Oracle Autonomous Database on Oracle Exadata Database Service on Cloud@Customer has a four-level database architecture model that makes use of Oracle multitenant database architecture.

• Resource Types
  
• Deployment Order
  

Your organization may choose to split the administration of the Oracle Autonomous Database on Oracle Exadata Database Service on Cloud@Customer into the following roles:

• Fleet Administrator. Fleet administrators create, monitor and manage Autonomous Exadata Infrastructure and Autonomous Container Database resources. They must also setup customer managed Backup Destinations, such as Recovery Appliance and NFS to be used by Autonomous Databases. A fleet administrator must have permissions for using the networking resources required by the Oracle Exadata Database Service on Cloud@Customer infrastructure, and permissions to manage the infrastructure and container database resources.

• Database Administrator. Database administrators create, monitor and manage Autonomous Databases. They also create and manage users within the database. Database administrators must have permissions for using container databases, for managing autonomous databases and backups, and for using the related networking resources. At the time of provisioning an Autonomous Database, the administrator provides user credentials for the automatically created ADMIN account, which provides administrative rights to the new database.

• Database User. Database users are the developers who write applications that connect to and use an Autonomous Database to store and access the data. Database users do not need Oracle Cloud Infrastructure accounts. They gain network connectivity to and connection authorization information for the database from the database administrator.

An access control list (ACL) provides additional protection to your database by allowing only the clients with specific IP addresses to connect to the database. You can add IP addresses individually, or in CIDR blocks.

You can optionally create an ACL during database provisioning, or at any time thereafter. You can also edit an ACL at any time. Enabling an access control list with an empty list of IP addresses makes the database inaccessible. For more information, see "Manage Access Control List of an Autonomous Database".

Note the following about using an ACL with your Autonomous Database:

• The Autonomous Database Service console is not subject to ACL rules.
• Oracle Application Express (APEX), RESTful services, and SQL Developer Web are not subject to ACLs. Choosing to enable an ACL disables these features automatically.
• Performance Hub is not subject to ACL rules.
• While creating a database, if setting ACL fails, then provisioning the database also fails.
• Updating ACL is allowed if the database is in Available and AvailableNeedsAttention states.
• Restoring a database does not overwrite the existing ACLs.
• Cloning a database, full and metadata, will have the same access control settings as the source database. You can make changes as necessary.
• All CDB operations are allowed during ACL update. However, ADB operations are not allowed during ACL update.