This topic describes the basics of managing your region subscriptions. For more information about regions in Oracle Cloud Infrastructure, see Regions and Availability Domains. For information about Platform Services regions, see Managing Platform Services Regions.
Required IAM Policy
If you're in the Administrators group, then you have the required access to manage region subscriptions.
If you're new to policies, see Getting Started with Policies and Common Policies. If you want to dig deeper into writing policies for managing regions or other IAM components, see Details for IAM with Identity Domains.
When you sign up for Oracle Cloud Infrastructure, Oracle creates a tenancy for you in one region. This is your home region. Your home region is where your IAM resources are defined. When you subscribe to another region, your IAM resources are available in the new region. However, the definitions reside in your home region and can only be changed there.
Your home region contains your account information and identity resources. It is not changeable after your tenancy is provisioned. If you are unsure which region to select as your home region, contact your sales representative before you create your account.
Resources that you can create and update only in the home region are:
- Dynamic groups
- Federation resources
When you use the API to update your IAM resources, you must use the endpoint for your home region. (See What is the tenancy home region? How do I find my tenancy home region?) IAM automatically propagates the updates to all regions in your tenancy.
When you use the Console to update your IAM resources, the Console sends the requests to the home region for you. You don't need to switch to your home region first. IAM then automatically propagates the updates to all regions in your tenancy.
When you subscribe your tenancy to a new region, all the policies from your home region are enforced in the new region. If you want to limit access for groups of users to specific regions, you can write policies to grant access to specific regions only. For an example policy, see Restrict admin access to a specific region.
IAM Updates Are Not Immediate Across All Regions
When you create or update an IAM resource, be aware that you need to allow up to several minutes for the changes in your home region to become available in all regions.
Provisioning SaaS applications and Geo-Regions
SaaS applications are provisioned in the geo-region specified on your order.
Depending on the SaaS application, the application user credentials might also be stored at the same home region as the Default identity domain.
For more information about identity domains, see Managing Identity Domains
Using the Console to Manage Infrastructure Regions
Open the Console, open the Region menu, and then click Manage Regions. A list of the regions offered by Oracle Cloud Infrastructure is displayed. Regions that you have not subscribed to provide a button to create a subscription.
- Open the Console, open the Region menu, and then click Manage Regions. The list of regions available to your tenancy is displayed. Your home region is labeled.
Locate the region you want to subscribe to and click Subscribe.Note
It could take several minutes to activate your tenancy in the new region.
Remember, your IAM resources are global, so when the subscription becomes active, all your existing policies are enforced in the new region.
To switch to the new region, use the Region menu in the Console. See Switching Regions for more information.
You cannot unsubscribe from a region.
Using the API to Work with Infrastructure Regions
For information about using the API and signing requests, see REST APIs and Security Credentials. For information about SDKs, see Software Development Kits and Command Line Interface.
Use these API operations to manage infrastructure regions:
- ListRegions: Returns a list of regions offered by Oracle Cloud Infrastructure in your selected realm .
You cannot unsubscribe from a region.
Find Out More
A region subscription is at the tenancy level. An administrator can subscribe the tenancy to a region. All IAM polices are enforced in the new region, so all users in the tenancy will have the same access and permissions in the new region.
When you select a region in the Console, you are shown a view of the resources in your selected region. Most cloud resources (instances, VCNs, buckets, etc.) exist only in a specific region, so you only see them when you select the region where they were created. The exception is IAM resources: compartments, users, groups, and policies are global across all regions. See also Working Across Regions.
Service limits can be scoped to the tenant level, the region level, or the availability domain level. When you subscribe to a new region, you get access to the region and its availability domains. Service limits apply accordingly. The service limits page lists the scope of each resource limit.