SQLcl<\/strong>, <strong>SQL*Plus<\/strong>, or another Oracle-compatible client<\/li>\n<li>SSH client for bastion\/compute access<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Base Database is available in many OCI commercial regions, but not necessarily all sovereign\/government regions or new regions on day one.<\/li>\n<li>Always verify in:<\/li>\n<li>Console region selector<\/li>\n<li>Official Base Database docs: https:\/\/docs.oracle.com\/en-us\/iaas\/base-database\/home.htm<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Common blockers include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DB system count limits per compartment\/region<\/li>\n<li>OCPU limits for database shapes<\/li>\n<li>Block volume limits<\/li>\n<\/ul>\n\n\n\n<p>Check <strong>OCI Service Limits<\/strong> in the console and request limit increases if needed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<p>For a secure private deployment and backups:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>VCN with at least:<\/li>\n<li>One <strong>private DB subnet<\/strong><\/li>\n<li>One <strong>private app\/admin subnet<\/strong> (optional but recommended)<\/li>\n<li><strong>Service Gateway<\/strong> to Object Storage (recommended if DB subnet is private)<\/li>\n<li>Route tables and security rules<\/li>\n<li>OCI Object Storage (for backups, if enabled)<\/li>\n<li>OCI Bastion (recommended for admin access without public IPs)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<blockquote>\n<p>Do not treat this section as a quote. Prices vary by region, shape, licensing model, and sometimes contract terms. Always validate with the official pricing pages and the OCI cost estimator.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Official pricing references<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI pricing entry points: https:\/\/www.oracle.com\/cloud\/price-list\/<br\/>\n  (Navigate to <strong>Database<\/strong> and look for <strong>Oracle Base Database Service<\/strong> \/ DB Systems pricing lines.)<\/li>\n<li>OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing dimensions (how you\u2019re billed)<\/h3>\n\n\n\n<p>Base Database cost typically includes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Compute (OCPU) for the DB system<\/strong>\n   &#8211; Billed based on selected shape and number of OCPUs.\n   &#8211; VM vs bare metal differs.<\/li>\n<li><strong>Database software licensing model<\/strong>\n   &#8211; <strong>License Included<\/strong>: Oracle license cost bundled into hourly OCPU price (where offered).\n   &#8211; <strong>BYOL<\/strong>: You bring your Oracle Database licenses; cloud price reflects infrastructure\/service costs.\n   &#8211; Availability and rules differ\u2014verify with Oracle pricing and your license agreement.<\/li>\n<li><strong>Storage<\/strong>\n   &#8211; DB system uses storage (commonly Block Volumes) sized during provisioning.\n   &#8211; Additional storage for datafiles, redo, and recovery area impacts cost.<\/li>\n<li><strong>Backup storage<\/strong>\n   &#8211; Automatic backups stored in <strong>OCI Object Storage<\/strong> (charged by GB-month and requests).\n   &#8211; Retention period directly impacts cost.<\/li>\n<li><strong>Networking<\/strong>\n   &#8211; Data transfer costs may apply for cross-region transfer, internet egress, and some interconnect patterns.\n   &#8211; Intra-region traffic within VCN is typically not billed like internet egress, but always verify OCI data transfer pricing rules.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (what makes bills grow)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Choosing <strong>larger OCPU counts<\/strong> and high-performance shapes<\/li>\n<li><strong>License Included<\/strong> vs BYOL differences<\/li>\n<li>Over-provisioning storage \u201cjust in case\u201d<\/li>\n<li>Long backup retention or multiple full backups without lifecycle policies<\/li>\n<li>DR architectures (standby systems double compute\/storage footprint)<\/li>\n<li>Additional admin compute instances, bastion sessions, monitoring services, and log retention<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs to plan for<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>High availability \/ DR<\/strong>: A standby DB system nearly duplicates cost.<\/li>\n<li><strong>Operational tooling<\/strong>: If you add advanced monitoring\/management services, costs may apply (verify service pricing).<\/li>\n<li><strong>Data egress<\/strong>: Exporting backups or moving large datasets out of region can be expensive.<\/li>\n<li><strong>Patching windows<\/strong>: Not a direct cost, but an operational cost (downtime planning, testing).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Backups written to Object Storage from a private subnet typically require:<\/li>\n<li><strong>Service Gateway<\/strong> (best practice) to avoid public internet paths<\/li>\n<li>Correct route tables and security rules<\/li>\n<li>Cross-region DR replication (if used) incurs inter-region data transfer (verify pricing).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Right-size OCPUs and storage; scale after measuring utilization.<\/li>\n<li>Prefer private networking and service gateways for predictable routing and security.<\/li>\n<li>Set <strong>backup retention<\/strong> aligned to compliance (not \u201cforever\u201d).<\/li>\n<li>Use tagging + budgets to detect runaway environments.<\/li>\n<li>Use separate compartments for dev\/test and enforce smaller shapes via policy and quota management.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (model, not numbers)<\/h3>\n\n\n\n<p>A typical low-cost lab pattern includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>1 small VM DB system (minimum viable OCPUs and storage)<\/li>\n<li>Automatic backups enabled with short retention<\/li>\n<li>1 small compute instance as SQL client (or use existing app host)<\/li>\n<li>Private subnet with service gateway (no NAT traffic for backups)<\/li>\n<\/ul>\n\n\n\n<p>To estimate:\n1. Pick your region\n2. Select Base Database VM DB system shape and OCPU count\n3. Choose BYOL vs License Included\n4. Add block storage size\n5. Add expected backup storage footprint\n6. Add compute instance for client\/bastion (if any)<\/p>\n\n\n\n<p>Use the OCI cost estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>For production, plan line items for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Primary DB system OCPUs + storage<\/li>\n<li>Standby DB system (if DR) OCPUs + storage<\/li>\n<li>Backup retention and archival strategy<\/li>\n<li>Monitoring\/logging retention<\/li>\n<li>Network connectivity (FastConnect\/VPN\/DRG)<\/li>\n<li>Operational headroom (CPU\/storage growth, additional environments)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab builds a <strong>private<\/strong> Base Database VM DB system, connects to it securely from a compute instance in the same VCN, creates a schema and sample table, verifies connectivity, and then cleans up.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Provision an <strong>Oracle Cloud Base Database<\/strong> (VM DB system) in a private subnet with automatic backups enabled, then securely connect and run SQL to validate the database.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create networking (VCN, private subnets, service gateway) <strong>or<\/strong> reuse an existing VCN.<\/li>\n<li>Create a small <strong>Compute<\/strong> instance as a \u201cSQL client host\u201d in a private subnet.<\/li>\n<li>Create a <strong>Base Database VM DB system<\/strong> in a private DB subnet.<\/li>\n<li>Connect from the compute instance to the database using SQL*Plus\/SQLcl.<\/li>\n<li>Create a user and sample table; validate.<\/li>\n<li>Troubleshoot common issues (NSG rules, routes, wallet\/listener).<\/li>\n<li>Clean up resources to stop charges.<\/li>\n<\/ol>\n\n\n\n<blockquote>\n<p>Low-cost and safety note: Base Database is not typically free. If you are cost-sensitive, stop after validation and <strong>delete<\/strong> the DB system and compute instance.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create (or select) a compartment and set tags<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the OCI Console, open <strong>Identity &amp; Security \u2192 Compartments<\/strong>.<\/li>\n<li>Create a compartment such as: <code>lab-base-db<\/code>.<\/li>\n<li>(Recommended) Define tags you will apply to all lab resources:\n   &#8211; <code>Environment=Lab<\/code>\n   &#8211; <code>Owner=&lt;your-name-or-team&gt;<\/code>\n   &#8211; <code>CostCenter=Training<\/code><\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a dedicated compartment to isolate access and simplify cleanup.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a VCN with private subnets and a Service Gateway<\/h3>\n\n\n\n<p>If you already have a VCN, verify it meets the requirements (private subnets, routing, security rules). Otherwise:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Networking \u2192 Virtual Cloud Networks<\/strong>.<\/li>\n<li>Click <strong>Create VCN<\/strong>.<\/li>\n<li>Choose <strong>VCN with Internet Connectivity<\/strong> only if you want public subnets. For a safer lab, prefer <strong>VCN with custom CIDR<\/strong> and build private-only routing.<\/li>\n<li>\n<p>Create:\n   &#8211; <strong>VCN CIDR:<\/strong> e.g., <code>10.0.0.0\/16<\/code>\n   &#8211; <strong>Private subnet (App\/Admin):<\/strong> <code>10.0.10.0\/24<\/code>\n   &#8211; <strong>Private subnet (DB):<\/strong> <code>10.0.20.0\/24<\/code><\/p>\n<\/li>\n<li>\n<p>Create a <strong>Service Gateway<\/strong>:\n   &#8211; <strong>Networking \u2192 Service Gateways \u2192 Create Service Gateway<\/strong>\n   &#8211; Select your VCN\n   &#8211; Add service: <strong>All <region> Object Storage Services in Oracle Services Network<\/region><\/strong><\/p>\n<\/li>\n<li>\n<p>Update the <strong>Route Table<\/strong> for the private subnets to include:\n   &#8211; Destination: <strong>Oracle Services Network<\/strong> (service CIDR label in OCI)\n   &#8211; Target: <strong>Service Gateway<\/strong><\/p>\n<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Private subnets can reach OCI Object Storage without using the public internet, supporting backups.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Confirm the Service Gateway exists and route table rules are attached to the private subnets.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create Network Security Groups (NSGs) for app and database<\/h3>\n\n\n\n<p>Using NSGs helps keep rules targeted.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Networking \u2192 Network Security Groups<\/strong>.<\/li>\n<li>Create NSG: <code>nsg-app-admin<\/code><\/li>\n<li>Create NSG: <code>nsg-db<\/code><\/li>\n<\/ol>\n\n\n\n<p>Add rules:<\/p>\n\n\n\n<p><strong>Ingress rules for <code>nsg-db<\/code>:<\/strong>\n&#8211; Allow TCP 1521 (Oracle listener) <strong>from<\/strong> <code>nsg-app-admin<\/code><br\/>\n  (In OCI, you can reference NSG as source, not just CIDR.)\n&#8211; Allow TCP 22 (SSH) <strong>only<\/strong> from <code>nsg-app-admin<\/code> (optional; you may not need SSH to DB host in this lab)<\/p>\n\n\n\n<p><strong>Ingress rules for <code>nsg-app-admin<\/code>:<\/strong>\n&#8211; Allow TCP 22 from your IP (only if the app\/admin subnet has a public IP path)<br\/>\n  If you keep everything private-only, use <strong>OCI Bastion<\/strong> instead of public SSH.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> Only the app\/admin host can talk to the database listener.<\/p>\n\n\n\n<p><strong>Verification:<\/strong> NSG rules show correct sources\/destinations and ports.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a small Compute instance as your SQL client host<\/h3>\n\n\n\n<p>This instance sits in the app\/admin private subnet and is used to connect to the database privately.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Compute \u2192 Instances \u2192 Create instance<\/strong>.<\/li>\n<li>Name: <code>sql-client<\/code><\/li>\n<li>Image: Oracle Linux (or another supported Linux)<\/li>\n<li>Shape: choose a small shape to reduce cost.<\/li>\n<li>Networking:\n   &#8211; VCN: your lab VCN\n   &#8211; Subnet: <code>private-app-admin<\/code>\n   &#8211; Assign public IP: <strong>No<\/strong> (recommended)\n   &#8211; NSG: attach <code>nsg-app-admin<\/code><\/li>\n<li>SSH keys: upload your public key.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Compute instance is running in the private subnet.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Instance is <code>RUNNING<\/code>\n&#8211; It has a private IP in <code>10.0.10.0\/24<\/code><\/p>\n\n\n\n<p><strong>How you will SSH to it (two common options):<\/strong>\n&#8211; Option A (recommended for private-only): use <strong>OCI Bastion<\/strong> to SSH into <code>sql-client<\/code>.\n&#8211; Option B: temporarily give the instance a public IP and restrict SSH source to your IP (less ideal).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Create a Base Database VM DB system in the private DB subnet<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Oracle Database \u2192 DB Systems<\/strong> (naming can vary slightly by console).<\/li>\n<li>Click <strong>Create DB system<\/strong>.<\/li>\n<li>Select <strong>Base Database<\/strong> and choose <strong>Virtual Machine DB system<\/strong>.<\/li>\n<li>Basic details:\n   &#8211; Compartment: <code>lab-base-db<\/code>\n   &#8211; DB system name: <code>lab-basedb-vm<\/code><\/li>\n<li>Configure shape and storage:\n   &#8211; Choose a modest OCPU count and storage size for lab.\n   &#8211; Choose database version and edition as required. (Select what is available in your region.)<\/li>\n<li>Networking:\n   &#8211; VCN: your lab VCN\n   &#8211; Subnet: <code>private-db<\/code>\n   &#8211; NSG: attach <code>nsg-db<\/code>\n   &#8211; Public IP: <strong>No<\/strong> (recommended)<\/li>\n<li>Credentials:\n   &#8211; Set the database admin password (store securely)<\/li>\n<li>Backups:\n   &#8211; Enable <strong>Automatic backups<\/strong> (recommended)\n   &#8211; Choose a short retention for lab to limit cost (if configurable)<\/li>\n<li>Create.<\/li>\n<\/ol>\n\n\n\n<p>Provisioning can take time.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> DB system becomes <code>AVAILABLE<\/code> (or equivalent \u201cready\u201d state), and you see database details (DB name, unique name, SCAN\/listener details vary).<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; DB system lifecycle state is healthy\/available\n&#8211; Note the <strong>private IP<\/strong> and <strong>port<\/strong> (commonly 1521)\n&#8211; Confirm the database name\/service name shown in the console<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Connect to the SQL client host (via OCI Bastion) and install a SQL tool<\/h3>\n\n\n\n<p>If using <strong>OCI Bastion<\/strong>:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to <strong>Identity &amp; Security \u2192 Bastion<\/strong> (or search \u201cBastion\u201d).<\/li>\n<li>Create a bastion in the same VCN.<\/li>\n<li>Create a <strong>Managed SSH session<\/strong> to the <code>sql-client<\/code> private IP.<\/li>\n<li>Use the provided SSH command from OCI console.<\/li>\n<\/ol>\n\n\n\n<p>Once connected to <code>sql-client<\/code>, install SQLcl (example on Oracle Linux; verify current package steps in official sources):<\/p>\n\n\n\n<pre><code class=\"language-bash\">sudo dnf -y install unzip\n<\/code><\/pre>\n\n\n\n<p>If SQLcl is not available via package manager, you can use SQL*Plus via Oracle Instant Client. Installation steps vary; follow Oracle\u2019s official instructions for your OS and client choice.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a SQL client available on <code>sql-client<\/code>.<\/p>\n\n\n\n<p><strong>Verification:<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">which sql\n# or\nwhich sqlplus\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Allow connectivity and resolve service name details<\/h3>\n\n\n\n<p>From the DB system details in OCI Console, collect:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>DB host private IP (or SCAN address if applicable)<\/li>\n<li>Listener port (commonly 1521)<\/li>\n<li>Service name \/ DB name shown by OCI<\/li>\n<\/ul>\n\n\n\n<p>If you cannot find the exact connect descriptor, use the OCI console\u2019s connection panel (often shows a connect string) or verify in official docs for your DB version.<\/p>\n\n\n\n<p>On the <code>sql-client<\/code> host, test TCP connectivity first:<\/p>\n\n\n\n<pre><code class=\"language-bash\">nc -zv &lt;DB_PRIVATE_IP&gt; 1521\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> Connection succeeds (<code>succeeded<\/code>).<\/p>\n\n\n\n<p><strong>If it fails:<\/strong>\n&#8211; Check NSG rules (Step 3)\n&#8211; Confirm route tables and subnet selection\n&#8211; Confirm DB system is in <code>AVAILABLE<\/code> state\n&#8211; Confirm listener port matches<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Connect to the database and run validation SQL<\/h3>\n\n\n\n<p>Use SQL*Plus\/SQLcl. Example with SQLcl:<\/p>\n\n\n\n<pre><code class=\"language-bash\">sql sys\/&lt;ADMIN_PASSWORD&gt;@\/\/&lt;DB_PRIVATE_IP&gt;:1521\/&lt;SERVICE_NAME&gt; as sysdba\n<\/code><\/pre>\n\n\n\n<p>Then run:<\/p>\n\n\n\n<pre><code class=\"language-sql\">SELECT name, open_mode FROM v$database;\nSELECT sys_context('USERENV','DB_NAME') AS db_name FROM dual;\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> You can query the database and see it open (typically <code>READ WRITE<\/code> for a primary).<\/p>\n\n\n\n<p>Now create a lab user and a sample table:<\/p>\n\n\n\n<pre><code class=\"language-sql\">CREATE USER lab_user IDENTIFIED BY \"Str0ng_Password_ChangeMe!\";\nGRANT CREATE SESSION, CREATE TABLE TO lab_user;\n\nCONNECT lab_user\/\"Str0ng_Password_ChangeMe!\"@\/\/&lt;DB_PRIVATE_IP&gt;:1521\/&lt;SERVICE_NAME&gt;\n\nCREATE TABLE hello_basedb (\n  id NUMBER GENERATED BY DEFAULT AS IDENTITY,\n  message VARCHAR2(200),\n  created_at TIMESTAMP DEFAULT SYSTIMESTAMP\n);\n\nINSERT INTO hello_basedb(message) VALUES ('Hello from OCI Base Database');\nCOMMIT;\n\nSELECT * FROM hello_basedb;\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome:<\/strong> You see one row returned with your message.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 9: Verify backups are enabled (control plane verification)<\/h3>\n\n\n\n<p>In the OCI Console:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open the database details page.<\/li>\n<li>Locate <strong>Backups<\/strong> section.<\/li>\n<li>Confirm automatic backups are enabled and next backup window is defined (if shown).<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Backup configuration is visible and enabled.<\/p>\n\n\n\n<p><strong>Note:<\/strong> Backup objects in Object Storage may not be directly human-readable and may not appear as plain files in your bucket listing depending on how the service manages backup storage. Always verify using the database service backup views and OCI console.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] DB system state is <code>AVAILABLE<\/code><\/li>\n<li>[ ] <code>sql-client<\/code> can reach DB private IP on port 1521<\/li>\n<li>[ ] SQL login works using the service name shown in OCI<\/li>\n<li>[ ] <code>lab_user<\/code> created successfully<\/li>\n<li>[ ] Sample table created and query returns expected row<\/li>\n<li>[ ] Automatic backups enabled (per OCI console)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p><strong>Problem: DB provisioning fails or stuck<\/strong>\n&#8211; Check <strong>service limits<\/strong> for DB systems and OCPUs in your region.\n&#8211; Verify the selected shape is available in your AD\/region.\n&#8211; Review OCI Work Requests \/ error messages in the console.<\/p>\n\n\n\n<p><strong>Problem: <code>nc<\/code> to port 1521 fails<\/strong>\n&#8211; Confirm DB system NSG (<code>nsg-db<\/code>) has ingress rule from <code>nsg-app-admin<\/code> on TCP 1521.\n&#8211; Confirm <code>sql-client<\/code> is actually attached to <code>nsg-app-admin<\/code>.\n&#8211; Ensure subnets are in the same VCN and routing is not blocking.\n&#8211; Confirm you used the correct DB private IP (not a display name).<\/p>\n\n\n\n<p><strong>Problem: SQL connection errors (ORA-12514 \/ service unknown)<\/strong>\n&#8211; Wrong <code>&lt;SERVICE_NAME&gt;<\/code> is the most common cause.\n&#8211; Use the connect descriptor shown in the OCI console database connection panel.\n&#8211; Verify listener\/service configuration on the DB host (requires DBA skill and may require SSH access to DB host\u2014use caution).<\/p>\n\n\n\n<p><strong>Problem: Backups failing in private subnet<\/strong>\n&#8211; Ensure a <strong>Service Gateway<\/strong> exists and the DB subnet route table includes a route to <strong>Object Storage<\/strong> via Service Gateway.\n&#8211; Confirm there is no restrictive egress rule blocking Oracle Services Network.\n&#8211; Verify backup configuration in console and check related events\/logs.<\/p>\n\n\n\n<p><strong>Problem: You cannot SSH anywhere (private-only)<\/strong>\n&#8211; Use <strong>OCI Bastion<\/strong>.\n&#8211; Ensure bastion is in the same VCN and allowed to reach the target subnet.\n&#8211; Confirm your SSH key is correct.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To stop charges, delete resources in this order:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Delete the database<\/strong> (from the DB system\u2019s database list) if required by console workflow.<\/li>\n<li><strong>Delete the DB system<\/strong> <code>lab-basedb-vm<\/code>.<\/li>\n<li>Terminate the compute instance <code>sql-client<\/code>.<\/li>\n<li>Delete NSGs <code>nsg-app-admin<\/code> and <code>nsg-db<\/code>.<\/li>\n<li>Delete bastion (if created).<\/li>\n<li>Delete VCN (only if created for lab and no longer needed).<br\/>\n   Deleting the VCN will delete subnets, route tables, gateways (confirm dependencies first).<\/li>\n<\/ol>\n\n\n\n<p>Always confirm backups and related storage are also removed if they remain billable.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>private subnets<\/strong> for databases; avoid public IPs for DB systems.<\/li>\n<li>Separate subnets:<\/li>\n<li>App tier subnet(s)<\/li>\n<li>DB subnet<\/li>\n<li>Admin subnet (optional)<\/li>\n<li>Use hub-and-spoke network architecture with centralized security controls for enterprise environments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>compartments<\/strong> to separate environments (dev\/test\/prod).<\/li>\n<li>Apply least privilege IAM policies:<\/li>\n<li>DB admins manage database-family<\/li>\n<li>Network team manages virtual-network-family<\/li>\n<li>Security team manages vaults\/keys<\/li>\n<li>Use tagging standards for owner\/environment\/classification.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Choose BYOL vs License Included intentionally (involve licensing experts).<\/li>\n<li>Set backup retention to match RPO\/compliance.<\/li>\n<li>Use budgets and cost alerts for compartments.<\/li>\n<li>Turn off\/terminate dev\/test DB systems when not needed (where feasible).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Right-size OCPUs and storage IOPS profile (shape\/storage options vary).<\/li>\n<li>Place app servers close to DB (same region, low-latency subnets).<\/li>\n<li>Use database tuning best practices (indexes, stats, partitioning) and avoid over-reliance on scaling.<\/li>\n<li>Benchmark with realistic workload before committing to shapes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Plan for failure:<\/li>\n<li>Backup\/restore procedures tested regularly<\/li>\n<li>HA\/DR using Oracle technologies where required (verify support)<\/li>\n<li>Regularly test:<\/li>\n<li>Backup restore to a new DB system (functional validation)<\/li>\n<li>DR drills (if implemented)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Maintain runbooks:<\/li>\n<li>Patching schedule<\/li>\n<li>Backup verification and restore testing<\/li>\n<li>Incident response<\/li>\n<li>Monitor:<\/li>\n<li>Storage space (data + FRA)<\/li>\n<li>CPU and memory pressure<\/li>\n<li>Long-running sessions and locks<\/li>\n<li>Centralize logs and alerts; integrate with incident management.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Naming convention example:<\/li>\n<li><code>basedb-&lt;env&gt;-&lt;app&gt;-&lt;region&gt;-&lt;seq&gt;<\/code><\/li>\n<li>Tags:<\/li>\n<li><code>Environment<\/code>, <code>Application<\/code>, <code>Owner<\/code>, <code>DataClassification<\/code>, <code>CostCenter<\/code><\/li>\n<li>Use OCI policies to enforce tagging where possible (verify current OCI governance features in your tenancy).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI IAM<\/strong> controls who can create\/modify Base Database resources.<\/li>\n<li><strong>Database users\/roles<\/strong> control data access inside Oracle Database.<\/li>\n<li>Separate duties:<\/li>\n<li>Cloud admins manage OCI resources<\/li>\n<li>DBAs manage Oracle users, roles, schemas, and security inside the DB<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>At rest:<\/strong> OCI storage encryption + Oracle Database TDE (common pattern for sensitive data).<\/li>\n<li><strong>In transit:<\/strong> Use TLS where required; client configuration depends on your chosen approach and Oracle Net configuration.<\/li>\n<\/ul>\n\n\n\n<blockquote>\n<p>Encryption implementations vary by database version\/configuration. Verify exact steps in Oracle Database and OCI Base Database documentation.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>no public IP<\/strong> on DB systems.<\/li>\n<li>Use NSGs with narrow rules:<\/li>\n<li>Allow 1521 only from known app subnets\/NSGs<\/li>\n<li>Avoid <code>0.0.0.0\/0<\/code> inbound rules<\/li>\n<li>Use OCI Bastion for admin access and port forwarding.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not store SYS\/SYSTEM passwords in plaintext.<\/li>\n<li>Use OCI Vault (secrets) or your enterprise secret manager for:<\/li>\n<li>DB admin credentials<\/li>\n<li>Application DB credentials<\/li>\n<li>Rotate credentials periodically and after staff changes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>OCI Audit<\/strong> to track API calls affecting DB systems.<\/li>\n<li>Enable database auditing features appropriate to your compliance requirements (inside Oracle Database).<\/li>\n<li>Retain logs according to policy; ensure access to logs is restricted.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Align with:<\/li>\n<li>Data residency (choose region appropriately)<\/li>\n<li>Encryption requirements (TDE, key custody)<\/li>\n<li>Access control (least privilege)<\/li>\n<li>Change management (patching windows, approvals)<\/li>\n<li>For regulated workloads, consider OCI security services and governance controls available in your tenancy (verify current OCI features).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Public DB endpoints<\/li>\n<li>Overly permissive NSG\/security list rules<\/li>\n<li>No service gateway\/NAT planning, causing admins to \u201ctemporarily\u201d open the DB to the internet<\/li>\n<li>Unrotated credentials and shared SYS password usage<\/li>\n<li>Not testing restore procedures (security includes recoverability)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Private DB subnet + service gateway + bastion access<\/li>\n<li>Dedicated compartments for prod and non-prod<\/li>\n<li>KMS\/Vault-based key governance where required<\/li>\n<li>Automated alerts for security group changes and DB system lifecycle changes<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<blockquote>\n<p>Treat these as common considerations; verify exact limits and supported configurations in official docs for your region and database version.<\/p>\n<\/blockquote>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Not serverless:<\/strong> You provision fixed OCPUs\/storage; scaling may involve downtime or operational work.<\/li>\n<li><strong>DBA responsibility remains:<\/strong> You manage schema design, tuning, parameter changes, and many operational workflows.<\/li>\n<li><strong>Regional\/AD constraints:<\/strong> Some shapes or capabilities may not be available in every AD\/region.<\/li>\n<li><strong>Connectivity pitfalls:<\/strong> Most issues come from NSGs, route tables, and incorrect connect descriptors.<\/li>\n<li><strong>Backup networking dependencies:<\/strong> Private subnet backups generally require correct <strong>Service Gateway<\/strong> routing to Object Storage.<\/li>\n<li><strong>Patching requires planning:<\/strong> Even with managed images, patching may require downtime and testing.<\/li>\n<li><strong>License complexity:<\/strong> BYOL rules and \u201cLicense Included\u201d eligibility require careful review; involve licensing specialists.<\/li>\n<li><strong>Cost surprises from retention\/DR:<\/strong> Backups and standby systems can double (or more) total cost footprint.<\/li>\n<li><strong>Operational drift:<\/strong> If admins make manual OS-level or DB-level changes without IaC\/runbooks, environments diverge quickly.<\/li>\n<li><strong>Migration nuance:<\/strong> Moving to Base Database from on-prem may require network redesign (CIDRs, DNS), identity updates, and careful performance validation.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">In Oracle Cloud (nearest alternatives)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Oracle Autonomous Database<\/strong>: More managed, less DBA overhead; different control model.<\/li>\n<li><strong>Exadata Database Service<\/strong>: Higher performance and Exadata features; typically higher cost and different scaling model.<\/li>\n<li><strong>OCI MySQL HeatWave<\/strong>: MySQL managed service (not Oracle Database).<\/li>\n<li><strong>Self-managed Oracle on Compute<\/strong>: Maximum control, but you manage everything (installation, patching, backups, automation).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">In other clouds (nearest equivalents)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS:<\/strong> Amazon RDS for Oracle (managed), or Oracle on EC2 (self-managed)<\/li>\n<li><strong>Azure:<\/strong> Oracle on Azure VMs (self-managed); Oracle Database@Azure is a distinct offering (verify current scope and availability)<\/li>\n<li><strong>Google Cloud:<\/strong> Oracle on Compute Engine (self-managed)<\/li>\n<li><strong>On-prem:<\/strong> Oracle Database on VMware\/bare metal<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>OCI Base Database<\/strong><\/td>\n<td>Oracle DB needing control + cloud integration<\/td>\n<td>Dedicated VM\/bare metal, VCN-native, DB Home lifecycle, integrated backups<\/td>\n<td>More DBA ops than autonomous; fixed sizing; cost can grow with HA\/DR<\/td>\n<td>You need Oracle compatibility and admin control on OCI<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Autonomous Database<\/strong><\/td>\n<td>Teams wanting minimal DBA ops<\/td>\n<td>Automated tuning\/patching, simplified ops, elastic features (service-dependent)<\/td>\n<td>Less OS-level control; not all customizations<\/td>\n<td>You can accept autonomous constraints and want lower ops burden<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Exadata Database Service<\/strong><\/td>\n<td>High-performance, large-scale Oracle workloads<\/td>\n<td>Exadata performance\/features<\/td>\n<td>Higher cost\/complexity<\/td>\n<td>You need Exadata capabilities and top-tier performance<\/td>\n<\/tr>\n<tr>\n<td><strong>Oracle on OCI Compute (self-managed)<\/strong><\/td>\n<td>Maximum control<\/td>\n<td>Full OS and install control<\/td>\n<td>You manage everything; more risk and toil<\/td>\n<td>You need custom setups not supported by Base Database<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS RDS for Oracle<\/strong><\/td>\n<td>Managed Oracle on AWS<\/td>\n<td>Managed service model, AWS ecosystem<\/td>\n<td>Feature\/option constraints; license considerations<\/td>\n<td>You are standardized on AWS and accept RDS constraints<\/td>\n<\/tr>\n<tr>\n<td><strong>Oracle on any-cloud VMs<\/strong><\/td>\n<td>Portability of self-managed model<\/td>\n<td>Familiar VM-based operations<\/td>\n<td>Highest operational burden<\/td>\n<td>You must run Oracle in a specific cloud without a suitable managed offering<\/td>\n<\/tr>\n<tr>\n<td><strong>Open-source DB (PostgreSQL\/MySQL)<\/strong><\/td>\n<td>New apps not requiring Oracle<\/td>\n<td>Lower license costs, broad ecosystems<\/td>\n<td>Migration effort; feature differences<\/td>\n<td>You can redesign and do not require Oracle Database<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example (regulated workload)<\/h3>\n\n\n\n<p><strong>Problem<\/strong><br\/>\nA financial services company has a customer account system on Oracle Database with strict audit requirements. They need to move from on-prem to Oracle Cloud while keeping the same Oracle features and maintaining a private network posture. They also require DR in a second region.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Base Database VM or bare metal DB system in a private DB subnet<\/li>\n<li>App servers in private app subnet behind internal load balancer<\/li>\n<li>OCI Bastion for admin access<\/li>\n<li>Service Gateway to Object Storage for backups<\/li>\n<li>DR via standby DB system in a second region (e.g., Data Guard pattern\u2014verify support and configuration)<\/li>\n<li>OCI Vault for key governance and secrets storage<\/li>\n<li>OCI Monitoring\/Alarms + centralized logging<\/li>\n<\/ul>\n\n\n\n<p><strong>Why Base Database was chosen<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Maintains DBA-level control and compatibility for existing Oracle features and operational processes<\/li>\n<li>Integrates with OCI private networking and governance<\/li>\n<li>Supports enterprise migration strategy with controlled patching and strong isolation boundaries<\/li>\n<\/ul>\n\n\n\n<p><strong>Expected outcomes<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reduced data center dependency and improved provisioning speed<\/li>\n<li>Improved security posture (no public DB, audited changes)<\/li>\n<li>Defined RPO\/RTO with tested backup restore and DR drills<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example (packaged app requirement)<\/h3>\n\n\n\n<p><strong>Problem<\/strong><br\/>\nA startup runs a B2B application that requires Oracle Database because of a vendor-provided module. They have a small team, but they need reliable backups and a secure database network.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>One Base Database VM DB system in private subnet<\/li>\n<li>One small compute instance for the application in private subnet<\/li>\n<li>OCI Bastion for admin access; no public DB endpoint<\/li>\n<li>Automatic backups enabled with short retention<\/li>\n<li>Simple alarms for CPU\/storage thresholds<\/li>\n<\/ul>\n\n\n\n<p><strong>Why Base Database was chosen<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Vendor compatibility without building a full self-managed stack from scratch<\/li>\n<li>Faster provisioning and clearer operational model than DIY Oracle installs<\/li>\n<li>Security controls achievable without a large security team<\/li>\n<\/ul>\n\n\n\n<p><strong>Expected outcomes<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Stable production database with manageable operations<\/li>\n<li>Predictable monthly cost with right-sized resources<\/li>\n<li>Easier path to future scaling or DR if business grows<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Is \u201cBase Database\u201d the same as \u201cOracle Base Database Service\u201d?<\/strong><br\/>\n   In OCI documentation, \u201cOracle Base Database Service\u201d is the full name often used. In the console you may see \u201cDB Systems\u201d as the main construct. Treat \u201cBase Database\u201d as the OCI service for VM\/bare metal DB systems. Verify naming in official docs: https:\/\/docs.oracle.com\/en-us\/iaas\/base-database\/home.htm<\/p>\n<\/li>\n<li>\n<p><strong>Is Base Database serverless?<\/strong><br\/>\n   No. You provision a DB system with a fixed shape (OCPUs) and storage. Scaling is possible within constraints, but it is not serverless.<\/p>\n<\/li>\n<li>\n<p><strong>Do I get OS access to the database host?<\/strong><br\/>\n   Typically, VM and bare metal DB systems allow SSH access with the right network path and keys. Exact access patterns depend on configuration and policy.<\/p>\n<\/li>\n<li>\n<p><strong>Can I deploy Base Database in a private subnet with no public IP?<\/strong><br\/>\n   Yes, and that is the recommended approach for production. Use OCI Bastion and strict NSG rules.<\/p>\n<\/li>\n<li>\n<p><strong>How do backups work?<\/strong><br\/>\n   Base Database supports automatic backups stored in OCI Object Storage. Configuration and retention options depend on the service and region. Always validate backup\/restore procedures.<\/p>\n<\/li>\n<li>\n<p><strong>Do I need a Service Gateway for backups?<\/strong><br\/>\n   If your DB system is in a private subnet and you want private access to Object Storage, a Service Gateway is the standard design.<\/p>\n<\/li>\n<li>\n<p><strong>What is a DB System vs a Database Home vs a Database?<\/strong><br\/>\n   DB System is the host infrastructure, Database Home is the Oracle software installation, and Database is the actual database instance\/configuration created inside the home.<\/p>\n<\/li>\n<li>\n<p><strong>What Oracle Database editions are supported?<\/strong><br\/>\n   Editions and versions vary by offering and region. Check the DB system creation wizard and pricing pages for current options.<\/p>\n<\/li>\n<li>\n<p><strong>Can I use BYOL?<\/strong><br\/>\n   BYOL is commonly offered, but rules depend on your Oracle agreement and OCI offering. Confirm with Oracle licensing guidance and official pricing pages.<\/p>\n<\/li>\n<li>\n<p><strong>How is Base Database different from Autonomous Database?<\/strong><br\/>\n   Autonomous Database reduces DBA tasks with more automation; Base Database provides more control and a more traditional DBA operating model.<\/p>\n<\/li>\n<li>\n<p><strong>How do I connect securely from my laptop if the DB is private?<\/strong><br\/>\n   Use OCI Bastion for SSH and port forwarding, or connect via a private network path (VPN\/FastConnect) and use private DNS.<\/p>\n<\/li>\n<li>\n<p><strong>What ports must be open?<\/strong><br\/>\n   Oracle listener commonly uses TCP 1521, but confirm your configuration. SSH is TCP 22 if you need OS access. Keep rules narrow and source-restricted.<\/p>\n<\/li>\n<li>\n<p><strong>How do I monitor performance?<\/strong><br\/>\n   Use OCI Monitoring for infrastructure-level metrics and Oracle database tooling for DB-level metrics. OCI Database Management may provide additional capabilities (verify availability\/pricing).<\/p>\n<\/li>\n<li>\n<p><strong>Can I do cross-region DR?<\/strong><br\/>\n   DR is commonly implemented using Oracle database technologies (e.g., standby databases). Support and setup steps vary\u2014verify in official docs and plan networking carefully.<\/p>\n<\/li>\n<li>\n<p><strong>What are the most common causes of failed connections?<\/strong><br\/>\n   Incorrect service name\/connect descriptor, missing NSG ingress rules, wrong subnet routing, or trying to connect from outside the VCN without bastion\/VPN\/FastConnect.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Base Database<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Base Database documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/base-database\/home.htm<\/td>\n<td>Primary, current reference for features, workflows, and limitations<\/td>\n<\/tr>\n<tr>\n<td>Official docs (OCI Database landing)<\/td>\n<td>Oracle Database on OCI docs entry points: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Database\/home.htm<\/td>\n<td>Broader context across DB offerings in OCI<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Oracle Cloud Price List: https:\/\/www.oracle.com\/cloud\/price-list\/<\/td>\n<td>Source of current SKUs and pricing dimensions (region-dependent)<\/td>\n<\/tr>\n<tr>\n<td>Official cost estimator<\/td>\n<td>OCI Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<td>Build scenario-based estimates without guessing<\/td>\n<\/tr>\n<tr>\n<td>Free tier overview<\/td>\n<td>Oracle Cloud Free Tier: https:\/\/www.oracle.com\/cloud\/free\/<\/td>\n<td>Confirms what is free and what is not (changes over time)<\/td>\n<\/tr>\n<tr>\n<td>Official architecture guidance<\/td>\n<td>OCI Architecture Center: https:\/\/docs.oracle.com\/en\/solutions\/<\/td>\n<td>Reference architectures (networking, DR, security) you can adapt<\/td>\n<\/tr>\n<tr>\n<td>Official networking docs<\/td>\n<td>OCI Networking documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Network\/Concepts\/overview.htm<\/td>\n<td>Required for secure private DB designs (VCN, gateways, NSGs)<\/td>\n<\/tr>\n<tr>\n<td>Official IAM docs<\/td>\n<td>OCI IAM documentation: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/td>\n<td>How to build least privilege policies and compartment models<\/td>\n<\/tr>\n<tr>\n<td>Official Bastion docs<\/td>\n<td>OCI Bastion: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Bastion\/home.htm<\/td>\n<td>Secure admin access patterns for private DB systems<\/td>\n<\/tr>\n<tr>\n<td>Official Object Storage docs<\/td>\n<td>OCI Object Storage: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Object\/home.htm<\/td>\n<td>Backup storage fundamentals, lifecycle policies, access controls<\/td>\n<\/tr>\n<tr>\n<td>Official Terraform provider<\/td>\n<td>OCI Terraform Provider docs: https:\/\/registry.terraform.io\/providers\/oracle\/oci\/latest\/docs<\/td>\n<td>Infrastructure-as-code for repeatable DB provisioning (verify supported resources)<\/td>\n<\/tr>\n<tr>\n<td>Official OCI CLI docs<\/td>\n<td>OCI CLI: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/Concepts\/cliconcepts.htm<\/td>\n<td>Script provisioning and operations where appropriate<\/td>\n<\/tr>\n<tr>\n<td>Official YouTube<\/td>\n<td>Oracle Cloud Infrastructure channel: https:\/\/www.youtube.com\/@OracleCloudInfrastructure<\/td>\n<td>Service walkthroughs and architecture talks (verify Base Database-specific content)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>DevOpsSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps engineers, SREs, cloud engineers, platform teams\n   &#8211; <strong>Likely learning focus:<\/strong> Cloud operations, DevOps practices, automation, CI\/CD (verify OCI-specific offerings on site)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>ScmGalaxy.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps and SCM learners, build\/release engineers\n   &#8211; <strong>Likely learning focus:<\/strong> Source control, CI\/CD pipelines, DevOps foundations (verify OCI modules on site)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.scmgalaxy.com\/<\/p>\n<\/li>\n<li>\n<p><strong>CLoudOpsNow.in<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> Cloud operations and production support teams\n   &#8211; <strong>Likely learning focus:<\/strong> Cloud ops practices, monitoring, incident response (verify OCI coverage on site)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.cloudopsnow.in\/<\/p>\n<\/li>\n<li>\n<p><strong>SreSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> SREs, reliability engineers, operations leads\n   &#8211; <strong>Likely learning focus:<\/strong> SRE principles, reliability, observability, incident management (verify database reliability topics on site)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.sreschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>AiOpsSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> Ops teams exploring AIOps, monitoring automation users\n   &#8211; <strong>Likely learning focus:<\/strong> AIOps concepts, event correlation, automated remediation (verify OCI integrations on site)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.aiopsschool.com\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>RajeshKumar.xyz<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> Cloud\/DevOps training content (verify OCI and database-specific coverage)\n   &#8211; <strong>Suitable audience:<\/strong> Engineers seeking practical coaching and workshops\n   &#8211; <strong>Website:<\/strong> https:\/\/rajeshkumar.xyz\/<\/p>\n<\/li>\n<li>\n<p><strong>devopstrainer.in<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps tooling and practices (verify OCI modules if needed)\n   &#8211; <strong>Suitable audience:<\/strong> DevOps engineers and teams\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopstrainer.in\/<\/p>\n<\/li>\n<li>\n<p><strong>devopsfreelancer.com<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> Freelance DevOps services and training resources (verify scope)\n   &#8211; <strong>Suitable audience:<\/strong> Small teams needing hands-on guidance\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsfreelancer.com\/<\/p>\n<\/li>\n<li>\n<p><strong>devopssupport.in<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps support and enablement (verify OCI\/database focus)\n   &#8211; <strong>Suitable audience:<\/strong> Teams needing operational support patterns\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopssupport.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>cotocus.com<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> Cloud and DevOps consulting (verify OCI and Oracle database experience on site)\n   &#8211; <strong>Where they may help:<\/strong> Cloud migration planning, landing zones, DevOps pipelines, operational readiness\n   &#8211; <strong>Consulting use case examples:<\/strong> Designing private network architecture for Base Database; setting up monitoring and backup validation runbooks\n   &#8211; <strong>Website:<\/strong> https:\/\/cotocus.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DevOpsSchool.com<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> DevOps consulting and corporate training (verify offerings)\n   &#8211; <strong>Where they may help:<\/strong> CI\/CD, infrastructure automation, operational practices for cloud platforms\n   &#8211; <strong>Consulting use case examples:<\/strong> Terraform-based provisioning for Base Database environments; building patching and deployment workflows\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DEVOPSCONSULTING.IN<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> DevOps and cloud consulting (verify OCI\/database scope)\n   &#8211; <strong>Where they may help:<\/strong> Cloud operations, automation, monitoring, and reliability improvements\n   &#8211; <strong>Consulting use case examples:<\/strong> Standardizing IAM and tagging for database compartments; building alerting and incident response integration for database operations\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsconsulting.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Base Database<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI fundamentals:<\/li>\n<li>Tenancy, compartments, IAM policies<\/li>\n<li>VCN, subnets, route tables, NSGs, gateways<\/li>\n<li>Linux basics:<\/li>\n<li>SSH, packages, basic troubleshooting<\/li>\n<li>Oracle Database fundamentals:<\/li>\n<li>Users\/roles, tablespaces, undo\/redo basics<\/li>\n<li>Backup concepts (RMAN basics are helpful even if OCI manages parts)<\/li>\n<li>Basic performance concepts (indexes, execution plans)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after Base Database<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle HA\/DR patterns (as applicable):<\/li>\n<li>Standby databases\/DR runbooks (verify specific support for Base Database)<\/li>\n<li>Infrastructure as Code:<\/li>\n<li>Terraform modules for DB systems, networking, and tagging<\/li>\n<li>Observability:<\/li>\n<li>OCI Monitoring\/Alarms + centralized log management<\/li>\n<li>Database performance monitoring tooling (OCI Database Management where applicable)<\/li>\n<li>Security hardening:<\/li>\n<li>Vault\/KMS key governance patterns<\/li>\n<li>Secure bastion access patterns and just-in-time access<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Solutions Architect (OCI + database workloads)<\/li>\n<li>DBA \/ Cloud DBA<\/li>\n<li>DevOps Engineer (database platform automation)<\/li>\n<li>SRE \/ Production Engineer (monitoring, incident response, reliability)<\/li>\n<li>Security Engineer (network isolation, encryption, audit)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle certifications change over time. For OCI, check Oracle University and official Oracle certification listings and choose tracks related to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI Foundations<\/li>\n<li>OCI Architect<\/li>\n<li>OCI operations specialties<\/li>\n<li>Oracle Database administration (as needed for Base Database operations)<\/li>\n<\/ul>\n\n\n\n<p>Verify current certification names and requirements in official Oracle certification portals.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Build a private Base Database environment with bastion-only access and strict NSGs.<\/li>\n<li>Implement automated provisioning with Terraform and enforce tags\/policies.<\/li>\n<li>Create a backup\/restore drill: restore to a new DB system and validate application connectivity.<\/li>\n<li>Build monitoring: alarms for storage thresholds and CPU, notifications to email\/Slack (via integration).<\/li>\n<li>Implement least-privilege IAM for DB admins vs app operators.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AD (Availability Domain):<\/strong> A physically isolated data center within an OCI region (in regions that use ADs).<\/li>\n<li><strong>Base Database:<\/strong> OCI service for Oracle Database on VM\/bare metal DB systems with OCI integration.<\/li>\n<li><strong>Bastion:<\/strong> Managed service to provide secure access to private resources without public IPs.<\/li>\n<li><strong>Block Volume:<\/strong> OCI persistent block storage used by compute and DB systems.<\/li>\n<li><strong>BYOL:<\/strong> Bring Your Own License; you supply Oracle Database licenses under your agreement.<\/li>\n<li><strong>CDB\/PDB:<\/strong> Container Database \/ Pluggable Database architecture used in modern Oracle Database versions.<\/li>\n<li><strong>Compartment:<\/strong> OCI logical container for resources and access control boundaries.<\/li>\n<li><strong>DB System:<\/strong> The Base Database compute resource (VM\/bare metal) hosting Oracle Database.<\/li>\n<li><strong>Database Home:<\/strong> Oracle Database software installation (version\/patch level) on a DB system.<\/li>\n<li><strong>DRG:<\/strong> Dynamic Routing Gateway for connecting VCNs to on-prem or other networks (VPN\/FastConnect).<\/li>\n<li><strong>IAM Policy:<\/strong> Text rules defining who can do what in OCI.<\/li>\n<li><strong>KMS\/Vault:<\/strong> OCI services for key management and secret storage.<\/li>\n<li><strong>NSG (Network Security Group):<\/strong> Virtual firewall rules applied to VNICs\/resources.<\/li>\n<li><strong>OCPU:<\/strong> Oracle CPU unit used for OCI compute billing.<\/li>\n<li><strong>Object Storage:<\/strong> OCI durable object store used commonly for backups.<\/li>\n<li><strong>Oracle Services Network:<\/strong> OCI service endpoints reachable via Service Gateway.<\/li>\n<li><strong>RPO\/RTO:<\/strong> Recovery Point Objective \/ Recovery Time Objective.<\/li>\n<li><strong>Service Gateway:<\/strong> Enables private subnet access to Oracle Services Network (e.g., Object Storage) without internet.<\/li>\n<li><strong>SQL*Net:<\/strong> Oracle database network protocol used by clients to connect to the listener.<\/li>\n<li><strong>TDE:<\/strong> Transparent Data Encryption, Oracle Database feature for encrypting data at rest.<\/li>\n<li><strong>VCN:<\/strong> Virtual Cloud Network, OCI\u2019s virtual network construct.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Base Database in <strong>Oracle Cloud<\/strong> (OCI) is the core <strong>Data Management<\/strong> service for running <strong>Oracle Database<\/strong> on dedicated VM or bare metal DB systems with cloud-native provisioning, networking, and backup integration\u2014while preserving the administrative control many Oracle workloads require.<\/p>\n\n\n\n<p>It matters because it provides a practical middle ground between self-managed Oracle on raw compute and fully managed autonomous services: you gain OCI governance, private networking, and integrated backups without giving up DBA control.<\/p>\n\n\n\n<p>From a cost perspective, the biggest drivers are <strong>OCPUs, storage, licensing model (BYOL vs License Included), backups retention, and DR footprint<\/strong>. From a security perspective, the strongest baseline is <strong>private subnets, bastion-only access, strict NSGs, encryption (TDE + key governance), and audit\/monitoring<\/strong>.<\/p>\n\n\n\n<p>Use Base Database when you need Oracle compatibility and control on OCI; choose alternatives like Autonomous Database when you want less DBA responsibility, or Exadata Database Service for specialized Exadata performance needs.<\/p>\n\n\n\n<p><strong>Next step:<\/strong> Re-run the hands-on lab using Terraform for repeatability, then add monitoring alarms and a backup\/restore drill to make your deployment operationally production-ready.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Data Management<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[68,62],"tags":[],"class_list":["post-881","post","type-post","status-publish","format-standard","hentry","category-data-management","category-oracle-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/881","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=881"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/881\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=881"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=881"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=881"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}