diegoecab/oci-deal-accelerator
1
1
Fork 2
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
eef213612c8e81afff72d18f301dd5317c2b76e6
oci-deal-accelerator/kb/diagram/assets/archcenter-refs/data-safe-exadata-adb/_description.md
root b30a4f0d32 Diagram generation: ref-arch-driven procedure + spec validator + KB enrichment 
The diagram path now follows a documented standard procedure (lookup
the closest Oracle Architecture Center reference → confirm components
→ author absolute_layout → spec validator → render → visually verify)
and ships persistent guardrails so layout regressions can't recur.

Persistent procedure changes (apply to all users, all sessions):
- tools/diagram_spec_validator.py — geometry checks (CONTAINER_TOO_THIN,
  CONTAINER_PADDING_VIOLATION, LABEL_OVERFLOW_PARENT) run BEFORE either
  renderer (drawio + PPTX). Catches the subnet-collapse / label-overflow
  bugs that the post-render drawio validator missed.
- tools/oci_diagram_gen.py + tools/oci_pptx_diagram_gen.py — call the
  spec validator before emitting any output. Adds mysql / mysql_heatwave
  type aliases.
- tools/archcenter_pattern_lookup.py — scores against cached page
  descriptions (not just the 1-line summary), supports --queries for
  multi-fragment composition, and applies synonym expansion via
  kb/architecture-center/synonyms.yaml so "LB HA cross AD" matches
  "load balancer high availability availability domain".
- kb/architecture-center/synonyms.yaml — canonical synonym table
  (load balancer, autonomous database, data guard, …) used by the
  lookup scorer.

KB enrichment:
- tools/archcenter_description_fetcher.py + 121 cached _description.md
  under kb/diagram/assets/archcenter-refs/<slug>/. Removes the runtime
  dependency on docs.oracle.com when authoring specs and feeds the
  pattern-lookup scorer.
- 110+ cached .drawio / .svg / .png references for offline reuse,
  plus the OCI Toolkit v24.2 import (kb/diagram/assets/oci-toolkit-drawio).

Documentation:
- docs/skill/output-formats.md — new "Standard diagram-generation
  procedure (MANDATORY)" + geometry rules + the new validator entry.
- SKILL.md option 2 — references the mandatory procedure.
- README.md — describes the spec validator, archcenter_pattern_lookup
  and description fetcher, and updates the KB-health table.

Tooling that backs the procedure (cumulative across recent sessions):
tools/archcenter_case_runner.py, archcenter_batch_driver.py,
archcenter_zip_downloader.py, drawio_visual_validator.py,
drawio_fidelity_eval.py, harvest_drawio_icon.py, import_oci_library.py,
oci_pptx_diagram_gen.py, oci_pptx_render.py, refresh_pptx_icon_index.py.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-25 21:15:21 -03:00

8.3 KiB
Raw Blame History

Implement Oracle Data Safe for Exadata and Autonomous Databases

Summary (catalog)

Data Safe deployment for ExaCS and ADB. Security assessment, user assessment, activity auditing, data masking, and data discovery. Private endpoint connectivity for databases in private subnets.

Architecture (fetched from source)

Architecture

This reference architecture outlines the following target databases and the way Data Safe connects to these databases:

  • Exadata Database Service or Exadata Cloud@Customer / Regional Cloud@Customer / Dedicated Region

  • Autonomous Databases

This reference architecture only discusses databases with private IP addresses. To configure a database with a public IP address is from a security perspective not advised.

For each different deployment of Data Safe discussed here, you should also deploy a landing zone in your tenancy. The following resources provide best practices for security and compliance, landing zone concepts and deployment of a landing zone on Oracle Cloud Infrastructure using terraform scripts:

  • Well-architected framework for Oracle Cloud Infrastructure

  • Deploy a secure landing zone that meets the CIS Foundations Benchmark for Oracle Cloud

  • CIS Compliant OCI Landing Zones (GitHub repository)

Note: Please refer to the Explore More topic below for access to these resources.

Exadata Database Service or Exadata Cloud@Customer

Oracle Exadata Database Service provides the Oracle Exadata Database Machine as a service in an Oracle Cloud Infrastructure (OCI) data center.

Exadata Cloud@Customer, a managed service, provides an Exadata Database Service that is hosted in the on-premises data center.

Exadata Database Service

The Exadata Database Service does not need to connect to the on-premises network because it is deployed on OCI and can therefor use the Private end-point directly. After setting up the necessary connectivity, the databases can be configured as targets in Data Safe using the wizard.

Exadata Cloud@Customer

To connect a Exadata Cloud@Customer target database there are two options :

  • On-premises connector

  • Private end-point

In the following diagram, the connections are shown between the Oracle Cloud and the on-premises data center. The diagram shows the options to choose from. If there is a site-to-site VPN or OCI FastConnect connection you can use a private endpoint to connect to your Exadata Cloud@Customer target Data Safe databases. If there is no VPN or OCI FastConnect, then you can deploy an on-premises connector to connect to your Exadata Cloud@Customer target Data Safe databases. This on-premises connector will then connect to Data Safe via a TLS tunnel.

Description of the illustration data-safe-exa-adb.png

data-safe-exa-adb-oracle.zip

Be aware that as shown in the diagram, an outgoing, persistent, secure automation tunnel connects the CPS infrastructure in the on-premises data center to the Oracle-managed admin VCN in the OCI region for delivering cloud automation commands to the VM clusters. This is a outgoing tunnel for the CPS infrastructure and can not be used for Data Safe connections. For more information see the link below on 'Architecture Exadata Cloud@Customer'.

The Exadata Cloud@Customer environment is supported by Oracle using the Oracle Operator Access Control (OpCtl). OpCtl is an OCI privileged access management (PAM) service that gives customers a technical mechanism to better control how Oracle staff can access their Exadata Cloud@Customer (ExaC@C) infrastructure. For a detailed reading on this see the link Oracle Operator Access Control link below. The following resources describe the architectures and setup in detail:

  • Architecture Exadata Cloud@Customer

  • Architecture Exadata Database Service

  • Setup Cloud@Customer database using private endpoint

  • Setup Cloud@Customer database using the wizard

  • Simplify Security for your on-premises Oracle Databases with Oracle Data Safe

  • Exadata Database Service Security Controls

Note: Please refer to the Explore More topic below for access to these resources.

Autonomous Databases

Autonomous database on shared infrastructure is available with Data Safe. Autonomous databases can be registered through the wizard or by a single click from the Autonomous database details page. The steps to connect the autonomous database for the Dedicated Region Cloud@Customer are discussed in this part of the Data Safe documentation.

Architecture Components

These architectures have the following components:

  • Tenancy

Oracle Autonomous Transaction Processing is a self-driving, self-securing, self-repairing database service that is optimized for transaction processing workloads. You do not need to configure or manage any hardware, or install any software. Oracle Cloud Infrastructure handles creating the database, as well as backing up, patching, upgrading, and tuning the database.

  • Region

An Oracle Cloud Infrastructure region is a localized geographic area that contains one or more data centers, called availability domains. Regions are independent of other regions, and vast distances can separate them (across countries or even continents).

  • Compartment

Compartments are cross-region logical partitions within an Oracle Cloud Infrastructure tenancy. Use compartments to organize your resources in Oracle Cloud, control access to the resources, and set usage quotas. To control access to the resources in a given compartment, you define policies that specify who can access the resources and what actions they can perform.

  • Availability domains

Availability domains are standalone, independent data centers within a region. The physical resources in each availability domain are isolated from the resources in the other availability domains, which provides fault tolerance. Availability domains don’t share infrastructure such as power or cooling, or the internal availability domain network. So, a failure at one availability domain is unlikely to affect the other availability domains in the region.

  • Fault domains

A fault domain is a grouping of hardware and infrastructure within an availability domain. Each availability domain has three fault domains with independent power and hardware. When you distribute resources across multiple fault domains, your applications can tolerate physical server failure, system maintenance, and power failures inside a fault domain.

  • Virtual cloud network (VCN) and subnets

A VCN is a customizable, software-defined network that you set up in an Oracle Cloud Infrastructure region. Like traditional data center networks, VCNs give you complete control over your network environment. A VCN can have multiple non-overlapping CIDR blocks that you can change after you create the VCN. You can segment a VCN into subnets, which can be scoped to a region or to an availability domain. Each subnet consists of a contiguous range of addresses that don't overlap with the other subnets in the VCN. You can change the size of a subnet after creation. A subnet can be public or private.

  • Load balancer The Oracle Cloud Infrastructure Load Balancing service provides automated traffic distribution from a single entry point to multiple servers in the back end. The load balancer provides access to different applications.

  • Security list For each subnet, you can create security rules that specify the source, destination, and type of traffic that must be allowed in and out of the subnet.

  • NAT gateway

The NAT gateway enables private resources in a VCN to access hosts on the internet, without exposing those resources to incoming internet connections.

  • Service gateway

The service gateway provides access from a VCN to other services, such as Oracle Cloud Infrastructure Object Storage. The traffic from the VCN to the Oracle service travels over the Oracle network fabric and never traverses the internet.

  • Cloud Guard

You can use Oracle Cloud Guard to monitor and maintain the security of your resources in Oracle Cloud Inf

Reference in New Issue View Git Blame Copy Permalink