Create Oracle Cloud resources
Learn to create a compartment, VCN, subnet, users, and user groups before you get started with Oracle Cloud Infrastructure GoldenGate.
Create a compartment
Compartments let you organize and control access to your cloud resources. It's a logical container that you can use to group related cloud resources together and let specific user groups access.
When you sign up for Oracle Cloud Infrastructure, Oracle creates your tenancy, which is the root compartment that holds all your cloud resources. You then create additional compartments within your tenancy and the corresponding policies to control access to the resources in each compartment.
To create a compartment:Create a Virtual Cloud Network and subnet
A virtual cloud network (VCN) is a network that you set up in the Oracle Cloud Infrastructure data centers in a particular region. A subnet is a subdivision of a VCN.
- Open the Oracle Cloud console navigation menu, click Networking, and then select Virtual Cloud Networks.
- On the Virtual Cloud Networking in <compartment-name> page, click Start VCN Wizard.
- In the Start VCN Wizard dialog, select VCN with Internet Connectivity, and then click Start VCN Wizard.
- On the Configuration page, under Basic Information, enter a name for VCN Name.
- For Compartment, select the compartment where you want to create this VCN.
- Click Next.
- On the Review and Create page, verify the configuration details, and then click Create.
Click View VCN Details to verify that both a Public and Private subnet were created.
Create users
Create users to add to groups that can access to your OCI GoldenGate resources.
Before you create users, understand that:
- User names must be unique across all users within your tenancy
- User names are unchangeable
- Users have no permissions until they're placed in a group
- Open the Oracle Cloud console navigation menu, click Identity & Security, and then under Identity, click Users.
- On the Users page, click Create User.
- On the Create User page, complete the fields as follows:
- Click Create.
Create groups
A group is a collection of users who require the same type of access to a set of resources or compartments.
- The group name must be unique within the tenancy.
- The group name cannot be changed once created.
- A group has no permissions unles you write at least one permission that gives the group permission to a tenancy or compartment.
- Open the Oracle Cloud console navigation menu, click Identity & Security, and then under Identity, click Groups.
- Click Create Group.
- In the Create Group panel:
- Click Create Group.
- In the Groups list, select the group. You're brought to the group Details page.
- Click Add User to Group.
- Select a user from the dropdown, and then click Add User.
Create policies
Policies define what actions members of a group can perform, and in which compartments.
You create policies using the Oracle Cloud console. In the Oracle Cloud console navigation menu, go to Identity & Security, and then under Identity, and click Policies. Policies are written in the following syntax:
allow group <identity-domain>/<group-name> to <verb> <resource-type> in <location> where <condition>
<identity-domain>
: (Optional) If using OCI IAM for identity management, then include the identity domain of the user group. If omitted, then OCI uses the default domain.<group-name>
: The name of the user group you're giving permissions to<verb>
: Gives the group a certain level of access to a resource-type. As the verbs go frominspect
toread
touse
tomanage
, the level of access increases and the permissions granted are cumulative.To learn about the relationship between permissions and verbs, see Permissions.
<resource-type>
: The type of resource you're giving a group permission to work with. There are individual resources, such asgoldengate-deployments
andgoldengate-connections
, and there are resource families, such asgoldengate-family
, which includes bothgoldengate-deployments
andgoldengate-connections
.For more information, see resource-types.
<location>
: Attaches the policy to a compartment or tenancy. You can specify a single compartment or compartment path by name or OCID, or specifytenancy
to cover the entire tenancy.<condition>
: Optional. One or more conditions for which this policy will apply.
Learn more about policy syntax.
How to create a policy
For more information about policies, see how policies work, policy syntax, and policy reference.
Minimum recommended policies
At minimum, you need policies to:
- Allow users to use or manage GoldenGate resources, so that
they can work with deployments and connections. For
example:
allow group <identity-domain>/<group-name> to manage goldengate-family in <location>
- Allow users to manage network resources, so that they can view
and select compartments and subnets, and create and delete private endpoints when
creating GoldenGate resources. For
example:
allow group <identity-domain>/<group-name> to manage virtual-network-family in <location>
Optionally, you can further secure network resources using a combination of granular policies. See Policy Examples for Securing Network Resources.
- Define a dynamic group for your GoldenGate deployments to access
resources in your
tenancy:
name: goldengate_deployments Matching rule: ALL {resource.type = 'goldengatedeployment', resource.compartment.id = '<location>'}
- Allow users to read the Identity and Access Management (IAM) user and
group for validations in IAM enabled
tenancies:
allow service goldengate to {idcs_user_viewer, domain_resources_viewer} in <location>
- Oracle Vault, to access customer managed encryption keys. For
example:
allow group <identity-domain>/<group-name> to manage secret-family in <location> allow group <identity-domain>/<group-name> to use keys in <location> allow group <identity-domain>/<group-name> to use vaults in <location> allow dynamic-group goldengate_deployments to use keys in <location> allow dynamic-group goldengate_deployments to use vaults in <location>
Depending on whether you intend to use the following services, you may also need to add policies for:
- Oracle Databases, for your source and/or target databases. For example:
allow group <identity-domain>/<group-name> to read database-family in <location>
allow group <identity-domain>/<group-name> to read autonomous-database-family in <location>
- Oracle Object Storage, to store manual OCI GoldenGate
backups. For
example:
allow group <identity-domain>/<group-name> to manage objects in <location> allow dynamic-group goldengate_deployments to manage objects in <location> allow group <identity-domain>/<group-name> to inspect buckets in <location>
- OCI Logging, to access log groups. For
example:
allow group <identity-domain>/<group-name> to read log-groups in <location> allow group <identity-domain>/<group-name> to read log-content in <location>
- Load Balancer, if you enable public access to the deployment
console:
allow group <identity-domain>/<group-name> to manage load-balancers in <location> allow group <identity-domain>/<group-name> to manage public-ips in <location> allow group <identity-domain>/<group-name> to manage network-security-groups in <location> allow group <identity-domain>/<group-name> to manage vcns in <location> where ANY {request.operation = 'CreateNetworkSecurityGroup', request.operation = 'DeleteNetworkSecurityGroup'}
- Work
requests:
allow group <identity-domain>/<group-name> to inspect work-requests in <location>
The following statement gives a group permission to manage tag-namespaces and tags for workspaces:
allow group <identity-domain>/<group-name> to manage tag-namespaces in <location>
To add a defined tag, you must have permission to use the tag namespace. To learn more about tagging, see Resource Tags.
For more information and additional example policies, see OCI GoldenGate Policies.