Create Oracle Cloud resources

Learn to create a compartment, VCN, subnet, users, and user groups before you get started with Oracle Cloud Infrastructure GoldenGate.

Related Topics

Create a compartment

Compartments let you organize and control access to your cloud resources. It's a logical container that you can use to group related cloud resources together and let specific user groups access.

When you sign up for Oracle Cloud Infrastructure, Oracle creates your tenancy, which is the root compartment that holds all your cloud resources. You then create additional compartments within your tenancy and the corresponding policies to control access to the resources in each compartment.

To create a compartment:
  1. Open the Oracle Cloud console navigation menu, and then click Identity & Security.
  2. Under Identity, click Compartments. A list of the compartments you have access to is displayed.
  3. Navigate to the compartment where you want to create the new compartment.
    • To create the compartment in the tenancy (root compartment) click Create Compartment.
    • To create the compartment in a compartment other than the tenancy (root compartment), click through the hierarchy of compartments until you reach the detail page of the compartment where you want to create the compartment. On the Compartment Details page, click Create Compartment.
  4. In the Create Compartment dialog, complete the fields as follows:
    1. For Name, enter a unique name for the compartment, no more than 100 characters (includes letters, numbers, periods, hyphens, and underscores). The name must be unique across all compartments in the tenancy. Avoid entering confidential information.
    2. For Description, enter a description that helps distinguish the compartment from others.
    3. For Parent Compartment, verify that this is the compartment where you want to create your compartment. To choose a different compartment, select one from the dropdown.
    4. (Optional) For Tag Namespace, you can add a free-form tag to help you search for you resources in the Oracle Cloud console. Click + Another Tag to add more tags.
    5. Click Create Compartment.
Your compartment appears in the Compartments list after it's created. You can now create policies and add resources to your compartment.

Create a Virtual Cloud Network and subnet

A virtual cloud network (VCN) is a network that you set up in the Oracle Cloud Infrastructure data centers in a particular region. A subnet is a subdivision of a VCN.

OCI GoldenGate requires a VCN and at least one private subnet with a NAT Gateway. A route table with a route rule redirecting traffic to the NAT Gateway for the private subnet must be available. If you want to enable connectivity using a public endpoint then a public subnet is also required and the VCN must include an Internet Gateway. A route table with a route rule redirecting traffic to the Internet Gateway for the public subnet must be available.
To create a VCN and subnet:
  1. Open the Oracle Cloud console navigation menu, click Networking, and then select Virtual Cloud Networks.
  2. On the Virtual Cloud Networking in <compartment-name> page, click Start VCN Wizard.
  3. In the Start VCN Wizard dialog, select VCN with Internet Connectivity, and then click Start VCN Wizard.
  4. On the Configuration page, under Basic Information, enter a name for VCN Name.
  5. For Compartment, select the compartment where you want to create this VCN.
  6. Click Next.
  7. On the Review and Create page, verify the configuration details, and then click Create.

Click View VCN Details to verify that both a Public and Private subnet were created.

Create users

Create users to add to groups that can access to your OCI GoldenGate resources.

Before you create users, understand that:

  • User names must be unique across all users within your tenancy
  • User names are unchangeable
  • Users have no permissions until they're placed in a group
To create users:
  1. Open the Oracle Cloud console navigation menu, click Identity & Security, and then under Identity, click Users.
  2. On the Users page, click Create User.
  3. On the Create User page, complete the fields as follows:
    1. For Name, enter a unique name or email address for the user.

      Note:

      The name must be unique across all users in the tenancy. You cannot change this value later. The user name cannot contain spaces, and can only consist of basic Latin letters (ASCII), numerals, hyphens, periods, underscores, +, and @.
    2. For Description, enter the user's full name, a nickname, or other descriptive information.
    3. For Email, enter a valid email address for the user for password recovery. This value must also be unique in the tenancy.
  4. Click Create.
You can then add the user to a group and create policies that give the group access to your resources. For more information about users, see Managing users.

Create groups

A group is a collection of users who require the same type of access to a set of resources or compartments.

Before you create a group, understand that:
  • The group name must be unique within the tenancy.
  • The group name cannot be changed once created.
  • A group has no permissions unles you write at least one permission that gives the group permission to a tenancy or compartment.
To create a group:
  1. Open the Oracle Cloud console navigation menu, click Identity & Security, and then under Identity, click Groups.
  2. Click Create Group.
  3. In the Create Group panel:
    1. For Name, enter a unique name for the group.

      Note:

      Once the group is created, you cannot change the name. The group name must be unique within the tenancy. The group name can be 1 to 100 alphanumeric characters long, upper or lowercase letters, and can contain periods, dashes, hyphens, but no spaces
    2. For Description, enter a friendly description.
  4. Click Create Group.
  5. In the Groups list, select the group. You're brought to the group Details page.
  6. Click Add User to Group.
  7. Select a user from the dropdown, and then click Add User.
A group doesn't have any permissions until you write a policy that gives the group permission to a compartment or tenancy. For more information about groups, see Managing groups.

Create policies

Policies define what actions members of a group can perform, and in which compartments.

You create policies using the Oracle Cloud console. In the Oracle Cloud console navigation menu, go to Identity & Security, and then under Identity, and click Policies. Policies are written in the following syntax: 

allow group <identity-domain>/<group-name> to <verb> <resource-type> in <location> where <condition>
  • <identity-domain>: (Optional) If using OCI IAM for identity management, then include the identity domain of the user group. If omitted, then OCI uses the default domain.
  • <group-name>: The name of the user group you're giving permissions to
  • <verb>: Gives the group a certain level of access to a resource-type. As the verbs go from inspect to read to use to manage, the level of access increases and the permissions granted are cumulative.

    To learn about the relationship between permissions and verbs, see Permissions.

  • <resource-type>: The type of resource you're giving a group permission to work with. There are individual resources, such as goldengate-deployments and goldengate-connections, and there are resource families, such as goldengate-family, which includes both goldengate-deployments and goldengate-connections.

    For more information, see resource-types.

  • <location>: Attaches the policy to a compartment or tenancy. You can specify a single compartment or compartment path by name or OCID, or specify tenancy to cover the entire tenancy.
  • <condition>: Optional. One or more conditions for which this policy will apply.

Learn more about policy syntax.

How to create a policy

To create a policy:
  1. In the Console navigation menu, under Governance and Administration, go to Identity, and then click Policies.
  2. Click Create Policy.
  3. Enter a name and description for the policy.
  4. In the Statement field, enter a policy rule in the following format:
    allow <subject> to <verb> <resource-type> in <location> where <condition>

    Conditions are optional. See Details for Verbs + Resource-Type Combinations.

  5. (Optional) To add another statement, click + Another Statement.
  6. Click Create.

For more information about policies, see how policies work, policy syntax, and policy reference.

Minimum recommended policies

At minimum, you need policies to:

  • Allow users to use or manage GoldenGate resources, so that they can work with deployments and connections. For example:
    allow group <identity-domain>/<group-name> to manage goldengate-family in <location>
  • Allow users to manage network resources, so that they can view and select compartments and subnets, and create and delete private endpoints when creating GoldenGate resources. For example:
    allow group <identity-domain>/<group-name> to manage virtual-network-family in <location>

    Optionally, you can further secure network resources using a combination of granular policies. See Policy Examples for Securing Network Resources.

  • Allow users to read the Identity and Access Management (IAM) user and group for validations in IAM enabled tenancies:
    allow service goldengate to {idcs_user_viewer, domain_resources_viewer} in tenancy
  • Oracle Vault, to access customer managed encryption keys. For example:
    allow group <identity-domain>/<group-name> to manage secret-family in <location>
allow group <identity-domain>/<group-name> to use keys in <location>
allow group <identity-domain>/<group-name> to use vaults in <location>
allow service goldengate to use keys in <location>
allow service goldengate to use vaults in <location>

Depending on whether you intend to use the following services, you may also need to add policies for:

  • Oracle Databases, for your source and/or target databases. For example: 
    allow group <identity-domain>/<group-name> to read database-family in <location>
    allow group <identity-domain>/<group-name> to read autonomous-database-family in <location>
  • Oracle Object Storage, to store manual OCI GoldenGate backups. For example:
    allow group <identity-domain>/<group-name> to manage objects in <location>
allow group <identity-domain>/<group-name> to inspect buckets in <location>
  • OCI Logging, to access log groups. For example:
    allow group <identity-domain>/<group-name> to manage log-groups in <location>
allow group <identity-domain>/<group-name> to manage log-content in <location>
  • Load Balancer, if you enable public access to the deployment console:
    allow group <identity-domain>/<group-name> to manage load-balancers in <location>
allow group <identity-domain>/<group-name> to manage public-ips in <location> 
 
allow group <identity-domain>/<group-name> to manage network-security-groups in <location>
allow group <identity-domain>/<group-name> to manage vcns in <location> where ANY {request.operation = 'CreateNetworkSecurityGroup', request.operation = 'DeleteNetworkSecurityGroup'}

The following statement gives a group permission to manage tag-namespaces and tags for workspaces:

allow group <identity-domain>/<group-name> to manage tag-namespaces in <location>

To add a defined tag, you must have permission to use the tag namespace. To learn more about tagging, see Resource Tags.

For more information and additional example policies, see OCI GoldenGate Policies.