Oracle Cloud Infrastructure Foundations (Activity Guide)

Unauthorized reproduction or distribution prohibited. Copyright© 2023, Oracle University and/or its affiliates.
Ca
m
S105665GC20
Activity Guide
ilo
Al
eja
n
Foundations
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
Learn more from Oracle University at education.oracle.com

to tor
us os
e an
th @
is g
Gu m
Oracle Cloud Infrastructure

ide ail.c
. om
)h
as
a
Copyright © 2023, Oracle and/or its affiliates.
Disclaimer
This document contains proprietary information and is protected by copyright and other intellectual property
laws. The document may not be modified or altered in any way. Except where your use constitutes "fair use"
under copyright law, you may not use, share, download, upload, copy, print, display, perform, reproduce,
publish, license, post, transmit, or distribute this document in whole or in part without the express authorization
of Oracle.
The information contained in this document is subject to change without notice and is not warranted to be
a
error-free. If you find any errors, please report them to us in writing.
as
Restricted Rights Notice
)h
. om
If this documentation is delivered to the United States Government or anyone using the documentation on
behalf of the United States Government, the following notice is applicable:
ide ail.c
U.S. GOVERNMENT END USERS: Oracle programs (including any operating system, integrated software, any
programs embedded, installed or activated on delivered hardware, and modifications of such programs) and
Gu m
Oracle computer documentation or other Oracle data delivered to or accessed by U.S. Government end users are
is g
"commercial computer software" or "commercial computer software documentation" pursuant to the applicable
th @
Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, reproduction,
duplication, release, display, disclosure, modification, preparation of derivative works, and/or adaptation of i)
e an
Oracle programs (including any operating system, integrated software, any programs embedded, installed or
us os
activated on delivered hardware, and modifications of such programs), ii) Oracle computer documentation
and/or iii) other Oracle data, is subject to the rights and limitations specified in the license contained in the
to tor
applicable contract. The terms governing the U.S. Government's use of Oracle cloud services are defined by the
applicable contract for such services. No other rights are granted to the U.S. Government.
se ilo
en am
Trademark Notice
lic z (c
Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of
their respective owners.
ble e
ra ch
Intel and Intel Inside are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are
used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Epyc, and the
fe án
AMD logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark
ns S
of The Open Group.

tra ro
Third-Party Content, Products, and Services Disclaimer

n- To
This documentation may provide access to or information about content, products, and services from third
no dro
parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any
kind with respect to third-party content, products, and services unless otherwise set forth in an applicable
n
agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss,
eja
costs, or damages incurred due to your access to or use of third-party content, products, or services, except as
set forth in an applicable agreement between you and Oracle.
Al
ilo
m
Ca
2005182023
Table of Contents
Identity and Access Management (IAM): Create IAM Components - With Identity Domains Enabled
........................................................................................................................................................... 5
a
Get Started ..................................................................................................................................... 6
as
Create a Compartment (With Identity Domains Enabled) .............................................................. 8
)h
Create a User (With Identity Domains Enabled) ............................................................................ 9
. om
Create a Group, and Add a User to the Group (With Identity Domains Enabled) ......................... 10
ide ail.c
Create a Policy (With Identity Domains Enabled) .......................................................................... 11
Create a Dynamic Group (With Identity Domains Enabled) ........................................................... 12
Gu m
Identity and Access Management (IAM): Create IAM Components - Without Identity Domains
is g
th @
Enabled ............................................................................................................................................. 13
e an
Get Started ..................................................................................................................................... 14
Create a Compartment (Without Identity Domains Enabled) ......................................................... 16
us os
Create a User (Without Identity Domains Enabled) ....................................................................... 17
to tor
Create a Group, and Add a User to the Group (Without Identity Domains Enabled) .................... 18
se ilo
Create a Policy (Without Identity Domains Enabled) ..................................................................... 19

en am
Create a Dynamic Group (Without Identity Domains Enabled) ...................................................... 20

lic z (c
Networking—Virtual Cloud Network: Create and Configure a Virtual Cloud Network ............. 21
ble e
Get Started ..................................................................................................................................... 22

ra ch
Create a Virtual Cloud Network ...................................................................................................... 24

fe án
Networking: OCI Load Balancer ..................................................................................................... 27

ns S
Get Started ..................................................................................................................................... 28

tra ro
Create a Virtual Cloud Network ...................................................................................................... 30

n- To
Create Two Compute Instances (Backend Servers) ...................................................................... 31

no dro
Create a Load Balancer.................................................................................................................. 34

n
Compute: Create a Web Server on an OCI Compute Instance .................................................... 37

eja
Get Started ..................................................................................................................................... 38

Al
Launch Cloud Shell ........................................................................................................................ 39

ilo
Generate SSH Keys ....................................................................................................................... 40

m
Create a Virtual Cloud Network and Its Components .................................................................... 42

Ca
Create a Compute Instance ........................................................................................................... 45

Install an Apache HTTP Server on the Instance ............................................................................ 47
Object Storage: Create and Manage OCI Object Storage ............................................................ 49
Get Started ..................................................................................................................................... 50
Create an Object Storage Bucket ................................................................................................... 51
Upload an Object to a Bucket ......................................................................................................... 53
Oracle Cloud Infrastructure Foundations – Table of Contents iii

Block Storage: Create, and Attach a Block Volume ..................................................................... 55

Get Started ..................................................................................................................................... 56
Create a Virtual Cloud Network and Its Components .................................................................... 58
Create a VM Instance ..................................................................................................................... 60
Create a Block Volume ................................................................................................................... 63
Attach a Block Volume to a Compute Instance .............................................................................. 64
a
Security: Configure Security Zones Using Maximum Security Zones ....................................... 67
as
Get Started ..................................................................................................................................... 68
)h
Set Up Security Zone with Maximum Security Recipe ................................................................... 70
. om
View the Security Zone Policies Attached with a Created Security Zone ...................................... 71
ide ail.c
Verify Creating a Bucket in an Assigned Compartment Using a Oracle-Managed Key ................ 72
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
iv Oracle Cloud Infrastructure Foundations – Table of Contents

Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os
e an
th @
Lab 1-1 Practices
is g
Gu m
ide ail.c
. om
Identity and Access
)h
as
a
IAM Components - With
Identity Domains Enabled
Management (IAM): Create
Get Started
Overview
Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) lets you control who
has access to your cloud resources.
a
In this lab, we will help you create a compartment, group, user, and policy. We will also provide
as
the steps to create a dynamic group.
)h
. om
Note: Below instructions are for accounts with Identity Domains enabled.
ide ail.c
In this lab, you’ll:
Gu m
is g
a. Create a compartment
th @
e an
b. Create a user
us os
c. Create a group, and add a user to the group
to tor
se ilo
d. Create a policy
en am
lic z (c
e. Create a dynamic group

ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
6 Identity and Access Management: Create IAM Components - With Identity Domains Enabled
Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os

e an
th @
is g
Identity and Access Management: Create IAM Components - With Identity Domains Enabled
Gu m
ide ail.c
. om
)h
as
a
7
Create a Compartment (With Identity Domains Enabled)
A compartment is a collection of related resources. Compartments are fundamental

components of OCI and are used for organizing and isolating your cloud resources.
In this practice, you will learn how to create a compartment.
a
Tasks
as
)h
1. Sign in to the OCI Console.
. om
2. Open the Main Menu and select Identity & Security. Under Identity,
ide ail.c
click Compartments. A list of the compartments to which you have access appears.
Gu m
Click Create Compartment.
is g
3.
th @
e an
4. Do the following:
us os
a. Name: Enter a unique name for the compartment. The name must be unique across
to tor
all the compartments in your tenancy.
se ilo
en am
b. Description: Enter a compartment-related description.

lic z (c
c. Parent Compartment: The compartment you are in appears by default.

ble e
ra ch
5. Click Create Compartment. The Child Compartment now appears in the list of
fe án
compartments.
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
Create a User (With Identity Domains Enabled)
A user is an individual employee or system that needs to manage or use your

company’s OCI resources.
In this practice, you’ll learn how to create a user.
a
Tasks
as
)h
1. Open the Main Menu and select Identity & Security. Under Identity, click Domains. A
. om
list of domains in your tenancy appears.
ide ail.c
2. Select the Domain that is allotted to you. Otherwise, you can click on the Default domain.
Gu m
Under Identity domain, click Users. A list of the users in your domain appears.
is g
3.
th @
e an
4. Click Create User.
us os
5. Enter the following: to tor
se ilo
a. First Name: Enter first name of user.

en am
b. Last Name: Enter last name of user.

lic z (c
ble e
c. Username/Email: Enter an email address for the user.

ra ch
fe án
d. Check the Use the same email address as the username. Do not select the
ns S
Assign cloud account administrator role check box.

tra ro
n- To
6. Click Create. The user now appears in the list of users.

no dro
n
eja
Al
ilo
m
Ca
Identity and Access Management: Create IAM Components - With Identity Domains Enabled 9
Create a Group, and Add a User to the Group (With
Identity Domains Enabled)

A group is a collection of users who need the same type of access to a particular compartment
or set of resources.
In this practice, you’ll learn how to create a group, and add a user to a group.
a
as
Tasks
)h
. om
ide ail.c
Gu m
2. Click on the Default domain.
is g
th @
3. Under Identity domain, click Groups. A list of the groups in your domain appears.
e an
us os
4. Select the Administrators group.
to tor
Click Assign User to Groups.
se ilo
5.
en am
6. Select the user created earlier from the Users drop-down list, and then click Add. The user
now appears in the group.
lic z (c
ble e
7. Use the breadcrumb trail to go back to the Groups page and click Create Group.
ra ch
fe án
8. Enter the following:

ns S
a. Name: Enter a unique name for the group.

tra ro
n- To
b. Description: Enter a group-related description.

no dro
9. Click Create. The group now appears in the list of groups.

n
eja
Al
ilo
m
Ca
Create a Policy (With Identity Domains Enabled)
A policy is a document that specifies who can access which resources, and how.
In this practice, you’ll learn how to create a policy.
Tasks
a
as
1. Open the Main Menu and select Identity & Security. Under Identity, click Policies.
)h
. om
2. Click Create Policy.
ide ail.c
Gu m
a. Name: Enter a unique name for the policy.
is g
th @
b. Description: Enter a policy-related description.
e an
us os
c. Compartment: If you want to attach the policy to a compartment other than the one
to tor
you’re viewing, select it from the drop-down list. Remember, where the policy is
se ilo
attached controls who can later modify or delete it.

en am
In the Policy Builder section, click Show manual editor and enter the policy statement.
lic z (c
4.
ble e
Note: A sample statement would look like the following:

ra ch
allow group <group_name> to manage virtual-network-family in

fe án
compartment <compartment_name>
ns S
tra ro
5. Click Create. The policy now appears in the list of policies.

n- To
no dro
n
eja
Al
ilo
m
Ca
Identity and Access Management: Create IAM Components - With Identity Domains Enabled 11
Create a Dynamic Group (With Identity Domains
Enabled)
A dynamic group is a special type of group that contains resources, such as compute
instances, which match rules that you define. This means that group membership can change
dynamically as matching resources are created or deleted. These instances serve as “principal”
a
actors and can make API calls to services according to policies that you write for the dynamic
as
group.
)h
In this practice, you’ll learn how to create a dynamic group.
. om
ide ail.c
Tasks
Gu m
is g
th @
e an
Click on the Default domain.
us os
2.
to tor
3. Under Identity domain, click Dynamic Groups.
se ilo
Click Create Dynamic Group.

en am
4.
lic z (c

ble e
a. Name: Enter a unique name for the group. The name must be unique across all groups
ra ch
in your tenancy, including dynamic groups and user groups.

fe án
b. Description: Enter a friendly description.

ns S
tra ro
Enter the Matching Rules. Resources that meet the rule criteria are members of the
n- To
6.
dynamic group.
no dro
a. Rule 1: Enter a rule by following the guidelines in https://docs.oracle.com/en-

n
us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm#Writing
eja
https://docs.oracle.com/en-
Al
us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm.
ilo
Note: You can manually enter the rule in the text box or launch the rule builder.
m
Ca
− For example, to include all instances that are in a specific compartment, add a rule
with the following syntax:
instance.compartment.id = '<compartment_ocid>'
b. Enter additional rules as needed. To add a rule, click +Additional Rule.
7. Click Create. The dynamic group now appears in the list of dynamic groups.
Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os
e an
th @
Lab 1-2 Practices
is g
Gu m
ide ail.c
. om
Identity and Access
)h
as
a
Identity Domains Enabled
Management (IAM): Create
IAM Components - Without
Get Started
Overview
Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) lets you control who
has access to your cloud resources.
a
In this lab, we will help you create a compartment, group, user, and policy. We will also provide
as
the steps to create a dynamic group.
)h
. om
Note: Below instructions are for accounts without Identity Domains enabled.
ide ail.c
In this lab, you’ll:
Gu m
is g
a. Create a compartment
th @
e an
b. Create a user
us os
c. Create a group, and add a user to the group
to tor
se ilo
d. Create a policy
en am
lic z (c
e. Create a dynamic group

ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
14 Identity and Access Management: Create IAM Components - Without Identity Domains Enabled
Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os

e an
th @
is g
Identity and Access Management: Create IAM Components - Without Identity Domains Enabled
Gu m
ide ail.c
. om
)h
as
a
15
Create a Compartment (Without Identity Domains
Enabled)
A compartment is a collection of related resources. Compartments are fundamental
components of OCI and are used for organizing and isolating your cloud resources.
In this practice, you will learn how to create a compartment.
a
as
Tasks
)h
. om
ide ail.c
2. Open the Main Menu and select Identity & Security. Under Identity,
Gu m
click Compartments. A list of the compartments to which you have access appears.
is g
th @
3. Under Child Compartment, click Create Compartment.
e an
us os
a.
to tor
Name: Enter a unique name for the compartment. The name must be unique across
se ilo
all the compartments in your tenancy.

en am
b. Description: Enter a compartment-related description.

lic z (c
Parent Compartment: The compartment you are in appears by default. To choose

ble e
c.
ra ch
another compartment in which to create this compartment, select from the drop-
fe án
down list.
ns S
Click Create Compartment. The Child Compartment now appears in the list of
tra ro
5.
compartments.
n- To
no dro
n
eja
Al
ilo
m
Ca
Create a User (Without Identity Domains Enabled)
A user is an individual employee or system that needs to manage or use your

company’s OCI resources.
In this practice, you’ll learn how to create a user.
a
Tasks
as
)h
1. Open the Main Menu and select Identity & Security. Under Identity, click Users. A list of
. om
users in your tenancy appears.
ide ail.c
2. Click Create User.
Gu m
Enter the following:
is g
3.
th @
e an
a. Name: Enter a unique name or email address for the user.
us os
b. Description: This value could be the user’s full name, a nickname, or any other
to tor
descriptive information.
se ilo
en am
c. Email: Enter an email address for the user. This email address is used for
lic z (c
password recovery.
ble e
4. Click Create. The user now appears in the list of users.

ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
Identity and Access Management: Create IAM Components - Without Identity Domains Enabled 17
Create a Group, and Add a User to the Group (Without
Identity Domains Enabled)

A group is a collection of users who need the same type of access to a particular compartment
or set of resources.
In this practice, you’ll learn how to create a group, and add a user to a group.
a
as
Tasks
)h
. om
1. Open the Main Menu and select Identity & Security. Under Identity, click Groups. A list
ide ail.c
of the groups in your tenancy appears.
Gu m
2. Click on the Administrators group.
is g
th @
3. Click Add User to Group.
e an
us os
4. Select the user created earlier from the Users drop-down list, and then click Add. The user
now appears in the group.
to tor
se ilo
Use the breadcrumb trail to go back to the Groups page and click Create Group.
en am
5.
lic z (c

ble e
ra ch
a. Name: Enter a unique name for the group.

fe án
b. Description: Enter a group-related description.

ns S
tra ro
7. Click Create. The group now appears in the list of groups.

n- To
no dro
n
eja
Al
ilo
m
Ca
Create a Policy (Without Identity Domains Enabled)
A policy is a document that specifies who can access which resources, and how.
In this practice, you’ll learn how to create a policy.
Tasks
a
as
1. Open the Main Menu and select Identity & Security. Under Identity, click Policies.
)h
. om
2. Choose a compartment.
ide ail.c
3. A list of the policies in the compartment you’re currently viewing appears.
Gu m
4. Click Create Policy.
is g
th @
e an
5.
us os
a. Name: Enter a unique name for the policy.
to tor
se ilo
b. Description: Enter a policy-related description.

en am
c. Compartment: If you want to attach the policy to a compartment other than the one
lic z (c
you’re viewing, select it from the drop-down list. Remember, where the policy is
ble e
attached controls who can later modify or delete it.

ra ch
fe án
6. In the Policy Builder section, click Show manual editor and enter the policy statement.
ns S
Note: A sample statement would look like the following:

tra ro
n- To
allow group <group_name> to manage virtual-network-family in

compartment <compartment_name>
no dro
n
7. Click Create. The policy now appears in the list of policies.

eja
Al
ilo
m
Ca
Identity and Access Management: Create IAM Components - Without Identity Domains Enabled 19
Create a Dynamic Group (Without Identity Domains
Enabled)
A dynamic group is a special type of group that contains resources, such as compute
instances, which match rules that you define. This means that group membership can change
dynamically as matching resources are created or deleted. These instances serve as “principal”
a
actors and can make API calls to services according to policies that you write for the dynamic
as
group.
)h
In this practice, you’ll learn how to create a dynamic group.
. om
ide ail.c
Tasks
Gu m
1. Open the Main Menu and select Identity & Security. Under Identity, click Dynamic
is g
th @
Groups.
e an
Click Create Dynamic Group.
us os
2.
to tor
se ilo
a. Name: Enter a unique name for the group. The name must be unique across all groups
en am
in your tenancy, including dynamic groups and user groups.

lic z (c
b. Description: Enter a friendly description.

ble e
ra ch
4. Enter the Matching Rules. Resources that meet the rule criteria are members of the
fe án
dynamic group.
ns S
a. Rule 1: Enter a rule by following the guidelines in https://docs.oracle.com/en-

tra ro
us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm#Writing
n- To
https://docs.oracle.com/en-
no dro
us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm.
Note: You can manually enter the rule in the text box or launch the rule builder.
n
eja
− For example, to include all instances that are in a specific compartment, add a rule
Al
with the following syntax:

ilo
instance.compartment.id = '<compartment_ocid>'
m
Ca
b. Enter additional rules as needed. To add a rule, click +Additional Rule.
5. Click Create. The dynamic group now appears in the list of dynamic groups.
Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os
e an
th @ Network
Lab 2-1 Practice
is g
Gu m
ide ail.c
. om
)h
Network: Create and
as
a
Configure a Virtual Cloud
Networking—Virtual Cloud
Get Started
Overview
In this practice, you will configure and deploy a Virtual Cloud Network (VCN).
A VCN is a software-defined network specific to your OCI tenancy or a compartment in a
a
specified region.
as
)h
Upon creation, a VCN automatically includes route tables, security lists (with default security
. om
rules), and a set of DHCP options. The VCN also has access to a DNS resolver.
ide ail.c
A VCN that is launched with the OCI VCN Wizard tool automatically creates the following:
Gu m
• Public and Private Subnets
is g
th @
• Internet Gateway (IG)
e an
• NAT Gateway (NAT)
us os
• Service Gateway (SG)
to tor
• Two Route Tables (RT)
se ilo
• Two Security Lists (SL)

en am
• One CIDR Blocks/Prefixes

lic z (c
• One DHCP Option

ble e
ra ch
For more information about VCNs, see the OCI Networking Documentation:
fe án
https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/landing.htm
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
22 Virtual Cloud Network: Create and Configure a Virtual Cloud Network

a
as
)h
. om
ide ail.c
Gu m
is g
th @
e an
us os
to tor
se ilo
Prerequisites
en am
• You have access to the OCI Console.

lic z (c
Assumptions
ble e
ra ch
• In this lab, we are considering US East (Ashburn, Region Key – IAD) as your region.
fe án
• You must be familiar with navigating the OCI Console.

ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
Virtual Cloud Network: Create and Configure a Virtual Cloud Network 23

Create a Virtual Cloud Network
In this lab, you will create a VCN and associated resources by using the VCN Wizard.
Tasks
1. Log in to the OCI Console.
a
as
2. In the Console ribbon at the top of the screen, click the Region icon to expand the menu.
)h
Ensure that you are in the correct region, US East (Ashburn).
. om
3. Click the Main Menu, click Networking, and then click Virtual Cloud Networks.
ide ail.c
4. Click Start VCN Wizard.
Gu m
is g
th @
5. Select the Create VCN with Internet Connectivity option, and then click Start VCN
e an
Wizard.
us os
6. Enter the following values: to tor
se ilo
Name: IAD-FA-LAB02-VCN-01
en am
Compartment: Select your <assigned compartment>.

lic z (c
ble e
7. Leave the default values for the remaining fields. Click Next.
ra ch
fe án
8. Review and understand the list of resources that the OCI VCN Wizard will create. Notice
ns S
that the wizard will configure CIDR block ranges for VCN IP addresses, and for the public
tra ro
and private subnets. It will also set up security list rules and route table rules to enable
n- To
basic access to the VCN.

no dro
9. Click Create to start creating the VCN and its resources and wait for the VCN Wizard to
n
successfully complete the VCN creation.

eja
Al
10. Click View Virtual Cloud Network to verify the creation of the VCN and its resources.
ilo
m
Ca
24 Virtual Cloud Network: Create and Configure a Virtual Cloud Network

You can see that the VCN is successfully created with the following components:
• VCN
• Public Subnet
• Private Subnet
• CIDR Blocks/Prefixes
• Route Tables
a
Internet Gateway
as
•
)h
• Security Lists
. om
• DHCP Options
ide ail.c
• NAT Gateway
• Service Gateway
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
Virtual Cloud Network: Create and Configure a Virtual Cloud Network 25

26
Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os

e an
th @
is g
Gu m
ide ail.c
. om
)h
as
a
Virtual Cloud Network: Create and Configure a Virtual Cloud Network

Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os
Balancer
e an
th @
Lab 3-1 Practice
is g
Gu m
ide ail.c
. om
)h
as
Networking: OCI Load
a
Get Started
Overview
In this practice, you will configure a Public Load Balancer, including a set of two backend
compute instances.
a
Load Balancer
as
)h
The OCI Load Balancer provides automated traffic distribution from one entry point to
. om
multiple backend servers in your VCN. It operates at the connection level and balances
ide ail.c
incoming client connections to healthy backend servers. The service offers a load balancer
with your choice of a regional public or private IP address and provisioned bandwidth.
Gu m
is g
Summary of Components for OCI Load Balancer Used in This Lab
th @
e an
• Listener: A logical entity that checks for incoming traffic on the load balancer’s IP
us os
address
•
to tor
Backend server: An application server responsible for generating content in reply to
se ilo
the incoming traffic

en am
• Backend set: A logical entity defined by a list of backend servers

lic z (c
• Load-balancing policy: Tells the load balancer how to distribute incoming traffic to
the backend servers
ble e
ra ch
• Health check: A test to confirm the availability of backend servers

fe án
• Shape: The bandwidth capacity of the load balancer

ns S
tra ro
In this lab, you will:

n- To

no dro
a.
n
b. Create two compute instances

eja
Al
c. Create a load balancer

ilo
m
Ca
28 OCI Load Balancer

a
as
)h
. om
ide ail.c
Gu m
is g
th @
Prerequisites
e an
us os
to tor
Assumptions
se ilo
en am
lic z (c

ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
OCI Load Balancer 29

In this practice, you will create a VCN and associated resources using the VCN Wizard.
Tasks
1. In the Console ribbon at the top of the screen, click the Regions icon to expand the menu.
a
as
)h
2. From the Main Menu, select Networking, and then click Virtual Cloud Networks.
. om
3. Click Start VCN Wizard.
ide ail.c
4. Select the Create VCN with Internet Connectivity option, and then click Start VCN
Gu m
Wizard.
is g
th @
e an
5. Enter the following values:
us os
• Name: IAD-FA-LAB03-VCN-01
to tor
• Compartment: Select your assigned <compartment name>.
se ilo
• VCN CIDR Block: 172.17.0.0/16

en am
• Public Subnet CIDR Block: 172.17.0.0/24

lic z (c
• Private Subnet CIDR Block: 172.17.1.0/24

ble e
ra ch
6. Leave the default values for the remaining fields. Click Next.
fe án
ns S
7. Review and understand the list of resources that the OCI VCN Wizard will create. Notice
tra ro
that the wizard will configure CIDR block ranges for VCN IP addresses, and for the public
n- To
and private subnets. It will also set up security list rules and route table rules to enable
basic access to the VCN.
no dro
n
8. Click Create.
eja
Al
9. When complete, click View Virtual Cloud Network.

ilo
10. In the left navigation pane, under Resources, click Security Lists.
m
Ca
11. Select Default Security List for IAD-FA-LAB03-VCN-01.
12. Click Add Ingress Rule.

a. For Source CIDR, enter 0.0.0.0/0.
b. For Destination Port Range, enter 80.
c. Click Add Ingress Rules.

Create Two Compute Instances (Backend Servers)
In this lab, you will create two compute instances and configure them to provide web services.
They will serve as the backend servers, and will reside in a private subnet.
Task 1: Build the First Compute Instance
a
as
)h
. om
2. From the Main Menu, select Compute, and then click Instances.
ide ail.c
3. In the left navigation pane, under List Scope, select your assigned <compartment name>.
Gu m
4. Click Create Instance and enter the following values:
is g
th @
• Name: IAD-FA-LAB03-VM-01
e an
• Compartment: Your assigned <compartment name>
us os
• Placement: AD-1 to tor
Image: Oracle Linux 8
se ilo
•
en am
• Shape: Click Change Shape.

lic z (c
• Instance Type: Virtual Machine

• Shape Series: Ampere
ble e
ra ch
• Shape Name: VM.Standard.A1.Flex

fe án
• Leave Number of OCPU at one.

ns S
• Leave Amount of memory (GB) at six.

tra ro
n- To
• Click Select Shape.

• Networking:
no dro
• Primary network: Select existing Virtual Cloud Network.

n
eja
• Virtual Cloud Network in <assigned compartment>: IAD-FA-LAB03-VCN-01

Al
• Subnet in <assigned compartment>: Private Subnet-IAD-FA-LAB03-VCN-01

ilo
(regional)
m
• Add SSH Key: No SSH Keys

Ca
• Click Show advanced options.

• On the Management tab, click Paste cloud-init script under Initialization script.

• Copy and paste the following into the Cloud-init script field
(Tip: Copy the below script in a notepad and ensure that the last 2 lines of the script
are copied in a single line as a single command):
#!/bin/bash -x
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
yum -y install httpd
a
systemctl enable httpd.service
as
systemctl start httpd.service
)h
firewall-offline-cmd --add-service=http
. om
firewall-offline-cmd --add-service=https
systemctl enable firewalld
ide ail.c
systemctl restart firewalld
echo Hello World! My name is IAD-FA-LAB03-WS-01>
Gu m
/var/www/html/index.html
is g
th @
Note: This script configures and enables the compute instance’s firewall and httpd
e an
processes.
us os
to tor
5. Click Create.
se ilo
en am
Note: The process will take approximately two minutes.

lic z (c
ble e
ra ch
Task 2: Build the Second Compute Instance

fe án
ns S
1. In the console ribbon at the top of the screen, click the Regions icon to expand the menu.
tra ro

n- To
2. From the Main Menu, select Compute, and then click Instances.
no dro
n
eja
4. Click Create Instance and enter the following values:

Al
ilo
• Name: IAD-FA-LAB03-VM-02
m
• Compartment: Your assigned <compartment name>

Ca
• Placement: AD-1
• Image: Oracle Linux 8
• Shape: Click Change Shape
• Instance Type: Virtual Machine
• Shape Series: Ampere

• Shape Name: VM.Standard.A1.Flex
• Leave Number of OCPU at one.

• Leave Amount of memory (GB) at six.
• Click Select Shape.
• Networking:
• Primary network: Select existing Virtual Cloud Network.
a
as
• Virtual Cloud Network in <assigned compartment>: IAD-FA-LAB03-VCN-01
)h
• Subnet in <assigned compartment>: Private Subnet-IAD-FA-LAB03-VCN-01
. om
(regional)
Add SSH Key: No SSH Keys
ide ail.c
•
• Click Show advanced options.
Gu m
• On the Management tab, click Paste cloud-init script under Initialization script.
is g
th @
• Copy and paste the following into the Cloud-init script field:
e an
#!/bin/bash -x
us os
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
to tor
yum -y install httpd
se ilo
systemctl enable httpd.service

en am
systemctl start httpd.service

lic z (c
firewall-offline-cmd --add-service=http
firewall-offline-cmd --add-service=https
ble e
systemctl enable firewalld

ra ch
systemctl restart firewalld

fe án
echo Hello World! My name is IAD-FA-LAB03-WS-02>

ns S
/var/www/html/index.html
tra ro
n- To
Note: This script configures and enables the compute instance’s firewall and httpd
processes.
no dro
n
5. Click Create.
eja
Al
Note: The process will take approximately two minutes.

ilo
m
Ca

Create a Load Balancer
In this lab, you will create a Load Balancer, and configure the listener, the health check, and
backend set. You will then add a security rule to the security list of the private subnet.
Tasks
a
1. From the Main Menu, select Networking, and then click Load Balancers.
as
)h
. om
3. Click Create Load Balancer.
ide ail.c
4. Select Load Balancer, click Create Load Balancer, and enter the following values:
Gu m
is g
• Load Balancer Name: IAD-FA-LAB03-LB-01
th @
• Choose visibility type: Public
e an
• Assign a public IP address: Ephemeral IP Address
us os
• to tor
In the Bandwidth section, under Shapes, select Flexible Shapes.
se ilo
• Under Choose Networking, for the Virtual Cloud Network in <compartment

en am
name>, select IAD-FA-LAB03-VCN-01 and for the Subnet in <compartment

name>, select Public Subnet-IAD-FA-LAB03_VCN-01.
lic z (c
• Click Next.
ble e
ra ch
• Under Choose Backends, select Weighted Round Robin.

fe án
• Click Add Backends.

ns S
• Select both IAD-FA-LAB03-VM-01 and IAD-FA-LAB03-VM-02.

tra ro
Click Add Selected Backends.

n- To
•
• Leave all values at defaults in the Specify Health Check Policy section.
no dro
Note: The default values will add a TCP port 80 rule to the security list for your
n
eja
private subnet.
• Click Next.
Al
ilo
• On the Configure Listener page, enter the following values:

m
• Listener Name: IAD-FA-LAB03-LISTENER-01

Ca
• Specify the type of traffic your listener handles: HTTP

Note: The Specify the port your listener monitors for ingress traffic value will
become 80.
• Click Next.
• On the Manage Logging page, set Error Logs to Not Enabled.

5. Click Submit and wait for the status to become Active.
Note: The process will take approximately three minutes.
6. Verify that the Backend Set Health status is OK.
7. Locate and copy the Load Balancer’s IP Address.
a
8. Paste the copied value into your browser’s address bar to visit the site.
as
)h
9. A webpage stating Hello World! My name is IAD-FA-LAB03-WS-01 will appear.
. om
10. Reload the page to see the other backend server has provided the message, Hello World!
ide ail.c
My name is IAD-FA-LAB03-WS-02.
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca

36
Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os

e an
th @
is g
Gu m
ide ail.c
. om
)h
as
a
OCI Load Balancer

Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os Instance
e an
th @
Lab 4-1 Practices
is g
Gu m
ide ail.c
. om
)h
as
a
Compute: Create a Web
Server on an OCI Compute
Get Started
Overview
The Oracle Cloud Infrastructure (OCI) Compute lets you provision and manage compute hosts,
known as instances. You can launch instances as needed to meet your compute and
application requirements. In this lab, you will create a web server on a compute instance.
a
as
)h
• Launch Cloud Shell
. om
• Generate SSH keys
ide ail.c
• Create a Virtual Cloud Network and its components
Gu m
• Create a compute instance
is g
th @
• Install an Apache HTTP server on the instance
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
Prerequisites
ilo
m

Ca
Assumptions
38 Create a Web Server on a Compute Instance

Launch Cloud Shell
The OCI Cloud Shell is a web browser–based terminal accessible from the OCI Console. It
provides access to a Linux shell, with a pre-authenticated OCI CLI.
In this practice, you will access Cloud Shell via the OCI Console.
a
Tasks
as
)h
1. Sign in to your Oracle Cloud Infrastructure Console.
. om
ide ail.c
Gu m
Click the Cloud Shell icon next to the Region in the Console ribbon.
is g
3.
th @
e an
Note: The OCI CLI running in the Cloud Shell will execute commands against the region
us os
selected in the Console's region selection menu when the Cloud Shell is started.
to tor
This displays the Cloud Shell in a "drawer" at the bottom of the console.
se ilo
en am
4. You can use the icons in the top-right corner of the Cloud Shell window to minimize,
lic z (c
maximize, and close your Cloud Shell session.

ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
Create a Web Server on a Compute Instance 39

Generate SSH Keys
In this practice, you will generate SSH keys using Cloud Shell.
Tasks
1. From the OCI Console, click the Cloud Shell icon next to the region in the Console ribbon.
a
as
2. After the Cloud Shell has started, run the following commands:
)h
. om
$ mkdir .ssh
ide ail.c
Important: In case you get an error that says “cannot create director: File exists”, you can
skip running the first command.
Gu m
is g
$ cd .ssh
th @
e an
$ ssh-keygen -b 2048 -t rsa –f <<sshkeyname>>
us os
to tor
Replace <<sshkeyname>> with ocifalab4key. Select the key name you can remember.
se ilo
This will be the key name you will use to connect to the compute instance you create.
en am
Note: If you receive an error message for the above command, enter the command
lic z (c
manually.
ble e
ra ch
Remember:
fe án
▪ After entering the third command, press Enter twice for no passphrase.
ns S
tra ro
▪ Do not include the angle brackets «» and $ symbol when pasting code into Cloud
n- To
Shell.
no dro
3. Examine the two files that you just created by running the following command:
n
eja
$ ls
Al
ilo
Note: In the output, there are two files, a private key <<sshkeyname>> and a public
m
key <<sshkeyname>>.pub. Keep the private key safe and don’t share its contents with
Ca
anyone. The public key will be needed for various activities and can be uploaded to certain
systems as well as copied and pasted to facilitate secure communications in the cloud.

4. To list the contents of the public key, run the following command:
$ cat <<sshkeyname>>.pub
Replace <<sshkeyname>> with ocifalab4key.
Note: The angle brackets «» should not appear in your code.
a
5. Copy the contents of the public key as you will require this in a subsequent step. Make
as
sure that you remove any hard returns that may have been added when copying.
)h
The .pub key should be one line.
. om
ide ail.c
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca

Create a Virtual Cloud Network and Its Components
In this practice, you will create a Virtual Cloud Network (VCN), subnet, and Internet gateway
and add route rules in the route table.
Tasks
a
1. From the Main Menu, under Networking, click Virtual Cloud Networks.
as
)h
2. Click Create VCN.
. om
3. In the Create a Virtual Cloud Network dialog box, populate the following information:
ide ail.c
a. Name: IAD-FA-LAB04-1-VCN-01
Gu m
is g
th @
b. Create in Compartment: <your compartment>
e an
IPv4 CIDR Blocks: 10.0.0.0/16 (Press Enter to add.)
us os
c.
to tor
4. Keep the other options default and click Create VCN.
se ilo
en am
You can see that the VCN is created successfully.

lic z (c
5. Click IAD-FA-LAB04-1-VCN-01 VCN to view the details page.

ble e
ra ch
6. Click Create Subnet.

fe án
In the Create Subnet dialog box, populate the following information:

ns S
7.
tra ro
Name: IAD-FA-LAB04-1-SNET-01
n- To
a.
no dro
b. Create in Compartment: <your compartment>

n
eja
c. Subnet Type: Regional

Al
d. IPv4 CIDR Blocks: 10.0.1.0/24

ilo
m
e. Subnet Access: Public Subnet

Ca
8. Keep the other options default and click Create Subnet.
You can see that the subnet is created successfully, and the state is Available.
9. Under Resources in the left navigation panel, click Internet Gateways.

10. Click Create Internet Gateway.
11. In the Create Internet Gateway dialog box, populate the following information:
a. Name: IAD-FA-LAB04-1-IG-01
b. Create In Compartment: <your compartment>
a
as
)h
You can see that the Internet gateway is created successfully and the state is Available.
. om
13. Under Resources in the left navigation panel, click Route Tables.
ide ail.c
14. Click Default Route Table for IAD-FA-LAB04-1-VCN-01.
Gu m
is g
th @
15. Click Add Route Rules.
e an
16. In the Add Route Rules dialog box, populate the following information:
us os
to tor
a. Target Type: Internet Gateway
se ilo
en am
b. Destination CIDR Block: 0.0.0.0/0

lic z (c
c. Target Internet Gateway: IAD-FA-LAB04-1-IG-01

ble e
ra ch
17. Click Add Route Rules.

fe án
ns S
You can see that the route rule is successfully added in the default Route Table.
tra ro
n- To
18. Navigate back to the Virtual Cloud Networks page from the Main Menu.
no dro
19. Click IAD-FA-LAB04-1-VCN-01 VCN to view the details page.

n
eja
20. Under Resources in the left navigation panel, click Security Lists.
Al
21. Click Default Security List for IAD-FA-LAB04-1-VCN-01.

ilo
m
22. Here, you need to open port 80. Click Add Ingress Rules.
Ca

23. In the Add Ingress Rules dialog box, populate the following information:
a. Source Type: CIDR
b. Source CIDR: 0.0.0.0/0
c. IP Protocol: TCP
a
Destination Port Range: 80
as
d.
)h
Note: Do not select the Stateless check box. The Source Port Range field is set to All by
. om
default.
ide ail.c
24. Click Add Ingress Rule.
Gu m
is g
You can see that the route rule is successfully added.
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca

Create a Compute Instance
In this practice, you will launch a compute instance and connect to it.
Tasks
1. From the OCI Console Main Menu, under Compute, click Instances.
a
as
2. Click Create instance.
)h
. om
3. In the Create compute instance dialog box, populate the following information:
ide ail.c
a. Name: IAD-FA-LAB04-1-VM-01
Gu m
b. Create in compartment: <your compartment>
is g
th @
Placement (Availability domain): AD 1
e an
c.
us os
Click Show advanced options and select On-demand capacity under Capacity type.
to tor
se ilo
d. Image: Oracle Linux 8

en am
e. Shape: Click Change Shape and select the following:

lic z (c
Instance Type: Virtual Machine

ble e
1)
ra ch
Shape Series: Ampere

fe án
2)
ns S
3) Shape Name: VM.Standard.A1.Flex

tra ro
n- To
4) Leave Number of OCPU at one.

no dro
5) Leave Amount of memory (GB) at six.

n
eja
6) Click Select Shape.

Al
ilo
f. Primary network: Select an existing Virtual Cloud Network.

m
Ca
1) Virtual cloud network in <your compartment>: IAD-FA-LAB04-1-VCN-01
2) Subnet: Select an existing subnet.
3) Subnet in <your compartment>: IAD-FA-LAB04-1-SNET-01 (regional)
4) Public IP address: Assign a public IPv4 address.

g. Add SSH keys: Paste public keys.
h. SSH Keys: <public key> (Paste the public key which you copied in Step 5 of Generate
SSH Keys practice.)
Note: Keep the default option for Boot volume.
Click Create.
a
4.
as
You will see that the instance is created successfully, and the state is Running.
)h
. om
5. Copy the public IP corresponding to the IAD-FA-LAB04-1-VM-01 instance and paste it in
ide ail.c
the Notepad.
Gu m
6. Click the Cloud Shell icon next to Region at the top of the screen.
is g
th @
7. Run the following command using SSH to connect to your instance:
e an
us os
$ ssh -i <private_key_file> <username>@<public-ip-address>
to tor
a. The /home/username/.ssh/private_key_file is the full path and name of the
se ilo
file that contains the private key associated with the instance you want to access.
en am
lic z (c
b. The <username> is the default user opc.

ble e
The <public-ip-address> is the public IP address of the instance.

ra ch
c.
fe án
Note: Enter yes in response to “Are you sure you want to continue connecting (yes/no)?”
ns S
tra ro
You are now connected to the instance IAD-FA-LAB04-1-VM-01.

n- To
no dro
n
eja
Al
ilo
m
Ca

Install an Apache HTTP Server on the Instance
The HTTP server is an open-source web server developed by the Apache Software
Foundation. The Apache server hosts web content and responds to requests for this content
from web browsers such as Chrome or Firefox.
In this practice, you will install an Apache HTTP web server and connect to it over the public
a
Internet.
as
)h
Tasks
. om
On the OCI Console, click the Cloud Shell icon at the top of the screen.
ide ail.c
1.
While connected to your compute instance via SSH, run the following commands:
Gu m
2.
is g
th @
a. Install Apache HTTP:
e an
us os
$ sudo yum install httpd -y
to tor
b. Start the Apache server and configure it to start after system:
se ilo
en am
$ sudo apachectl start

lic z (c
$ sudo systemctl enable httpd

ble e
ra ch
c. Run a quick check on Apache configurations:

fe án
$ sudo apachectl configtest

ns S
tra ro
d. Create firewall rules to allow access to the ports on which the HTTP server listens:
n- To
$ sudo firewall-cmd --permanent --zone=public --add-

no dro
service=http
n
eja
$ sudo firewall-cmd --reload

Al
e. Create an index file for your web server.

ilo
m
$ sudo bash -c 'echo This is my Web-Server running on Oracle

Ca
Cloud Infrastructure >> /var/www/html/index.html'

3. Open your browser and enter http://Public-IPAddress in the address bar (the IP
address of the compute instance).
You should see the index page of the web server we created in the second step (last point).
This is my Web-Server running on Oracle Cloud Infrastructure
a
as
)h
. om
ide ail.c
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca

Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os
e an
th @
Lab 5-1 Practices
is g
Gu m
ide ail.c
. om
)h
as
a
Object Storage: Create and
Manage OCI Object Storage
Get Started
Overview
The Oracle Cloud Infrastructure (OCI) Object Storage provides unlimited capacity with high
durability and scalability. It is highly reliable and cost efficient. The object storage resources
include namespace, bucket, and object.
a
as
Object Storage is characterized by strong consistency and security with encryption. By
)h
creating unlimited buckets, you can add as many objects as required with a maximum of 10TiB
. om
per object. In this lab, you will work on buckets, object versioning, object life cycle
ide ail.c
management, replication policy, and retention rule.
Gu m
is g
th @
• Create an Object Storage bucket
e an
• Upload an object to a bucket
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
Prerequisites
m
Ca
Assumptions
50 Create and Manage OCI Object Storage

Create an Object Storage Bucket
In this practice, you will create an Object Storage bucket.
Tasks
1. Sign in to your OCI account.
a
as
2. From the Main Menu, select Storage.
)h
. om
3. Under Object Storage and Archive Storage, click Buckets.
ide ail.c
4. From the left navigation panel, select the compartment in which you have permission to
work. Then the page updates to display only the resources in that compartment.
Gu m
is g
th @
5. Click Create Bucket.
e an
In the Create Bucket dialog box, specify the following attributes of the bucket:
us os
6.
to tor
▪ Bucket Name: Enter IAD-FA-LAB05-1-BKT-01-xxx as the name for the bucket.
se ilo
Specify a random number in place of xxx to make it unique.

en am
▪ Default Storage Tier: Select the default tier in which you want to store the data. After
lic z (c
it is set, you cannot change the default storage tier of a bucket. When you upload
ble e
objects, this tier will be selected by default. You can, however, select a different tier. In
ra ch
this case, select Standard, which is the primary and default storage tier used for Object
fe án
Storage.
ns S
tra ro
▪ Enable Auto-Tiering: Auto-Tiering helps you automatically move objects between

n- To
Standard and Infrequent Access tiers based on their access patterns. Do not enable this
no dro
field now.
n
eja
▪ Enable Object Versioning: Versioning directs Object Storage to automatically create

an object version each time a new object is uploaded, an existing object is overwritten,
Al
or when an object is deleted. You can enable it while creating a bucket or later. Do not
ilo
enable this field now.

m
Ca
▪ Emit Object Events: Emit Object Events lets the bucket emit events for object state
changes. Do not select this field now.
▪ Uncommitted Multipart Uploads Cleanup: Uncommitted Multipart Uploads Cleanup

allows deletion of uncommitted or failed multipart uploads. Do not select this field now.
Create and Manage OCI Object Storage 51

▪ Encryption: Buckets are encrypted with keys managed by Oracle by default, but you
can optionally encrypt the data in this bucket using your own vault encryption key.
Select the Encrypt using Oracle managed keys option.
▪ Tags: If you have permissions to create a resource, then you also have permissions to
apply free-form tags to that resource. Skip this option. You can always apply tags later.
a
7. Click Create.
as
)h
The bucket is created immediately, and you can add objects to it.
. om
ide ail.c
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
52 Create and Manage OCI Object Storage

Upload an Object to a Bucket
In this practice, you will upload an object to your bucket. Object Storage supports uploading
individual files up to 10 TiB.
Before you upload an object to a bucket, you must have a bucket. In this case, you will use the
bucket that is created from the previous practice.
a
as
Tasks
)h
. om
1. In the Main Menu, navigate to Storage, and then select Buckets.
ide ail.c
2. Click the bucket IAD-FA-LAB05-1-BKT-01-xxx to view its details.
Gu m
Under Objects, click Upload.
is g
3.
th @
e an
4. In the Object Name Prefix field, enter the file name prefix oci/ for the files you plan to
us os
upload. This step is optional.
to tor
5. The Storage Tier field is populated as Standard. You can optionally change the storage
se ilo
tier (to Infrequent Access or Archive) to upload objects. In this case, keep it as Standard.
en am
lic z (c
6. Select the objects to upload (browse any object from your local machine) by using one of
the following options:
ble e
ra ch
▪ Drag files from your computer into the Drop files here... section.
fe án
ns S
▪ Click the Select Files link to display a file selection dialog box.
tra ro
n- To
As you select files to upload, they are displayed in a scrolling list. If you decide that you
no dro
do not want to upload a file that you have selected, click X to the right of the file name.
n
If selected files to upload and files already stored in the bucket have the same name,
eja
warning messages to overwrite are displayed.

Al
ilo
7. Click Upload.
m
Ca
The selected objects are uploaded. Click Close to return to the bucket.
Create and Manage OCI Object Storage 53

54
Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os

e an
th @
is g
Gu m
ide ail.c
. om
)h
as
a
Create and Manage OCI Object Storage

Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os
e an
th @
Lab 6-1 Practices
is g
Gu m
ide ail.c
. om
)h
as
Attach a Block Volume
a
Block Storage: Create, and
Get Started
Overview
The Oracle Cloud Infrastructure (OCI) Block Volume service lets you dynamically provision and
manage block storage volumes. You can create, attach, connect, and move volumes, as well as
change volume performance, as needed, to meet your storage, performance, and application
a
requirements.
as
)h
. om
Create a Virtual Cloud Network and its components
ide ail.c
a.
Create a VM instance
Gu m
b.
is g
th @
c. Create a block volume
e an
us os
d. Attach a block volume to a compute instance
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
Prerequisites
56 Create, Attach, Detach, and Resize a Block Volume

Assumptions
a
as
)h
. om
ide ail.c
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
Create, Attach, Detach, and Resize a Block Volume 57

Create a Virtual Cloud Network and Its Components
In this practice, you will learn how to create a Virtual Cloud Network (VCN), subnet, and
Internet gateway, and add route rules in the Route Table.
Tasks
a
as
)h
. om
ide ail.c
3. From the Main Menu, select Networking, and then click Virtual Cloud Networks.
Gu m
Click Create VCN.
is g
4.
th @
e an
5.
us os
a. Name: Enter IAD-FA-LAB06-1-VCN-01.
to tor
se ilo
b. Create in Compartment: Select the <compartment name> assigned to you.
en am
c. IPv4 CIDR Blocks: Type 10.0.0.0/16 and press Enter.

lic z (c
Note: You can leave all the other options as default.

ble e
ra ch
6. Click Create VCN. The VCN is now created successfully.

fe án
ns S
7. Click Create Subnet.

tra ro
n- To
8. In the Create Subnet dialog box, do the following:

no dro
a. Name: Enter IAD-FA-LAB06-1-SNET-01.

n
eja

Al
c. Subnet Type: Select Regional.

ilo
m
d. IPv4 CIDR Blocks: Enter 10.0.1.0/24.

Ca
e. Subnet Access: Select Public Subnet.
Note: You can leave all the other options as default.
9. Click Create Subnet. The subnet is now created successfully, and the state is Available.

10. In the left navigation pane, under Resources, click Internet Gateways.
a. Name: Enter IAD-FA-LAB06-1-IG-01.
a
Create in Compartment: Select the <compartment name> assigned to you.
as
b.
)h
13. Click Create Internet Gateway. The Internet gateway is now created successfully, and the
. om
state is Available.
ide ail.c
14. In the left navigation pane, under Resources, click Route Tables.
Gu m
is g
15. Click Default Route Table for IAD-FA-LAB06-1-VCN-01.
th @
e an
16. Click Add Route Rules and do the following:
us os
a. Target Type: Select Internet Gateway from the drop-down list.
to tor
se ilo
b. Destination CIDR Block: Enter 0.0.0.0/0.

en am
Target Internet Gateway: Select IAD-FA-LAB06-1-IG-01 from the drop-down list.

lic z (c
c.
ble e
17. Click Add Route Rules. The route rule is now successfully added to the default Route
ra ch
Table.
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca

Create a VM Instance
In this practice, you will learn how to create SSH keys using Cloud Shell and how to launch an
instance.
Tasks
a
as
)h
. om
ide ail.c
3. In the Console ribbon at the top of the screen, click the Cloud Shell icon next to the
Region selection menu.
Gu m
is g
th @
4. Once the Cloud Shell is ready, enter the following commands:
e an
us os
$ mkdir .ssh
to tor
▪ Important: In case you get an error “Cannot create directory: File exists,” you can skip
se ilo
running this first command.

en am
$ cd .ssh
lic z (c
ble e
$ ssh-keygen -b 2048 -t rsa –f <<sshkeyname>>

ra ch
fe án
▪ Remember: After entering this third command, press Enter twice for no passphrase.
ns S
Note: Replace <<sshkeyname>> with ocifalab6key. Choose a key name you can
tra ro
n- To
remember. This will be the key name you will use to connect to the compute instance you
create.
no dro
Reminder: The angle brackets «» should not appear in your code.

n
eja
Reminder: Do not include the $ symbol when pasting code into Cloud Shell.
Al
ilo
5. Examine the two files that you just created by running the following command:
m
Ca
$ ls
Note: In the output, there are two files, a private key <<sshkeyname>> and a public
key <<sshkeyname>>.pub. Keep the private key safe and don’t share its contents with
anyone. The public key will be needed for various activities and can be uploaded to certain
systems, as well as copied and pasted to facilitate secure communications in the cloud.

6. To list the contents of the public key, use the following command:
$ cat <<sshkeyname>>.pub
Note: Replace <<sshkeyname>> with ocifalab6key.
Reminder: The angle brackets «» should not appear in your code.
a
7. Copy the contents of the public key as you will need this in a subsequent step. Make sure
as
that you remove any hard returns that may have been added when copying. The .pub
)h
key should be one line.
. om
From the Main Menu, select Compute. Under Compute, click Instances.
ide ail.c
8.
Gu m
9. Click Create instance and do the following:
is g
th @
a. Name: Enter IAD-FA-LAB06-1-VM-01.
e an
us os
b. Create in compartment: Select the <compartment name> assigned to you.
to tor
c. Placement: Select Availability Domain AD1. Click Show advanced options and select
se ilo
On-demand capacity from the Capacity type menu.

en am
lic z (c
d. Image: Select Oracle Linux 8.

ble e
Shape: Click Change Shape and select the following:

ra ch
e.
fe án
1) Instance Type: Virtual Machine

ns S
tra ro
2) Shape Series: Ampere

n- To
3) Shape Name: VM.Standard.A1.Flex

no dro
n
4) Leave Number of OCPU at one.

eja
Al
5) Leave Amount of memory (GB) at six.

ilo
6) Click Select Shape.

m
Ca
f. Networking: Select the existing VCN IAD-FA-LAB06-1-VCN-01 and existing subnet

IAD-FA-LAB06-1-SNET-01 (regional). Under Public IP address, select Assign a
public IPv4 address.
g. Add SSH keys: Select Paste public keys and paste the contents of the public key,
which you copied in Step 6, in the box.

h. Boot volume: Keep the default selection.
10. Click Create.
Note: After a couple of minutes, you see that the instance is successfully created, and the
state is Running.
11. Under Instance access, copy the Public IP address.
a
as
12. Click the Cloud Shell icon to open Cloud Shell, and use SSH to connect to your instance
)h
by using the following command:
. om
Note: Enter yes in response to “Are you sure you want to continue connecting (yes/no)?”
ide ail.c
$ ssh -i <private_key_file> <username>@<public-ip-address>
Gu m
is g
Reminders:
th @
e an
▪ /home/username/.ssh/private_key_file is the full path and name of the file
us os
that contains the private key associated with the instance you want to access.
to tor
se ilo
▪ <username> is the default user opc.

en am
▪ <public-ip-address> is the public IP address of the instance.

lic z (c
13. You are now connected to the instance IAD-FA-LAB06-1-VM-01. Run the following
ble e
ra ch
command to display information about the block devices:

fe án
ns S
$ lsblk
tra ro
Note: You will only see the boot disk sda.

n- To
no dro
n
eja
Al
ilo
m
Ca

Create a Block Volume
The OCI Block Volume service lets you dynamically provision and manage block storage
volumes.
In this practice, you will learn how to create a block volume.
a
Tasks
as
)h
. om
2. Open the Main Menu and click Storage. Under Block Storage, click Block Volumes.
ide ail.c
3. Click Create Block Volume.
Gu m
4. Fill in the required volume information:
is g
th @
e an
a. Name: Enter IAD-FA-LAB06-1-BV-01.
us os
to tor
se ilo
c. Availability Domain: Select the first availability domain.

en am
d. Volume Size and Performance: Select Custom and specify the following:
lic z (c
Volume Size (in GB): Enter 50.

ble e
1)
ra ch
fe án
2) Target Volume Performance: Drag the VPUs/GB slider to the left to make the
ns S
performance Lower Cost.

tra ro
n- To
e. Backup Policies: Do not specify any policy.

no dro
f. Cross Region Replication: Keep the OFF default selection.

n
eja
g. Encryption: Keep the default Encrypt using Oracle-managed keys selection.

Al
5. Click Create Block Volume. You now see that the Block Volume state becomes Available.
ilo
m
Ca

Attach a Block Volume to a Compute Instance
You can create, attach, connect, and move volumes. You can also change volume
performance, as needed, to meet your storage, performance, and application requirements.
After you attach and connect a volume to an instance, you can use the volume like a regular
hard drive.
a
In this practice, you’ll learn how to attach a block volume to a compute instance and perform
as
various configuration tasks on the attached volume.
)h
. om
Tasks
ide ail.c
1. Open the Main Menu and click Compute. Under Compute, click Instances.
Gu m
is g
2. In the Instances list, click the instance IAD-FA-LAB06-1-VM-01.
th @
e an
3. In the left navigation pane, under Resources, click Attached block volumes.
us os
4. Click Attach block volume. to tor
se ilo
5. Specify the volume you want to attach to. For example, to use the volume name,
en am
choose Select volume, and then select the volume IAD-FA-LAB06-1-BV-01 from
lic z (c
the Volume drop-down list.

ble e
ra ch
6. If the instance supports consistent device paths, and the volume you are attaching is not a
fe án
boot volume, select the path /dev/oracleoci/oraclevdb from the Device path drop-
down list. This enables you to specify a device path for the volume attachment that
ns S
tra ro
remains consistent between instance reboots.

n- To
7. In the Attachment type section, select Paravirtualized.

no dro
Note: After you attach a volume using the Paravirtualized attachment type, it is ready to
n
eja
use, and you do not need to run any additional commands.

Al
8. In the Access section, select Read/Write.

ilo
m
Note: This is the default option for volume attachments and, with this option, an instance
Ca
can read and write data to the volume.
9. Click Attach. You now see the state as Attached and, since the attachment type
is Paravirtualized, you can use the volume without running any additional commands.

10. Ensure that you are connected to the instance IAD-FA-LAB06-1-VM-01.
Note: For help with this, refer to Step 11 in the Create a VM Instance practice.
11. Run the following command to display information about the block devices:
$ lsblk
a
Note: You now see that the system recognizes a new disk device, and the size is 50 GB.
as
)h
12. To verify that the volume is attached to the instance, run the following command:
. om
$ ll /dev/oracleoci/oraclevd*
ide ail.c
13. To partition the disk using fdisk, run the following command:
Gu m
is g
$ sudo fdisk /dev/oracleoci/oraclevdb
th @
e an
Note: Enter the following responses as seen in Cloud Shell:
us os
a.
to tor
Command (m for help): Enter n to create a new partition.
se ilo
Select (default p): Enter p.

en am
b.
lic z (c
c. Partition number (1,4, default 1): Press Enter.

ble e
ra ch
d. First sector: Press Enter.

fe án
e. Last sector: Press Enter.

ns S
tra ro
f. Command (m for help): Enter w to write the new partition.

n- To
no dro
14. To format the partition, run the following command:

n
$ sudo mkfs -t ext4 /dev/oracleoci/oraclevdb1

eja
Al
15. To mount the partition, run the following commands:

ilo
$ sudo mkdir -p /mnt/volume1

m
Ca
$ sudo mount /dev/oracleoci/oraclevdb1 /mnt/volume1
Note: On Linux instances, if you want to automatically mount volumes on an instance

boot, you need to set some specific options in the /etc/fstab file.

16. To display information about the block devices, run the following command:
$ lsblk
Note: You now see the partition and the mountpoint /mnt/volume1.
a
as
)h
. om
ide ail.c
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca

Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os
e an
th @
Lab 7-1 Practices
is g
Gu m
Security Zones
ide ail.c
. om
)h
as
a
Zones Using Maximum
Security: Configure Security
Get Started
Overview
Security zones enforce security posture on OCI cloud compartments and prevent actions that
can compromise a customer’s security posture. Security zone policies can be applied to
various cloud infrastructure types (network, compute, storage, database, and so on) to
a
guarantee cloud resources ensure security and to prevent potential misconfigurations.
as
)h
. om
Set up a security zone with Maximum Security Recipe
ide ail.c
a.
View the security zone policies attached to a created security zone
Gu m
b.
is g
th @
c. Test creating a bucket in an assigned compartment using an Oracle-managed key
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
68 Configure Security Zones using Maximum Security Zones

Prerequisites

• Your tenancy should have Cloud Guard enabled.
Assumptions
a
as
• In this lab, we are considering US East (Ashburn) (IAD) as your region.
)h
. om
ide ail.c
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca
Configure Security Zones using Maximum Security Zones 69

Set Up Security Zone with Maximum Security Recipe
You will create a security zone for an allocated compartment and check for any security zone
policy violations.
Tasks
a
as
)h
. om
ide ail.c
3. From the navigation menu, select Identity & Security. Navigate to Security Zones, and
then click Overview.
Gu m
is g
th @
4. In the left navigation pane, under Scope, select <your assigned compartment> from the
e an
drop-down menu.
us os
to tor
Note: The compartment should not be associated with a security zone. By default, all sub-
compartments are also in the same security zone.
se ilo
en am
5. Click Create Security Zone.

lic z (c
6. On the Create Security Zone page, enter the following values:

ble e
ra ch
a. Security Zone Recipe: Select Oracle-managed to use Maximum Security Recipe.

fe án
ns S
b. Name: IAD-FA-LAB07-1-SZ-01
tra ro
n- To
c. Description: My Security Zone

no dro
d. Create for compartment: <your assigned compartment>

n
eja
7. Click Create Security Zone.

Al
Note: When you create a security zone for a compartment, Cloud Guard does the
ilo
following:
m
Ca
• Deletes any existing Cloud Guard target for the compartment and for any child
compartments
• Creates a security zone target for the compartment
• Adds the default Oracle-managed detector recipes to the security zone target

View the Security Zone Policies Attached with a Created
Security Zone
You will identify the recipe associated with the newly formed security zone, and then review its
policies.
1. From the navigation menu, select Identity & Security. Navigate to Security Zones, and
a
then click Overview.
as
)h
2. In the left navigation pane, under Scope, select <your assigned compartment> from the
. om
drop-down menu.
ide ail.c
3. Click the IAD-FA-LAB07-1-SZ-01 security zone and view the Security Zone details page.
Gu m
is g
4. On the Security Zone information tab, locate the attached recipe and click the Recipe for
th @
this security zone: Maximum Security Recipe – 20200914.
e an
us os
5. View the Oracle-managed recipe attached to the Security Zone created on the Recipe
details page.
to tor
se ilo
View a few policy statements with associated Resource types:

en am
6.
deny public_subnets in VIRTUALNETWORK
lic z (c
deny public_buckets in OBJECTSTORAGE

ble e
deny buckets_without_vault_key in in OBJECTSTORAGE

ra ch
fe án
Next, you will put a security zone to test by attempting to violate a few of its policies.
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca

Verify Creating a Bucket in an Assigned Compartment
Using a Oracle-Managed Key

You will test the security zone. Create a bucket to check if it is restricted in the security zone.
As a reference, the security zone recipe has a policy that prohibits bucket creation without a
customer-managed vault key.
a
To create a bucket to observe the security zone violations:
as
)h
1. Open the navigation menu and click Storage. Navigate Object Storage, click Buckets.
. om
In the left navigation pane, under List Scope, select the assigned compartment from the
ide ail.c
2.
drop-down menu.
Gu m
is g
3. Click Create Bucket.
th @
e an
4. In the Create Bucket dialog box, specify the attributes of the bucket:
us os
a. to tor
Bucket Name: IAD-FA-LAB07-1-BKT-01-<user-id>
se ilo
Please specify your user ID in place of <user-id> to make it unique.

en am
b. Default Storage Tier: Standard

lic z (c
Encryption: Encrypt using Oracle-managed keys.

ble e
c.
ra ch
fe án
Note: Leave all the other options in their default setting.

ns S
Click Create.
tra ro
5.
n- To
You will receive an error indicating a security zone violation: “Encrypt the bucket with a
no dro
customer-managed encryption key”.

n
Click Cancel.
eja
6.
Al
The security zone recipe created earlier has a policy that prohibits bucket creation without a
ilo
customer-managed key. You will need to create an OCI Vault and a master encryption key,
m
using which you can create a bucket. This way the security zone recipes enforce security
Ca
posture on OCI cloud compartments and prevent actions that could compromise the security
posture of a customer.
Note: Please purge the Security Zone created for this lab.

Purge Security Zone
1. From the navigation menu, select Identity & Security. Navigate to Security Zones and
click Overview.
2. Make sure you are in your given compartment.
a
3. From the list of Security Zones, locate your Security Zone and click its name: IAD-FA-
as
LAB07-1-SZ-01.
)h
4. Click Delete. Then click Delete in the Confirmation window.
. om
ide ail.c
Gu m
is g
th @
e an
us os
to tor
se ilo
en am
lic z (c
ble e
ra ch
fe án
ns S
tra ro
n- To
no dro
n
eja
Al
ilo
m
Ca

74
Ca
m
ilo
Al
eja
n
no dro
n- To
tra ro
ns S
fe án
ra ch
ble e
lic z (c
en am
se ilo
to tor
us os

e an
th @
is g
Gu m
ide ail.c
. om
)h
as
a
Configure Security Zones using Maximum Security Zones

Oracle Cloud Infrastructure Foundations (Activity Guide)

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Oracle Cloud Infrastructure Foundations (Activity Guide)

Uploaded by

Copyright:

Available Formats

Unauthorized reproduction or distribution prohibited. Copyright© 2023, Oracle University and/or its affiliates.

Learn more from Oracle University at education.oracle.com

Oracle Cloud Infrastructure

of The Open Group.

Third-Party Content, Products, and Services Disclaimer

Create a Policy (Without Identity Domains Enabled) ..................................................................... 19

Create a Dynamic Group (Without Identity Domains Enabled) ...................................................... 20

Get Started ..................................................................................................................................... 22

Create a Virtual Cloud Network ...................................................................................................... 24

Networking: OCI Load Balancer ..................................................................................................... 27

Get Started ..................................................................................................................................... 28

Create a Virtual Cloud Network ...................................................................................................... 30

Create Two Compute Instances (Backend Servers) ...................................................................... 31

Create a Load Balancer.................................................................................................................. 34

Compute: Create a Web Server on an OCI Compute Instance .................................................... 37

Get Started ..................................................................................................................................... 38

Launch Cloud Shell ........................................................................................................................ 39

Generate SSH Keys ....................................................................................................................... 40

Create a Virtual Cloud Network and Its Components .................................................................... 42

Create a Compute Instance ........................................................................................................... 45

Copyright © 2023, Oracle and/or its affiliates.

Oracle Cloud Infrastructure Foundations – Table of Contents iii

Block Storage: Create, and Attach a Block Volume ..................................................................... 55

Copyright © 2023, Oracle and/or its affiliates.

iv Oracle Cloud Infrastructure Foundations – Table of Contents

e. Create a dynamic group

Copyright © 2023, Oracle and/or its affiliates.

Copyright © 2023, Oracle and/or its affiliates.

A compartment is a collection of related resources. Compartments are fundamental

In this practice, you will learn how to create a compartment.

b. Description: Enter a compartment-related description.

c. Parent Compartment: The compartment you are in appears by default.

Copyright © 2023, Oracle and/or its affiliates.

A user is an individual employee or system that needs to manage or use your

In this practice, you’ll learn how to create a user.

a. First Name: Enter first name of user.

b. Last Name: Enter last name of user.

c. Username/Email: Enter an email address for the user.

Assign cloud account administrator role check box.

6. Click Create. The user now appears in the list of users.

Copyright © 2023, Oracle and/or its affiliates.

Identity Domains Enabled)

8. Enter the following:

a. Name: Enter a unique name for the group.

b. Description: Enter a group-related description.

9. Click Create. The group now appears in the list of groups.

Copyright © 2023, Oracle and/or its affiliates.

In this practice, you’ll learn how to create a policy.

attached controls who can later modify or delete it.

Note: A sample statement would look like the following:

allow group <group_name> to manage virtual-network-family in

5. Click Create. The policy now appears in the list of policies.

Copyright © 2023, Oracle and/or its affiliates.

Click Create Dynamic Group.

5. Enter the following:

in your tenancy, including dynamic groups and user groups.

b. Description: Enter a friendly description.

a. Rule 1: Enter a rule by following the guidelines in https://docs.oracle.com/en-

b. Enter additional rules as needed. To add a rule, click +Additional Rule.

Copyright © 2023, Oracle and/or its affiliates.

e. Create a dynamic group

Copyright © 2023, Oracle and/or its affiliates.

Copyright © 2023, Oracle and/or its affiliates.

In this practice, you will learn how to create a compartment.