{"id":931,"date":"2026-04-17T04:26:37","date_gmt":"2026-04-17T04:26:37","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-marketplace-policies-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-marketplace\/"},"modified":"2026-04-17T04:26:37","modified_gmt":"2026-04-17T04:26:37","slug":"oracle-cloud-marketplace-policies-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-marketplace","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-marketplace-policies-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-marketplace\/","title":{"rendered":"Oracle Cloud Marketplace Policies Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Marketplace"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Marketplace<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Oracle Cloud <strong>Marketplace Policies<\/strong> are tenancy-level governance controls for <strong>Oracle Cloud Marketplace<\/strong>. They help you decide <em>whether<\/em> your organization can use Marketplace at all and <em>what kinds of Marketplace listings<\/em> (for example, Oracle-published vs partner-published, free vs paid) your users are allowed to subscribe to.<\/p>\n\n\n\n<p>In simple terms: <strong>Marketplace Policies let administrators reduce risk and control spending by limiting Marketplace usage<\/strong>. Instead of relying on tribal knowledge (\u201cdon\u2019t click Subscribe\u201d), you can put guardrails in place that align with procurement, security, and compliance requirements.<\/p>\n\n\n\n<p>Technically, Marketplace Policies are part of the Oracle Cloud Infrastructure (OCI) control plane for Marketplace. They are configured by administrators and then <strong>enforced when users browse, subscribe to, or attempt to deploy Marketplace listings<\/strong>. Marketplace Policies work alongside OCI IAM (Identity and Access Management): policies define what Marketplace categories are allowed at the tenancy level, and IAM defines which users\/groups can perform Marketplace-related actions in specific compartments.<\/p>\n\n\n\n<p>The problem Marketplace Policies solve is common in real OCI environments: Marketplace makes it easy to deploy vendor software and prebuilt solutions, but that convenience can introduce <strong>unreviewed third-party software, unclear license obligations, unexpected charges, or security exposure<\/strong>. Marketplace Policies provide a first line of governance before deployments happen.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Marketplace Policies?<\/h2>\n\n\n\n<p><strong>Official purpose (scope-aligned):<\/strong> Marketplace Policies in Oracle Cloud are administrative settings that <strong>govern the use of Oracle Cloud Marketplace within an OCI tenancy<\/strong>. These settings help you control which types of listings your users are allowed to subscribe to and use.<\/p>\n\n\n\n<p>Because the Oracle Cloud console and documentation can evolve, confirm the exact current options and labels in the official Oracle Cloud Marketplace documentation:<br\/>\nhttps:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Marketplace\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities (what it does)<\/h3>\n\n\n\n<p>Marketplace Policies typically enable you to:\n&#8211; <strong>Restrict Marketplace usage<\/strong> at the tenancy level (governance guardrails).\n&#8211; <strong>Control subscription eligibility<\/strong> for certain listing types (for example, limiting categories of listings that can be subscribed to).\n&#8211; Support a safer operating model when combined with <strong>OCI IAM<\/strong>, <strong>compartments<\/strong>, <strong>tagging<\/strong>, and <strong>audit logging<\/strong>.<\/p>\n\n\n\n<blockquote>\n<p>If your tenancy has multiple regions enabled, Marketplace Policies are generally treated as <strong>tenancy-wide governance settings<\/strong> (OCI governance commonly follows the IAM \u201cglobal to the tenancy\u201d model). <strong>Verify in official docs<\/strong> how policy enforcement behaves across regions\/realms for your specific tenancy configuration.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (practical view)<\/h3>\n\n\n\n<p>Marketplace Policies are not a \u201cdeployable resource.\u201d Think of them as:\n&#8211; <strong>A control-plane settings page<\/strong> (in the OCI Console) for Marketplace governance\n&#8211; <strong>A set of enforcement rules<\/strong> evaluated when Marketplace actions occur (browse\/subscribe\/deploy)\n&#8211; <strong>An administrative workflow<\/strong> typically owned by cloud platform\/security\/procurement stakeholders<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Service type:<\/strong> Governance \/ administrative control (control plane), aligned to Oracle Cloud Marketplace.<\/li>\n<li><strong>Billing:<\/strong> Marketplace Policies themselves are not typically billed as a separate meter. The <strong>cost impact is indirect<\/strong>, driven by what Marketplace listings you allow users to deploy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Oracle Cloud ecosystem<\/h3>\n\n\n\n<p>Marketplace Policies sit at the intersection of:\n&#8211; <strong>Oracle Cloud Marketplace<\/strong> (where listings are discovered and subscribed to)\n&#8211; <strong>OCI IAM<\/strong> (who can do what, and where)\n&#8211; <strong>Compartments<\/strong> (where Marketplace deployments land)\n&#8211; <strong>Audit<\/strong> (traceability of administrative changes and user actions)\n&#8211; <strong>Budgets \/ Cost Management<\/strong> (control spend after deployments)<\/p>\n\n\n\n<p>If you\u2019re building an OCI landing zone, Marketplace Policies fit naturally into \u201cDay 0\/Day 1 governance\u201d alongside IAM baseline policies, network architecture, and tagging standards.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Marketplace Policies?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Procurement control:<\/strong> Prevent unapproved software subscriptions and vendor engagements.<\/li>\n<li><strong>Cost containment:<\/strong> Reduce the chance of accidental subscription to paid listings or paid usage models.<\/li>\n<li><strong>Standardization:<\/strong> Encourage sanctioned images\/stacks rather than ad-hoc deployments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce supply-chain risk:<\/strong> Marketplace introduces third-party software into your environment; restricting listing types is a practical first control.<\/li>\n<li><strong>Improve environment consistency:<\/strong> Limiting to approved sources reduces variation in images, agents, and default configurations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Fewer incident classes:<\/strong> Unvetted appliances and images can introduce operational fragility (unknown patch cadence, obscure configuration, surprise dependencies).<\/li>\n<li><strong>Clearer supportability:<\/strong> Keeping Marketplace usage aligned to support policies (Oracle or approved partners) simplifies escalation paths.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control third-party code intake:<\/strong> For regulated environments, limiting the types of listings that can be used helps meet internal audit requirements.<\/li>\n<li><strong>License and data handling awareness:<\/strong> Some listings involve license terms and telemetry; restricting use reduces compliance exposure.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<p>Marketplace Policies don\u2019t directly improve performance, but they reduce risk that a \u201cquick deployment\u201d introduces:\n&#8211; Unsupported kernel modules\n&#8211; Nonstandard network patterns\n&#8211; Over-permissioned IAM roles\n&#8211; Unmonitored services that later impact performance and reliability<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Use Marketplace Policies if you:\n&#8211; Run a <strong>shared OCI tenancy<\/strong> serving multiple teams.\n&#8211; Need <strong>guardrails<\/strong> for software adoption.\n&#8211; Have <strong>compliance<\/strong> requirements (SOC 2, ISO 27001, PCI, HIPAA-like controls) that demand controlled third-party intake.\n&#8211; Want to enable Marketplace but with <strong>bounded risk<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it (or should be cautious)<\/h3>\n\n\n\n<p>Marketplace Policies may be too restrictive if:\n&#8211; You\u2019re in a small, fast-moving environment that depends on rapid vendor trials and can manage risk through other means.\n&#8211; You need granular allow\/deny controls at a per-listing level but your current Marketplace Policies capabilities are more coarse-grained (tenancy-wide categories). In that case you may need <strong>process controls<\/strong> (procurement approvals) and <strong>IAM compartment boundaries<\/strong> in addition.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Marketplace Policies used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<p>Common in:\n&#8211; Financial services and insurance (strict vendor and software intake)\n&#8211; Healthcare and life sciences (compliance and data handling controls)\n&#8211; Government and public sector (approved software lists, procurement oversight)\n&#8211; Manufacturing and critical infrastructure (risk avoidance, standardized platforms)\n&#8211; SaaS companies (multi-team environments where guardrails matter)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Platform engineering \/ cloud center of excellence (CCoE)<\/li>\n<li>Security engineering and GRC teams<\/li>\n<li>SRE and operations teams<\/li>\n<li>DevOps and application platform teams<\/li>\n<li>Procurement \/ vendor management stakeholders (as governance partners)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Kubernetes platforms (control which CNIs\/ingress\/security appliances enter)<\/li>\n<li>Security tooling (SIEM forwarders, WAF appliances, vulnerability scanners)<\/li>\n<li>Data platforms (Kafka distributions, databases, ETL tools)<\/li>\n<li>Enterprise apps (commercial appliances or prebuilt stacks)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<p>Marketplace Policies are used in:\n&#8211; Landing zones (baseline governance)\n&#8211; Multi-compartment enterprise tenancy models\n&#8211; Shared services architectures (central network, central logging, central security)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production:<\/strong> Most valuable. You want explicit controls around third-party\/premium software.<\/li>\n<li><strong>Dev\/test:<\/strong> Still useful to prevent uncontrolled spend and reduce the chance that dev deployments become \u201cshadow production.\u201d<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic scenarios where <strong>Oracle Cloud Marketplace Policies<\/strong> are commonly applied. Each use case includes the problem, why Marketplace Policies fit, and a short scenario.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Prevent accidental paid subscriptions<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Engineers subscribe to paid listings unintentionally, triggering unexpected costs or procurement issues.<\/li>\n<li><strong>Why this service fits:<\/strong> Marketplace Policies can restrict Marketplace usage patterns at the tenancy level (exact paid\/free controls depend on current OCI policy options\u2014<strong>verify in official docs<\/strong>).<\/li>\n<li><strong>Scenario:<\/strong> A platform team enables Marketplace for productivity but restricts paid listing subscriptions until procurement workflows are ready.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Block third-party listings in regulated environments<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Compliance requires strict control of third-party software sources.<\/li>\n<li><strong>Why this service fits:<\/strong> Marketplace Policies can limit which categories of listings are allowed (for example, Oracle vs partner offerings\u2014<strong>verify current option names<\/strong>).<\/li>\n<li><strong>Scenario:<\/strong> A bank allows only Oracle-published listings while building a formal third-party risk assessment pipeline.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Enable Marketplace only for a controlled pilot window<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> You want Marketplace benefits but only for a limited pilot period.<\/li>\n<li><strong>Why this service fits:<\/strong> Marketplace Policies are a fast control-plane lever for enabling\/disabling or restricting use without refactoring IAM everywhere.<\/li>\n<li><strong>Scenario:<\/strong> A cloud team enables Marketplace for 30 days to evaluate two vendor images, then disables or tightens restrictions after the pilot.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Reduce software supply-chain risk<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Marketplace listings may include images with unknown build provenance or update practices.<\/li>\n<li><strong>Why this service fits:<\/strong> Policies reduce the set of allowable intake paths and make governance auditable.<\/li>\n<li><strong>Scenario:<\/strong> Security team requires that only vetted sources can be subscribed to while they build a golden-image program.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Enforce \u201cplatform team as broker\u201d model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> App teams deploy appliances directly; operations later inherits them without knowledge.<\/li>\n<li><strong>Why this service fits:<\/strong> Marketplace Policies can be combined with IAM so only the platform group can subscribe\/deploy.<\/li>\n<li><strong>Scenario:<\/strong> Platform team becomes the broker: they subscribe to approved listings, publish internal Terraform modules, and app teams consume via standardized pipelines.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Align Marketplace usage with compartment strategy<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Marketplace resources appear in inconsistent compartments, breaking billing and ownership.<\/li>\n<li><strong>Why this service fits:<\/strong> Policies and IAM together help constrain where Marketplace actions occur, and tagging policies can complement governance.<\/li>\n<li><strong>Scenario:<\/strong> Subscriptions\/deployments are allowed only in <code>Shared-Services<\/code> or <code>Sandbox<\/code> compartments (enforced via IAM), while Marketplace Policies restrict listing types.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Limit exposure during incident response<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> During an active security incident, you want to reduce change vectors and software introductions.<\/li>\n<li><strong>Why this service fits:<\/strong> Marketplace Policies can rapidly reduce allowed Marketplace activity (depending on available controls).<\/li>\n<li><strong>Scenario:<\/strong> Security incident commander temporarily restricts Marketplace usage while investigating lateral movement.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Support internal audit requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Auditors ask, \u201cWho can bring in third-party software and under what control?\u201d<\/li>\n<li><strong>Why this service fits:<\/strong> Marketplace Policies provide a documented governance mechanism; Audit logs can show changes and actions.<\/li>\n<li><strong>Scenario:<\/strong> Annual audit requires evidence of preventive controls; Marketplace Policies plus IAM and Audit reports satisfy the requirement.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Control vendor terms acceptance responsibilities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Marketplace subscriptions often require acceptance of terms. You may want only authorized approvers to accept.<\/li>\n<li><strong>Why this service fits:<\/strong> Marketplace Policies and IAM-based controls can restrict who can subscribe, aligning with procurement approval responsibilities.<\/li>\n<li><strong>Scenario:<\/strong> Only the procurement-approved \u201cCloud Purchasers\u201d group is allowed to subscribe to listings.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Standardize reference architectures and repeatable deployments<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams deploy similar vendor stacks inconsistently.<\/li>\n<li><strong>Why this service fits:<\/strong> Policies reduce the catalog to approved options; platform team provides approved \u201cpaths\u201d for deployment.<\/li>\n<li><strong>Scenario:<\/strong> Org approves one WAF and one logging agent appliance from Marketplace; everything else is blocked or discouraged.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">11) Multi-entity tenancy governance (business units)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> One tenancy hosts multiple business units with different risk tolerances.<\/li>\n<li><strong>Why this service fits:<\/strong> Marketplace Policies provide a global baseline; compartments + IAM provide more granular per-BU controls.<\/li>\n<li><strong>Scenario:<\/strong> Global policy restricts risky listing types, while BU-specific IAM policies define which BU teams can deploy approved listings in their compartments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12) Education and training tenancies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Students accidentally deploy costly marketplace solutions.<\/li>\n<li><strong>Why this service fits:<\/strong> Restricting Marketplace scope reduces cost surprises.<\/li>\n<li><strong>Scenario:<\/strong> A training tenancy allows only free\/sandbox-friendly marketplace options; budgets and quotas backstop spending.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Marketplace Policies are governance controls, so features are primarily about <strong>restriction and enforcement<\/strong> rather than deploying resources. The exact policy options can change; where your console differs, use the on-screen descriptions and confirm in official documentation:<br\/>\nhttps:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Marketplace\/home.htm<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 1: Tenancy-level governance for Marketplace usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets administrators define whether and how Marketplace can be used within a tenancy.<\/li>\n<li><strong>Why it matters:<\/strong> A single administrative control can reduce broad risk across all compartments.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster governance than building complex per-team rules first.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Tenancy-wide settings can be coarse; you may still need IAM, compartments, and process controls for fine-grained governance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 2: Restriction of listing types (category-based allow\/deny)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Restricts what kinds of listings users can subscribe to (for example, based on publisher\/source and\/or commercial model, depending on current OCI options).<\/li>\n<li><strong>Why it matters:<\/strong> Third-party and paid listings can introduce risk and cost.<\/li>\n<li><strong>Practical benefit:<\/strong> Prevents risky or noncompliant subscriptions before they happen.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> If you need per-listing approvals, you may need additional governance and workflow tooling.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 3: Enforced control-plane behavior during subscription\/deployment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Enforces restrictions when a user attempts to subscribe to a listing or proceed with Marketplace-driven deployment flows.<\/li>\n<li><strong>Why it matters:<\/strong> Preventive controls are stronger than detective controls.<\/li>\n<li><strong>Practical benefit:<\/strong> Reduces reliance on training and manual reviews.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Enforcement is bounded by what Marketplace Policies are designed to control; it does not replace hardening deployed resources.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 4: Works alongside OCI IAM for \u201cwho can subscribe\/deploy\u201d<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Marketplace Policies define \u201cwhat\u2019s allowed\u201d globally, while IAM defines \u201cwho can do what in which compartment.\u201d<\/li>\n<li><strong>Why it matters:<\/strong> You need both: category restrictions and identity-based authorization.<\/li>\n<li><strong>Practical benefit:<\/strong> Enables models like \u201cplatform team brokers subscriptions\u201d while app teams only deploy approved stacks.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> IAM permissions for Marketplace have specific resource types\/verbs\u2014<strong>verify exact IAM policy statements in official docs<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 5: Auditable changes via OCI Audit (governance traceability)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Administrative changes to tenancy settings and user actions are typically captured in OCI Audit (depending on event types and logging configuration).<\/li>\n<li><strong>Why it matters:<\/strong> Governance controls must be auditable for compliance.<\/li>\n<li><strong>Practical benefit:<\/strong> Helps answer \u201cwho changed Marketplace governance and when?\u201d<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Audit retention, export, and query patterns should be planned; ensure your audit strategy meets your regulatory needs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 6: Supports landing zone governance patterns<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Integrates naturally into a landing zone build checklist (governance, IAM, network, tagging, budgets).<\/li>\n<li><strong>Why it matters:<\/strong> Marketplace is a common \u201cbackdoor\u201d for nonstandard deployments if not governed.<\/li>\n<li><strong>Practical benefit:<\/strong> Reduces variance across teams and environments.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Policies are only one layer; you still need secure network defaults, logging, and patching standards.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level service architecture<\/h3>\n\n\n\n<p>At a high level:\n1. An <strong>OCI administrator<\/strong> configures <strong>Marketplace Policies<\/strong> at the tenancy level.\n2. Users browse Marketplace listings in the OCI Console (or via APIs\/automation where applicable).\n3. When a user attempts to <strong>subscribe<\/strong> or proceed with a deployment workflow, the Marketplace control plane evaluates:\n   &#8211; <strong>Marketplace Policies<\/strong> (what listing types are allowed)\n   &#8211; <strong>IAM authorization<\/strong> (whether the identity can perform the action in the target compartment)\n4. If allowed, the subscription\/deployment proceeds and may create OCI resources (compute instances, networking, storage, etc.) depending on the listing.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow (conceptual)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane:<\/strong> Policy evaluation, subscription metadata, authorization decisions.<\/li>\n<li><strong>Data plane:<\/strong> The actual runtime resources created by Marketplace listings (instances, clusters, etc.).<\/li>\n<li><strong>Billing plane:<\/strong> Any charges from deployed OCI services and\/or listing-related commercial terms (varies by listing; <strong>verify listing pricing details<\/strong> before deploying).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services<\/h3>\n\n\n\n<p>Common integrations around Marketplace Policies include:\n&#8211; <strong>OCI IAM:<\/strong> Manage who can subscribe\/deploy and where (compartment scope).\n&#8211; <strong>Compartments:<\/strong> Contain and isolate Marketplace deployments.\n&#8211; <strong>OCI Audit:<\/strong> Track policy changes and Marketplace actions for compliance.\n&#8211; <strong>Budgets and Cost Management:<\/strong> Detect and prevent spend escalation after enabling Marketplace.\n&#8211; <strong>Networking (VCN, NSGs, security lists):<\/strong> Constrain exposure of Marketplace-deployed resources.\n&#8211; <strong>Vault:<\/strong> Store secrets for workloads deployed from Marketplace (application-level).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services (typical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI tenancy\/IAM (required)<\/li>\n<li>Oracle Cloud Marketplace (required)<\/li>\n<li>Audit (strongly recommended)<\/li>\n<li>Cost Management (recommended)<\/li>\n<li>Networking and compute services (only if you deploy listings)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Users authenticate via OCI identity (local users, federation, etc.).<\/li>\n<li>Authorization uses <strong>IAM policy statements<\/strong> and tenancy governance controls.<\/li>\n<li>Marketplace Policies are an additional governance layer evaluated by the Marketplace control plane.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<p>Marketplace Policies themselves have no networking. They govern the ability to deploy Marketplace software that <em>will<\/em> have networking implications:\n&#8211; public IP assignment\n&#8211; inbound\/outbound rules\n&#8211; egress to the internet\n&#8211; private endpoints\n&#8211; load balancers\nPlan \u201csafe defaults\u201d in your landing zone so Marketplace deployments can\u2019t easily violate network security.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Audit<\/strong> is central for governance.<\/li>\n<li>For workloads deployed from Marketplace, ensure standard observability:<\/li>\n<li>OCI Logging\/Monitoring\/Alarms (service availability varies by resource type)<\/li>\n<li>OS logs (syslog\/journald), application logs<\/li>\n<li>vulnerability scanning and patch compliance (your tools\/process)<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Simple architecture diagram (conceptual)<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  Admin[Tenancy Admin] --&gt;|Configure| MP[Marketplace Policies]\n  User[OCI User\/Engineer] --&gt;|Browse\/Subscribe| Mkt[Oracle Cloud Marketplace]\n  Mkt --&gt;|Evaluate| MP\n  Mkt --&gt;|Authorize| IAM[OCI IAM Policies]\n  Mkt --&gt;|If allowed, deploy| OCI[OCI Resources&lt;br\/&gt;Compute\/VCN\/Storage]\n  MP --&gt; Audit[OCI Audit]\n  IAM --&gt; Audit\n  OCI --&gt; Cost[Cost Management\/Budgets]\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Production-style architecture diagram (governed enterprise)<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Governance[\"Governance &amp; Security\"]\n    MP[Marketplace Policies&lt;br\/&gt;(Tenancy-level)]\n    IAM[IAM Groups\/Policies]\n    Audit[OCI Audit]\n    Tag[Tagging\/Tag Defaults]\n    Budgets[Budgets &amp; Cost Tracking]\n  end\n\n  subgraph LandingZone[\"Landing Zone Baseline\"]\n    Net[Network Compartments&lt;br\/&gt;VCN, NSGs, Routing]\n    Log[Central Logging\/Monitoring]\n    Vault[OCI Vault]\n  end\n\n  subgraph Workloads[\"Workload Compartments\"]\n    Dev[Dev Compartment]\n    Prod[Prod Compartment]\n    Shared[Shared Services Compartment]\n  end\n\n  Platform[Platform Team] --&gt; MP\n  Platform --&gt; IAM\n  Security[Security\/GRC] --&gt; MP\n  Security --&gt; Audit\n\n  Engineers[App Teams] --&gt;|Request approved listing| Platform\n  Engineers --&gt;|Deploy in allowed compartment| Dev\n  Engineers --&gt;|Deploy in allowed compartment| Prod\n\n  MP --&gt;|Restrict listing categories| Mkt[Oracle Cloud Marketplace]\n  IAM --&gt;|Authorize actions| Mkt\n\n  Mkt --&gt;|Deploys resources| Dev\n  Mkt --&gt;|Deploys resources| Prod\n\n  Dev --&gt; Log\n  Prod --&gt; Log\n  Dev --&gt; Vault\n  Prod --&gt; Vault\n\n  MP --&gt; Audit\n  Mkt --&gt; Audit\n  Budgets --&gt;|Alerts| Platform\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Tenancy requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An active <strong>Oracle Cloud (OCI) tenancy<\/strong> with access to <strong>Oracle Cloud Marketplace<\/strong>.<\/li>\n<li>You must have <strong>administrative access<\/strong> to configure tenancy-level settings.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>To work with Marketplace Policies, you typically need permissions equivalent to:\n&#8211; <strong>Tenancy administrator<\/strong> or a delegated administrator role with rights to manage Marketplace governance settings.<\/p>\n\n\n\n<p>For subscribing\/deploying Marketplace listings, users also need appropriate IAM permissions for Marketplace actions and for creating resources (compute, networking, etc.) in target compartments.<\/p>\n\n\n\n<blockquote>\n<p>OCI IAM policy statements and resource types for Marketplace can vary and are periodically updated. <strong>Verify the latest IAM policy reference for Marketplace in official docs<\/strong>:<br\/>\nhttps:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Marketplace Policies themselves are governance settings, but enabling Marketplace can lead to billable deployments:<\/li>\n<li>OCI resources created from listings (compute, storage, networking)<\/li>\n<li>Listing-related commercial terms (if applicable to the listing)<\/li>\n<li>Ensure your tenancy has a configured payment method and cost controls (budgets, quotas).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools needed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Console<\/strong> access (primary for Marketplace Policies).<\/li>\n<li>OCI CLI\/SDK are optional; Marketplace Policies are generally configured via console. If your organization automates governance, check whether OCI exposes APIs for these settings (<strong>verify in official docs<\/strong>).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Cloud Marketplace is available in many OCI regions, but availability and listing support can vary by region and realm.  <\/li>\n<li>Marketplace Policies are typically tenancy-level; <strong>verify cross-region behavior<\/strong> in the official Marketplace documentation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<p>Marketplace Policies don\u2019t typically have \u201cquotas\u201d like compute. Practical limits are organizational:\n&#8211; How many teams need access\n&#8211; How you structure compartments and budgets\n&#8211; How many Marketplace deployments your operations team can support<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services (recommended for production)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI Audit<\/strong> (for governance traceability)<\/li>\n<li><strong>Budgets \/ cost tracking<\/strong> (to manage indirect Marketplace cost impact)<\/li>\n<li><strong>Network baseline<\/strong> (VCN patterns, egress controls, NSGs)<\/li>\n<li><strong>Vault<\/strong> (for secrets in deployed solutions)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing model (accurate framing)<\/h3>\n\n\n\n<p><strong>Marketplace Policies<\/strong> are governance settings and are <strong>not typically priced as a standalone metered service<\/strong>. The main cost impact is indirect and comes from what you allow users to deploy through Marketplace.<\/p>\n\n\n\n<p>Marketplace cost considerations split into two buckets:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>OCI resource costs created by the listing<\/strong>\n   &#8211; Compute instances\n   &#8211; Block volumes\n   &#8211; Load balancers\n   &#8211; Object storage\n   &#8211; Network egress\n   &#8211; Managed services that a stack provisions<\/p>\n<\/li>\n<li>\n<p><strong>Listing-related charges (listing-dependent)<\/strong>\n   &#8211; Some Marketplace listings may include paid software licensing models.\n   &#8211; Others may be BYOL (Bring Your Own License) where charges occur outside OCI.\n   &#8211; Some may be free to use but still incur underlying infrastructure costs.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<p>Always check the listing page in Oracle Cloud Marketplace for:\n&#8211; Pricing notes\n&#8211; Billing units (if any)\n&#8211; License terms and conditions<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Official pricing references<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Cloud pricing overview: https:\/\/www.oracle.com\/cloud\/pricing\/<\/li>\n<li>OCI pricing documentation entry point: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/CostAnalysis\/home.htm (Cost Management docs area; verify current URL structure if it changes)<\/li>\n<li>Oracle Cloud Cost Estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (most common)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Compute shape selection<\/strong> (OCPU\/memory) used by a Marketplace image<\/li>\n<li><strong>Always-on instances<\/strong> (24\/7 cost)<\/li>\n<li><strong>Block storage sizing and performance tier<\/strong><\/li>\n<li><strong>Load balancer hours + bandwidth<\/strong><\/li>\n<li><strong>Outbound data transfer (egress)<\/strong>, especially internet egress<\/li>\n<li><strong>High availability topologies<\/strong> (multiple instances, multi-AD patterns)<\/li>\n<li><strong>Support and operations tooling<\/strong> you add after deployment<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Hidden or indirect costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Logging and monitoring data ingestion\/storage<\/strong><\/li>\n<li><strong>Backups and snapshots<\/strong><\/li>\n<li><strong>Patch management overhead<\/strong><\/li>\n<li><strong>Security scanning tooling<\/strong><\/li>\n<li><strong>Network appliances<\/strong> (if the listing deploys additional components)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Marketplace deployments that pull container images, updates, or telemetry can generate:<\/li>\n<li>Internet egress<\/li>\n<li>NAT gateway usage<\/li>\n<li>Service gateway routing differences<\/li>\n<li>Plan egress controls and evaluate whether the solution can operate with restricted outbound access.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prefer <strong>free\/BYOL listings<\/strong> for evaluation (when suitable).<\/li>\n<li>Deploy into <strong>sandbox compartments<\/strong> with budgets and quotas.<\/li>\n<li>Right-size compute; schedule shutdown for non-production.<\/li>\n<li>Use tagging to attribute spend to a team\/project.<\/li>\n<li>Require architecture review before production Marketplace deployments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (no fabricated numbers)<\/h3>\n\n\n\n<p>A low-cost trial typically involves:\n&#8211; Subscribing to a free\/BYOL Marketplace listing (no direct listing fee)\n&#8211; Deploying a small compute instance for a few hours\/days\n&#8211; Minimal storage and no load balancer<\/p>\n\n\n\n<p>The exact cost depends on:\n&#8211; Region\n&#8211; Compute shape\n&#8211; Runtime duration\n&#8211; Storage size\n&#8211; Network egress<\/p>\n\n\n\n<p>Use the Oracle Cost Estimator for a region-accurate estimate:<br\/>\nhttps:\/\/www.oracle.com\/cloud\/costestimator.html<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, costs often come from:\n&#8211; Multiple instances for HA\n&#8211; Load balancers\n&#8211; Persistent volumes and backups\n&#8211; Monitoring\/log aggregation at scale\n&#8211; Security tooling and operations overhead<\/p>\n\n\n\n<p>A good practice is to treat Marketplace enablement as a <strong>platform product<\/strong>: require a cost model per approved listing and maintain a \u201cknown monthly run rate\u201d for each reference deployment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab is designed to be <strong>safe and low-cost<\/strong> by focusing on governance configuration and subscription behavior rather than deploying large stacks.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Configure <strong>Marketplace Policies<\/strong> in Oracle Cloud to enforce a more controlled Marketplace usage model, then validate that restrictions are applied.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Review your current Marketplace governance baseline.\n2. Configure Marketplace Policies to restrict Marketplace usage (based on the controls available in your tenancy).\n3. Validate the behavior by attempting a Marketplace subscription action that should be restricted.\n4. Confirm traceability using Audit logs.\n5. Roll back changes (cleanup) to restore the original state.<\/p>\n\n\n\n<blockquote>\n<p>Important: Marketplace Policies options can differ by tenancy, realm, and OCI UI updates. Follow the intent of each step and rely on the <strong>descriptions shown in the console<\/strong>. For exact, current option labels, verify the official docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Marketplace\/home.htm<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Confirm you have the right admin access<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in to the <strong>OCI Console<\/strong> using an account with tenancy administration privileges.<\/li>\n<li>Open the navigation menu and confirm you can access tenancy administration\/governance areas.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You can access governance settings in the tenancy and can open Marketplace-related administration pages.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You can view tenancy details and governance settings without authorization errors.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Locate the Marketplace Policies page<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the OCI Console, open the navigation menu.<\/li>\n<li>Navigate to <strong>Marketplace<\/strong> and look for <strong>Marketplace Policies<\/strong> (or a similarly named governance entry under administration\/tenancy settings depending on your console layout).<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> You reach a page that shows Marketplace governance controls for your tenancy.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You can see current policy settings and a way to edit\/update them.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Record the current baseline (before changes)<\/h3>\n\n\n\n<p>Before you change anything, capture your baseline:\n&#8211; Which controls are enabled\/disabled\n&#8211; Any notes about what is allowed\n&#8211; A timestamp and your admin username (for audit traceability)<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> You have a recorded baseline so you can revert safely.<\/p>\n\n\n\n<p><strong>Verification checklist:<\/strong>\n&#8211; Baseline recorded in your change ticket \/ notes.\n&#8211; You understand which Marketplace actions should be allowed today.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Apply a restrictive Marketplace Policies configuration (safe governance change)<\/h3>\n\n\n\n<p>On the Marketplace Policies page, update settings to implement a conservative posture. Choose one or more restrictions that match your governance goal, for example:\n&#8211; Restrict Marketplace usage to <strong>lower-risk listing categories<\/strong>\n&#8211; Disallow subscription to listing categories that your organization is not ready to govern (for example, third-party and\/or paid listings\u2014depending on what your console provides)<\/p>\n\n\n\n<p>Make a minimal change first (one control), then apply\/save.<\/p>\n\n\n\n<p><strong>Expected outcome:<\/strong> Marketplace governance settings are updated successfully.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; The console confirms the update.\n&#8211; The displayed policy state reflects your changes.<\/p>\n\n\n\n<blockquote>\n<p>Tip: If the console provides an explanatory tooltip or description for each policy, rely on that text for understanding the impact. Oracle may adjust naming over time; the intent is consistent: restrict Marketplace usage to reduce risk.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Validate enforcement by attempting a restricted Marketplace action<\/h3>\n\n\n\n<p>Now validate behavior.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open <strong>Oracle Cloud Marketplace<\/strong> listings in the console.<\/li>\n<li>Identify a listing type that should be restricted by your new Marketplace Policies settings (for example, a category you disabled).<\/li>\n<li>Attempt the action that should be blocked (commonly \u201cSubscribe\u201d or proceeding past terms acceptance, depending on the listing workflow).<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> The console prevents the action or displays an error\/denial indicating the tenancy\u2019s Marketplace governance does not allow it.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You see a clear UI block, denial message, or the action is not available.\n&#8211; The listing cannot be subscribed to under the restricted category.<\/p>\n\n\n\n<p>If you cannot find a listing that matches your restricted category:\n&#8211; Use a different listing category, or\n&#8211; Temporarily adjust the restriction to a category you can test immediately.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Confirm governance traceability in OCI Audit<\/h3>\n\n\n\n<p>To ensure your governance changes are auditable:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Navigate to <strong>Audit<\/strong> (OCI Audit service) in the console.<\/li>\n<li>Set the time range to include your Marketplace Policies change timestamp.<\/li>\n<li>Filter by your user identity and look for events that correspond to governance or tenancy setting updates.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> An audit event exists showing that Marketplace Policies (or an associated tenancy setting) was updated, including who made the change and when.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; You can identify:\n  &#8211; the event time\n  &#8211; the user\/principal\n  &#8211; the action\/event name\n  &#8211; the affected resource\/settings (as shown in the event payload)<\/p>\n\n\n\n<blockquote>\n<p>Audit event names and payload schemas evolve. If you don\u2019t immediately see a clear event, broaden filters and verify audit configuration in your tenancy.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this quick validation checklist:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Control plane:<\/strong> Marketplace Policies page reflects the intended restrictions.<\/li>\n<li><strong>Enforcement:<\/strong> A restricted Marketplace action is blocked.<\/li>\n<li><strong>Auditability:<\/strong> OCI Audit shows an event for the policy change (and ideally for the blocked\/attempted action where applicable).<\/li>\n<li><strong>Reversibility:<\/strong> You can revert to baseline without ambiguity.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and fixes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>You can\u2019t find \u201cMarketplace Policies\u201d in the console<\/strong>\n   &#8211; Your tenancy may have a different menu layout or you may lack permissions.\n   &#8211; Try searching within the console for \u201cMarketplace\u201d and \u201cPolicies\u201d.\n   &#8211; Confirm you\u2019re in the correct tenancy and have admin rights.<\/p>\n<\/li>\n<li>\n<p><strong>Changes don\u2019t appear to take effect<\/strong>\n   &#8211; Refresh the console session.\n   &#8211; Confirm the changes were saved successfully.\n   &#8211; Re-check that you changed the correct setting (some controls may affect only certain listing types).<\/p>\n<\/li>\n<li>\n<p><strong>You can still subscribe when you expect it to be blocked<\/strong>\n   &#8211; Your restriction may not apply to that listing category.\n   &#8211; The listing may be considered an allowed category under your current policy set.\n   &#8211; Verify in official docs how the policy is evaluated for that listing type.<\/p>\n<\/li>\n<li>\n<p><strong>No Audit events found<\/strong>\n   &#8211; Confirm Audit is enabled and you\u2019re searching the right time range and compartment\/tenancy context.\n   &#8211; Expand filters (principal, event type).\n   &#8211; Verify Audit documentation and your retention\/export approach.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>Revert changes to restore the original baseline:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Return to the Marketplace Policies page.<\/li>\n<li>Restore the settings you recorded in Step 3.<\/li>\n<li>Save\/apply changes.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome:<\/strong> Your tenancy\u2019s Marketplace governance is returned to its pre-lab state.<\/p>\n\n\n\n<p><strong>Verification:<\/strong>\n&#8211; Marketplace Policies match the baseline.\n&#8211; Marketplace subscription behavior returns to previous behavior.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Treat Marketplace enablement as part of your <strong>landing zone architecture<\/strong>, not an afterthought.<\/li>\n<li>Separate <strong>sandbox<\/strong> and <strong>production<\/strong> compartments and restrict Marketplace deployments to sandbox until a listing is approved.<\/li>\n<li>Standardize Marketplace-based deployments through <strong>reference architectures<\/strong> and \u201cknown good\u201d patterns.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use <strong>least privilege<\/strong> for Marketplace actions:<\/li>\n<li>Only allow subscription\/deployment actions to approved groups.<\/li>\n<li>Restrict target compartments where deployments can occur.<\/li>\n<li>Avoid granting broad permissions like \u201cmanage all-resources\u201d to teams just to use Marketplace.<\/li>\n<li>Use federation (where appropriate) and strong MFA for identities that can change governance settings.<\/li>\n<\/ul>\n\n\n\n<blockquote>\n<p>For exact IAM statements related to Marketplace, rely on the latest OCI IAM policy reference (<strong>verify in official docs<\/strong>):<br\/>\nhttps:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Require a <strong>cost model<\/strong> per approved listing (compute shape, expected runtime, egress, backups).<\/li>\n<li>Use <strong>Budgets<\/strong> and alerts for compartments where Marketplace deployments are allowed.<\/li>\n<li>Enforce tagging so Marketplace spend is attributable to owners.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Benchmark vendor appliances like you would any production workload.<\/li>\n<li>Validate that Marketplace images meet performance needs and can be tuned (storage IOPS, network throughput, CPU pinning, etc.).<\/li>\n<li>Treat Marketplace deployments as a starting point, not a final architecture.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Validate HA patterns supported by the listing (single instance vs multi-node).<\/li>\n<li>Confirm patching\/upgrade strategy:<\/li>\n<li>Can you update without breaking support?<\/li>\n<li>Is there a vendor-supported upgrade path?<\/li>\n<li>Include backup\/restore plans and test them.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Standardize observability:<\/li>\n<li>metrics, logs, alarms, dashboards<\/li>\n<li>Integrate with incident response:<\/li>\n<li>ownership tags<\/li>\n<li>runbooks<\/li>\n<li>escalation path with vendor (if third-party)<\/li>\n<li>Keep an inventory of Marketplace subscriptions and deployments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use consistent naming for Marketplace-related resources and compartments:<\/li>\n<li><code>mkt-&lt;team&gt;-&lt;env&gt;-&lt;app&gt;<\/code><\/li>\n<li>Enforce tags like:<\/li>\n<li><code>owner<\/code>, <code>cost-center<\/code>, <code>environment<\/code>, <code>data-classification<\/code>, <code>support-tier<\/code><\/li>\n<li>Document approved listing categories and your review workflow.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Marketplace Policies are <strong>administrative governance<\/strong> controls.<\/li>\n<li>IAM is the <strong>authorization engine<\/strong> determining who can subscribe\/deploy and where.<\/li>\n<li>Best practice: separate duties:<\/li>\n<li>Security\/platform team controls Marketplace Policies and approvals<\/li>\n<li>App teams deploy only into approved compartments with bounded permissions<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Marketplace Policies themselves don\u2019t store your data; they govern actions.<\/li>\n<li>For Marketplace deployments, enforce encryption standards:<\/li>\n<li>encryption at rest (block volumes, databases)<\/li>\n<li>encryption in transit (TLS)<\/li>\n<li>Use OCI Vault for keys\/secrets when workloads require them.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<p>Marketplace listings often deploy software that listens on network ports. Common mistakes:\n&#8211; Exposing admin consoles to the public internet\n&#8211; Using wide-open security lists (0.0.0.0\/0 inbound)\n&#8211; Allowing unrestricted outbound egress<\/p>\n\n\n\n<p>Recommendations:\n&#8211; Prefer private subnets for internal services.\n&#8211; Use NSGs with minimal rules.\n&#8211; Use bastions and private access patterns for administration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not embed credentials in Terraform variables stored in plaintext.<\/li>\n<li>Use Vault and secret injection patterns supported by your deployment tooling.<\/li>\n<li>Rotate credentials after initial deployment.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure governance changes (Marketplace Policies) are auditable.<\/li>\n<li>Export audit logs to a protected logging account\/project if required.<\/li>\n<li>For deployed workloads, centralize logs and protect log integrity.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Maintain an approved software list and map Marketplace policy posture to it.<\/li>\n<li>Archive:<\/li>\n<li>Marketplace listing terms accepted (where applicable)<\/li>\n<li>who accepted them and under what authority<\/li>\n<li>Validate vendor compliance requirements (data residency, telemetry, support boundaries).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enabling Marketplace broadly with no budgets, no tagging, and no compartment boundaries.<\/li>\n<li>Allowing \u201cany user\u201d to accept vendor terms.<\/li>\n<li>Deploying third-party appliances into production without:<\/li>\n<li>vulnerability scanning<\/li>\n<li>patch strategy<\/li>\n<li>secure network defaults<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with restrictive Marketplace Policies, then relax as your governance matures.<\/li>\n<li>Require a security review for any listing that:<\/li>\n<li>introduces inbound internet exposure<\/li>\n<li>processes sensitive data<\/li>\n<li>installs agents with broad access<\/li>\n<li>Use a dedicated \u201cMarketplace Sandbox\u201d compartment with tight budgets and quotas.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<blockquote>\n<p>Marketplace Policies are governance controls, not a full procurement system. Plan accordingly.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Known limitations (practical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Coarse-grained controls:<\/strong> Marketplace Policies may not provide per-listing allow\/deny or rich approval workflows.<\/li>\n<li><strong>Not a substitute for IAM:<\/strong> You still must control who can deploy resources and where.<\/li>\n<li><strong>Not a substitute for security hardening:<\/strong> Allowed Marketplace images can still be insecure if deployed with permissive networking and weak credentials.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>No typical service quota like compute, but your tenancy resource quotas still apply for anything you deploy from Marketplace.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regional constraints<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Marketplace listing availability can vary by region.<\/li>\n<li>Enforcement is usually tenancy-wide, but behavior can depend on realm\/region configuration\u2014<strong>verify in official docs<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Pricing surprises<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u201cFree\u201d listings can still incur substantial infrastructure costs.<\/li>\n<li>Vendor licensing can be separate from OCI billing for BYOL models.<\/li>\n<li>Network egress and load balancers frequently dominate cost in real deployments.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compatibility issues<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Some listings assume certain network patterns (public subnets, specific ports).<\/li>\n<li>Some images may not align with your baseline hardening (CIS benchmarks, custom agents, logging).<\/li>\n<li>Some stacks assume specific OCI features are enabled in the region.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational gotchas<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Marketplace deployments can drift from standard configuration management.<\/li>\n<li>Updates might require vendor-specific tooling and procedures.<\/li>\n<li>Ownership can become unclear (\u201cwho runs this appliance?\u201d) without tagging and runbooks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Migration challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Moving from Marketplace-deployed vendor appliances to internally built images can be nontrivial:<\/li>\n<li>data migration<\/li>\n<li>license transitions<\/li>\n<li>operational model changes<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Vendor-specific nuances<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Support boundaries vary by publisher.<\/li>\n<li>Terms acceptance and telemetry may differ per listing.<\/li>\n<li>Always review listing documentation and terms.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Marketplace Policies are a governance feature for Oracle Cloud Marketplace. Alternatives typically fall into:\n&#8211; Other OCI governance controls (IAM, compartments, quotas, budgets)\n&#8211; Marketplace governance in other clouds\n&#8211; Self-managed software catalogs and internal platform engineering approaches<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Oracle Cloud Marketplace Policies<\/strong><\/td>\n<td>Tenancy-wide governance of Marketplace usage<\/td>\n<td>Fast guardrails; reduces risky\/unauthorized Marketplace adoption; complements IAM and Audit<\/td>\n<td>Often coarse-grained; not a procurement workflow engine<\/td>\n<td>You need immediate Marketplace governance across teams<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI IAM (compartment-based authorization)<\/strong><\/td>\n<td>Controlling who can deploy what and where<\/td>\n<td>Fine-grained permissioning; strong separation of duties<\/td>\n<td>Doesn\u2019t inherently restrict Marketplace listing categories tenancy-wide<\/td>\n<td>You need per-team\/per-compartment control; use with Marketplace Policies<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Budgets + tagging strategy<\/strong><\/td>\n<td>Cost governance<\/td>\n<td>Strong cost attribution and alerting; easy to operationalize<\/td>\n<td>Detective\/after-the-fact; doesn\u2019t prevent subscription alone<\/td>\n<td>You want cost controls after enabling Marketplace<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Quotas<\/strong><\/td>\n<td>Hard caps on resource usage<\/td>\n<td>Prevents runaway provisioning<\/td>\n<td>Doesn\u2019t address license\/terms\/vendor risk<\/td>\n<td>You want strict guardrails on resource consumption<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Organizations + IAM + AWS Marketplace controls<\/strong><\/td>\n<td>AWS enterprise governance<\/td>\n<td>Mature org-level governance patterns; broad tooling<\/td>\n<td>Different cloud; requires AWS adoption<\/td>\n<td>Your workloads are on AWS and Marketplace governance is needed there<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Marketplace Private Store + Azure Policy<\/strong><\/td>\n<td>Azure enterprise governance<\/td>\n<td>Strong governance and policy framework<\/td>\n<td>Different cloud; not OCI<\/td>\n<td>You operate primarily in Azure<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Cloud Marketplace controls + Org Policy<\/strong><\/td>\n<td>GCP governance<\/td>\n<td>Organization policy model; integrates with GCP<\/td>\n<td>Different cloud; not OCI<\/td>\n<td>You operate primarily in GCP<\/td>\n<\/tr>\n<tr>\n<td><strong>Internal curated catalog (self-managed)<\/strong><\/td>\n<td>Highly regulated environments<\/td>\n<td>Maximum control; can require approvals and scanning<\/td>\n<td>Higher engineering overhead; slower adoption<\/td>\n<td>You need strict intake processes beyond Marketplace Policies<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example (regulated industry)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A financial services company wants to use Oracle Cloud Marketplace for faster provisioning of security tools and vendor appliances, but internal audit prohibits uncontrolled third-party software adoption and paid subscriptions without procurement.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Marketplace Policies configured to restrict Marketplace usage to approved categories (per available controls).<\/li>\n<li>IAM model:<ul>\n<li>Only a \u201cPlatform-Broker\u201d group can subscribe to Marketplace listings.<\/li>\n<li>App teams can deploy only from approved internal Terraform modules into their compartments.<\/li>\n<\/ul>\n<\/li>\n<li>Audit logs exported to a centralized logging account.<\/li>\n<li>Budgets on Marketplace-enabled compartments with alerting to FinOps and platform ops.<\/li>\n<li><strong>Why Marketplace Policies were chosen:<\/strong><\/li>\n<li>Immediate tenancy-level guardrails to reduce supply-chain and procurement risk.<\/li>\n<li>Clear governance story for auditors: preventive controls + auditable changes.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Reduced unauthorized subscriptions<\/li>\n<li>Clear ownership and cost attribution<\/li>\n<li>Faster onboarding of approved vendor solutions with controlled risk<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A startup wants to move quickly and uses Marketplace to deploy a database tool and a logging agent, but they\u2019ve already had one surprise bill from a mis-sized deployment.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Marketplace Policies set to a conservative baseline (restrict risky categories if available; keep the catalog tight).<\/li>\n<li>\u201cSandbox\u201d compartment for experiments with a strict budget and auto-alerts.<\/li>\n<li>Tagging enforced for any Marketplace deployment.<\/li>\n<li><strong>Why Marketplace Policies were chosen:<\/strong><\/li>\n<li>Low operational overhead: a small team needs simple guardrails, not heavy process.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Fewer cost surprises<\/li>\n<li>Safer experimentation<\/li>\n<li>Faster iteration with less governance debt<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>Is Marketplace Policies a standalone Oracle Cloud service?<\/strong><br\/>\n   Marketplace Policies are best understood as <strong>governance controls for Oracle Cloud Marketplace<\/strong> rather than a separately deployed service.<\/p>\n<\/li>\n<li>\n<p><strong>Does enabling Marketplace Policies cost extra?<\/strong><br\/>\n   Marketplace Policies themselves are governance settings and are not typically billed separately. Costs come from <strong>resources deployed<\/strong> from Marketplace and any listing-specific commercial terms.<\/p>\n<\/li>\n<li>\n<p><strong>Do Marketplace Policies replace OCI IAM policies?<\/strong><br\/>\n   No. Marketplace Policies restrict Marketplace usage categories at a high level; <strong>IAM<\/strong> controls which identities can perform actions and in which compartments.<\/p>\n<\/li>\n<li>\n<p><strong>Can I restrict Marketplace to only one compartment?<\/strong><br\/>\n   Marketplace Policies are generally tenancy-level. Compartment restrictions are typically done with <strong>IAM policies<\/strong>. Combine both for strong governance.<\/p>\n<\/li>\n<li>\n<p><strong>Can I allow only Oracle-published listings and block third-party listings?<\/strong><br\/>\n   Many organizations implement that posture. The exact control available depends on current Marketplace Policies options\u2014<strong>verify in official docs and your console<\/strong>.<\/p>\n<\/li>\n<li>\n<p><strong>Can Marketplace Policies prevent users from deploying resources that cost money?<\/strong><br\/>\n   They can reduce risk by restricting listing types, but <strong>resource costs<\/strong> can still occur from allowed listings. Use <strong>budgets, quotas, and IAM<\/strong> as additional controls.<\/p>\n<\/li>\n<li>\n<p><strong>How do I audit changes to Marketplace Policies?<\/strong><br\/>\n   Use <strong>OCI Audit<\/strong> to track administrative actions. Confirm your audit retention and export strategy for compliance.<\/p>\n<\/li>\n<li>\n<p><strong>If a user already subscribed to a listing, what happens if I tighten Marketplace Policies later?<\/strong><br\/>\n   Governance changes may block new subscriptions or actions, but existing deployments may continue to run. Plan operationally: inventory existing subscriptions and deployed resources. <strong>Verify exact behavior in official docs.<\/strong><\/p>\n<\/li>\n<li>\n<p><strong>Can Marketplace Policies enforce security hardening on deployed images?<\/strong><br\/>\n   No. They control Marketplace access categories. Use hardened images, network controls, scanning, and configuration management for security posture.<\/p>\n<\/li>\n<li>\n<p><strong>Is Marketplace available in all OCI regions?<\/strong><br\/>\n   Marketplace availability and specific listings can vary by region and realm. Verify region support on the listing and in official docs.<\/p>\n<\/li>\n<li>\n<p><strong>How do I prevent engineers from exposing Marketplace-deployed admin UIs to the internet?<\/strong><br\/>\n   Use network baseline controls: private subnets, NSGs, ingress restrictions, bastion access patterns, and security review.<\/p>\n<\/li>\n<li>\n<p><strong>Can I integrate Marketplace approvals into ITSM tools (ServiceNow\/Jira)?<\/strong><br\/>\n   Marketplace Policies alone are not an ITSM workflow engine. Implement process controls: require tickets for approvals and restrict subscription permissions via IAM.<\/p>\n<\/li>\n<li>\n<p><strong>What\u2019s the safest way to start using Marketplace in a new tenancy?<\/strong><br\/>\n   Start with restrictive Marketplace Policies, a sandbox compartment with tight budgets, enforced tagging, and a platform-broker model.<\/p>\n<\/li>\n<li>\n<p><strong>Do Marketplace listings always include compute instances?<\/strong><br\/>\n   Not always; it depends on the listing. Many listings deploy compute images or stacks that provision compute and related resources.<\/p>\n<\/li>\n<li>\n<p><strong>Where do I find the authoritative list of Marketplace Policies options?<\/strong><br\/>\n   In the OCI Console under Marketplace governance and in official docs: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Marketplace\/home.htm<\/p>\n<\/li>\n<li>\n<p><strong>Can I manage Marketplace Policies through Terraform?<\/strong><br\/>\n   Not all tenancy settings are exposed through Terraform. <strong>Verify in official docs and the OCI Terraform provider documentation<\/strong> whether Marketplace Policies are supported as a resource\/data source.<\/p>\n<\/li>\n<li>\n<p><strong>How do I handle license compliance for Marketplace software?<\/strong><br\/>\n   Treat it as software asset management: review listing terms, record approvals, restrict who can subscribe, and maintain an inventory of deployments and versions.<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Marketplace Policies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>Oracle Cloud Marketplace docs<\/td>\n<td>Primary reference for Marketplace concepts, subscriptions, and governance context: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Marketplace\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Identity and Access Management docs<\/td>\n<td>Needed to design least-privilege access around Marketplace usage: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Audit docs<\/td>\n<td>Learn how to find and retain governance change events: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Audit\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>Oracle Cloud Pricing<\/td>\n<td>Understand pricing dimensions for resources deployed from Marketplace: https:\/\/www.oracle.com\/cloud\/pricing\/<\/td>\n<\/tr>\n<tr>\n<td>Official cost tool<\/td>\n<td>Oracle Cloud Cost Estimator<\/td>\n<td>Build region-accurate cost estimates for Marketplace deployments: https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<\/tr>\n<tr>\n<td>Official docs (cost governance)<\/td>\n<td>OCI Cost Management docs entry point<\/td>\n<td>Budgets, tracking, and cost analysis patterns (verify navigation if it changes): https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/CostAnalysis\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official architecture<\/td>\n<td>Oracle Architecture Center<\/td>\n<td>Reference architectures and governance patterns that complement Marketplace controls: https:\/\/docs.oracle.com\/en\/solutions\/<\/td>\n<\/tr>\n<tr>\n<td>Official learning<\/td>\n<td>Oracle University (OCI training)<\/td>\n<td>Structured OCI training paths (Marketplace content varies by course): https:\/\/education.oracle.com\/<\/td>\n<\/tr>\n<tr>\n<td>Official videos<\/td>\n<td>Oracle Cloud YouTube channel<\/td>\n<td>Product updates and demos; search for Marketplace governance topics: https:\/\/www.youtube.com\/@OracleCloudInfrastructure<\/td>\n<\/tr>\n<tr>\n<td>Community (reputable)<\/td>\n<td>OCI blogs and field notes (Oracle Cloud Blog)<\/td>\n<td>Practical guidance and announcements; validate details against docs: https:\/\/blogs.oracle.com\/cloud-infrastructure\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, platform teams<\/td>\n<td>OCI operations, DevOps practices, cloud governance topics<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate engineers<\/td>\n<td>DevOps\/SCM foundations that support cloud governance<\/td>\n<td>check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud operations teams<\/td>\n<td>Cloud operations, monitoring, governance fundamentals<\/td>\n<td>check website<\/td>\n<td>https:\/\/cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, reliability engineers<\/td>\n<td>Reliability engineering practices applicable to OCI workloads<\/td>\n<td>check website<\/td>\n<td>https:\/\/sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops and platform teams<\/td>\n<td>AIOps concepts for monitoring and incident response<\/td>\n<td>check website<\/td>\n<td>https:\/\/aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud training content<\/td>\n<td>Individuals and teams seeking practical DevOps coaching<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training services<\/td>\n<td>Engineers wanting guided DevOps learning paths<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps enablement<\/td>\n<td>Teams needing short-term mentoring\/implementation help<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and training<\/td>\n<td>Ops teams needing troubleshooting-oriented guidance<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting<\/td>\n<td>Governance, automation, operational readiness<\/td>\n<td>Landing zone governance, cost controls, operational runbooks for Marketplace deployments<\/td>\n<td>https:\/\/cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps\/Cloud consulting &amp; enablement<\/td>\n<td>Platform engineering, DevOps pipelines, training<\/td>\n<td>Implement controlled Marketplace adoption with IAM, budgets, audit reporting<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting<\/td>\n<td>CI\/CD, cloud operations, governance practices<\/td>\n<td>Build guardrails around Marketplace usage and standardize approved deployment patterns<\/td>\n<td>https:\/\/devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Marketplace Policies<\/h3>\n\n\n\n<p>To use Marketplace Policies effectively, you should understand:\n&#8211; OCI tenancy basics: compartments, regions, and identity model\n&#8211; OCI IAM fundamentals: groups, policies, least privilege\n&#8211; OCI networking basics: VCNs, subnets, NSGs, routing, internet\/NAT\/service gateways\n&#8211; Cost basics: how OCI resources are billed (compute, storage, egress)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after Marketplace Policies<\/h3>\n\n\n\n<p>Next skills that compound the value:\n&#8211; Landing zone architecture patterns on Oracle Cloud\n&#8211; Tagging strategy and governance automation\n&#8211; Cost governance:\n  &#8211; budgets, cost analysis, and chargeback\/showback\n&#8211; Security posture management:\n  &#8211; vulnerability scanning\n  &#8211; patching strategy\n  &#8211; secret management with Vault\n&#8211; Infrastructure as Code:\n  &#8211; Terraform modules for approved Marketplace patterns (where applicable)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud platform engineer<\/li>\n<li>Cloud security engineer \/ GRC engineer<\/li>\n<li>Solutions architect<\/li>\n<li>DevOps engineer<\/li>\n<li>SRE \/ operations engineer<\/li>\n<li>FinOps analyst (in governance collaboration)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle\u2019s certification offerings evolve. A common approach:\n&#8211; Start with OCI foundations training\/certification paths on Oracle University.\n&#8211; Add security and architecture credentials as needed.<\/p>\n\n\n\n<p>Check Oracle University for current OCI certification tracks:<br\/>\nhttps:\/\/education.oracle.com\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Build an OCI \u201cMarketplace Sandbox\u201d compartment with budgets, tags, and restrictive Marketplace Policies.<\/li>\n<li>Implement a platform-broker model:\n   &#8211; Only platform group can subscribe\n   &#8211; App teams deploy via approved modules<\/li>\n<li>Create an audit report:\n   &#8211; Marketplace policy changes\n   &#8211; Marketplace subscription activity<\/li>\n<li>Design a secure network baseline for typical Marketplace appliances:\n   &#8211; private subnets\n   &#8211; controlled egress\n   &#8211; bastion access<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Oracle Cloud (OCI):<\/strong> Oracle Cloud Infrastructure services and control plane used to provision and manage cloud resources.<\/li>\n<li><strong>Marketplace:<\/strong> Oracle Cloud Marketplace, a catalog of listings (images, stacks, solutions) from Oracle and partners.<\/li>\n<li><strong>Marketplace Policies:<\/strong> Tenancy-level governance settings that restrict and control Marketplace usage.<\/li>\n<li><strong>Tenancy:<\/strong> The top-level OCI account boundary containing identity, compartments, and governance configuration.<\/li>\n<li><strong>Compartment:<\/strong> Logical container for OCI resources used for isolation, access control, and billing organization.<\/li>\n<li><strong>IAM Policy:<\/strong> OCI authorization rule defining who can perform which actions on what resources in which scope.<\/li>\n<li><strong>Audit:<\/strong> OCI service that records control-plane events for governance and security investigations.<\/li>\n<li><strong>Listing:<\/strong> A Marketplace item (image\/solution\/stack) that can be subscribed to and deployed.<\/li>\n<li><strong>Subscription:<\/strong> The act of accepting terms and enabling the ability to deploy a Marketplace listing.<\/li>\n<li><strong>BYOL:<\/strong> Bring Your Own License; licensing is handled outside OCI billing, but infrastructure costs still apply.<\/li>\n<li><strong>Egress:<\/strong> Outbound network traffic, often billed when going to the public internet.<\/li>\n<li><strong>Landing Zone:<\/strong> Standardized baseline architecture for accounts\/tenancies including IAM, networking, governance, and logging.<\/li>\n<li><strong>Least privilege:<\/strong> Security principle of granting only the minimum permissions necessary.<\/li>\n<li><strong>FinOps:<\/strong> Cross-functional practice for cloud financial management and cost governance.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Oracle Cloud <strong>Marketplace Policies<\/strong> are tenancy-level governance controls for <strong>Oracle Cloud Marketplace<\/strong>. They matter because Marketplace is a fast path to deploy vendor software, but without guardrails it can introduce <strong>security, compliance, operational, and cost<\/strong> risks.<\/p>\n\n\n\n<p>Marketplace Policies fit into Oracle Cloud as a <strong>control-plane governance layer<\/strong> that works best when paired with <strong>OCI IAM<\/strong>, <strong>compartments<\/strong>, <strong>Audit<\/strong>, and <strong>budgets<\/strong>. They don\u2019t directly cost money, but they materially affect spend by controlling which Marketplace paths are available and by reducing accidental or unapproved deployments.<\/p>\n\n\n\n<p>Use Marketplace Policies when you need organization-wide Marketplace governance\u2014especially in shared tenancies and regulated environments. Next, deepen your implementation by aligning IAM compartment controls, adding cost guardrails, and standardizing approved deployment patterns through reference architectures and IaC.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Marketplace<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[71,62],"tags":[],"class_list":["post-931","post","type-post","status-publish","format-standard","hentry","category-marketplace","category-oracle-cloud"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=931"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/931\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}