Oracle Autonomous Database on Dedicated Exadata Infrastructure is a highly automated, fully managed database environment running in Oracle Cloud Infrastructure (OCI) with committed hardware and software resources. These isolated resources enable organizations to meet stringent security, availability, and performance requirements while reducing cost and complexity.

Acme Company has chosen to use Autonomous Database on Dedicated Exadata Infrastructure for its internal project applications. The Acme I.T. department will assume the role of fleet administrator, responsible for creating and managing Exadata Infrastructure (EI) and Autonomous Exadata VM Cluster (AVMC) resources for the company. Within each project team or line of business, designated users will take on the application DBA role, tasked with creating Autonomous Container Database (ACD) and Autonomous Databases for their database users, including application developers, testers, and deployers.

Acme I.T. will allocate resources to the various teams, ensuring the provision of AVMCs that meet the required SLAs. Additionally, to control the allocation of resources fairly, Acme I.T. does not want any project team or line of business to have management access to the underlying dedicated infrastructure. Furthermore, in compliance with regulatory audits, Acme management does not want Acme I.T. to be able to access the data that belongs to different project teams or lines of business; that is, the data they store in their application databases.

AcmeHR, an internal HR application developed and utilized by Acme, operates in two distinct environments: one for development and testing (Dev) and another for production (Prod). Acme I.T. is committed to maintaining strict isolation between these environments to prevent any unauthorized access or interaction between the Dev and Prod teams.

Before Acme I.T. begins configuring Autonomous Database resources on Dedicated Exadata Infrastructure, it requests a service limit increase using the OCI console to add Exadata Infrastructure resources - Database Servers and Storage Servers to the tenancy. Refer to Request a Service Limit Increase for more details.

Listed below are the high-level steps to implement this use case:

1. The security administrator for Acme Company's cloud tenancy creates the following compartments, groups, and compartment policies for resource isolation:
   • The FleetComp, DevComp, and ProdComp compartments.
   • The FAGroup, DevGroup, and ProdGroup groups.
   • The FleetCompPolicy, DevCompPolicy, and ProdCompPolicy policies.
2. For access isolation:
   • For Oracle Public Cloud deployments, Acme I.T. or the network administrator for Acme creates the following network resources in the FleetComp compartment:
     • VCN: AcmeHRVCN
     • Private subnets: DevVMSubnet and ProdVMSubnet
     • Public subnet: AppSubnet
   • For Exadata Cloud@Customer deployments, Acme I.T. or the network administrator of Acme ensures to:
     • Set up network rules as listed in Network Requirements for Oracle Exadata Database Service on Cloud@Customer in Preparing for Exadata Database Service on Cloud@Customer.
     • Open Port 1522 to allow TCP traffic between primary database and standby database in an Autonomous Data Guard setup.
3. After creating network resources, the security administrator adds the cloud user of a designated Acme I.T. member to the FAGroup, thus authorizing that user as the fleet administrator.
4. The newly authorized fleet administrator creates the following dedicated infrastructure resources:
   • An Exadata Infrastructure resource AcmeInfrastructure in the FleetComp compartment.
   • Two Autonomous Exadata VM Clusters (AVMCs) in the FleetComp compartment, specifying the newly created Exadata Infrastructure:
     • DevAVMC.

       For Oracle Public Cloud deployments, specify AcmeHRVCN and DevVMSubnet as its VCN and subnet.

     • ProdAVMC.

       For Oracle Public Cloud deployments, specify AcmeHRVCN and ProdVMSubnet as its VCN and subnet.

5. The security administrator then adds designated cloud users to the DevGroup and ProdGroup, thus authorizing them as application DBAs for the Dev and Prod environments.
6. The newly authorized application DBAs create the following resources in their respective work environments, that is Dev and Prod:
   • Two Autonomous Container Databases (ACDs):
     • DevACD in the DevComp compartment, specifying DevAVMC as its underlying resource
     • ProdACD in the ProdComp compartment, specifying Prod AVMC as its underlying resource.
   • Autonomous Database named DevADB in the DevComp compartment.
   • Autonomous Database named ProdADB in the ProdComp compartment.

In this step, the security administrator for Acme Company's cloud tenancy creates the FleetComp, DevComp, and ProdComp compartments.

To perform this step, the security administrator follows the instructions in Managing Compartments in Oracle Cloud Infrastructure Documentation to create a compartment using the Oracle Cloud console. When following these instructions, the security administrator specifies the root compartment of the tenancy as the parent compartment of each of the three compartments.

In this step, the security administrator creates the FAGroup, DevGroup, and ProdGroup groups.

To perform this step, the security administrator follows the instructions in Managing Groups in Oracle Cloud Infrastructure Documentation to create a group using the Oracle Cloud console.

In this step, the security administrator creates the FleetCompPolicy, DevCompPolicy, and ProdCompPolicy policies.

To perform this step, the security administrator follows the instructions in Managing Policies in Oracle Cloud Infrastructure Documentation to create a policy using the Oracle Cloud console.

When following these instructions for the FleetCompPolicy policy, the security administrator:

1. Sets the Compartment in the side menu to FleetComp before clicking Create Policy.

2. Adds either of the following Policy Statements depending on their deployment platform:

   • Oracle Public Cloud deployments:
     • Allow group FAGroup to MANAGE cloud-exadata-infrastructures in compartment FleetComp
     • Allow group FAGroup to MANAGE cloud-autonomous-vmclusters in compartment FleetComp
     • Allow group FAGroup to USE virtual-network-family in compartment FleetComp
     • Allow group FAGroup to USE tag-namespaces in compartment FleetComp
     • Allow group DevGroup to READ cloud-exadata-infrastructures in compartment FleetComp
     • Allow group DevGroup to READ cloud-autonomous-vmclusters in compartment FleetComp
     • Allow group DevGroup to USE virtual-network-family in compartment FleetComp
     • Allow group ProdGroup to READ cloud-exadata-infrastructures in compartment FleetComp
     • Allow group ProdGroup to READ cloud-autonomous-vmclusters in compartment FleetComp
     • Allow group ProdGroup to USE virtual-network-family in compartment FleetComp
   • Exadata Cloud@Customer deployments:
     • Allow group FAGroup to MANAGE exadata-infrastructures in compartment FleetComp
     • Allow group FAGroup to MANAGE autonomous-vmclusters in compartment FleetComp
     • Allow group FAGroup to USE tag-namespaces in compartment FleetComp
     • Allow group DevGroup to READ exadata-infrastructures in compartment FleetComp
     • Allow group DevGroup to READ autonomous-vmclusters in compartment FleetComp
     • Allow group ProdGroup to READ exadata-infrastructures in compartment FleetComp
     • Allow group ProdGroup to READ autonomous-vmclusters in compartment FleetComp

When following these instructions for the DevCompPolicy policy, the security administrator:

1. Sets the Compartment in the side menu to DevComp before clicking Create Policy.

2. Adds these Policy Statements:

   • Allow group DevGroup to MANAGE autonomous-container-databases in compartment DevComp
   • Allow group DevGroup to MANAGE autonomous-databases in compartment DevComp
   • Allow group DevGroup to MANAGE autonomous-backups in compartment DevComp
   • Allow group DevGroup to MANAGE instance-family in compartment DevComp
   • Allow group DevGroup to USE tag-namespaces in compartment DevComp
   • Allow group DevGroup to MANAGE metrics in compartment DevComp
   • Allow group DevGroup to INSPECT work-requests in compartment DevComp

When following these instructions for the ProdCompPolicy policy, the security administrator:

1. Sets the Compartment in the side menu to ProdComp before clicking Create Policy.

2. Adds these Policy Statements:

   • Allow group ProdGroup to MANAGE autonomous-container-databases in compartment ProdComp
   • Allow group ProdGroup to MANAGE autonomous-databases in compartment ProdComp
   • Allow group ProdGroup to MANAGE autonomous-backups in compartment ProdComp
   • Allow group ProdGroup to MANAGE instance-family in compartment ProdComp
   • Allow group ProdGroup to USE tag-namespaces in compartment ProdComp
   • Allow group ProdGroup to MANAGE metrics in compartment ProdComp
   • Allow group ProdGroup to INSPECT work-requests in compartment ProdComp

In this step, Acme I.T. or the network administrator of Acme creates the AcmeHRVCN VCN and the DevVMSubnet, ProdVMSubnet, and AppSubnet subnets in the FleetComp compartment.

To perform this step, Acme I.T. first confers with the Acme I.T. department's networking to reserve a CIDR IP address range that will not conflict with the company's on-premises network. (Otherwise, the VCN would conflict with the on-premises network and an IPSec VPN could not be set up.) The reserved range is CIDR 10.0.0.0/16.

Then, Acme I.T. adapts the instructions in Scenario B: Private Subnet with a VPN in Oracle Cloud Infrastructure Documentation to create the VCN, the Subnets and other network resources using the Oracle Cloud console.

For more details on AVMC ingress and egress requirements, see Requirements to Provision an Autonomous Exadata VM Cluster.

In this step, the security administrator adds the cloud user of a designated Acme I.T. member to the FAGroup.

To perform this step, the security administrator follows the instructions in Managing Users in Oracle Cloud Infrastructure Documentation to add a user to a group using the Oracle Cloud console.

In this step, the fleet administrator follows the instructions in Create an Exadata Infrastructure Resource to create an Exadata Infrastructure resource named AcmeInfrastructure in the FleetComp compartment.

In this step, the fleet administrator follows the instructions in Create an Autonomous Exadata VM Cluster to create DevAVMC and ProdAVMC in the FleetComp compartment with the following specifications, leaving all the other attributes at their default settings.

In this step, the security administrator adds designated cloud users to DevGroup, thus authorizing them as application DBAs for the Dev resources, and then repeats the process for ProdGroup.

To perform this step, for each user the security administrator follows the instructions in Managing Users in Oracle Cloud Infrastructure Documentation to add a user to a group using the Oracle Cloud console.

In this step, the respective application DBAs follow the instructions in Create an Autonomous Container Database to create the Autonomous Container Databases (ACDs) for the Dev and Prod environments. These ACDs are created with the following specifications, leaving all other attributes at their default settings.

In this step, the respective application DBAs follow the instructions in Create an Autonomous Database to create the Autonomous Databases for the Dev and Prod environments. These databases are created with the following specifications, leaving all other attributes at their default settings.

The Autonomous Database on Dedicated Exadata Infrastructure is now configured to develop and test the AcmeHR application, with subsequent deployment in the production environment.