# OCI Deal Accelerator — Proposal Spec
# Demo: Pharma Mexico — ExaCS migration from on-prem Exadata X6
# Prompt 1: Full proposal

metadata:
  customer: "PharmaCorp Mexico"
  project: "Oracle Database Migration to OCI"
  subtitle: "ExaCS Migration — Exadata X6 to OCI"
  architect: "Carlos Mendoza"
  firm: "Oracle Cloud Infrastructure"
  date: "2026-04-12"

summary:
  why: >
    PharmaCorp Mexico operates 3 Oracle databases (EBS R12, SAP, DW) on on-premises
    Exadata X6 hardware approaching end-of-life. Hardware refresh costs $1.8M and
    locks into 5 more years of on-prem operations. Migration to OCI ExaCS provides
    30%+ cost reduction, eliminates hardware lifecycle management, improves DR posture
    (RPO<15min, RTO<1h), and enables SOX compliance alignment with Oracle-managed
    infrastructure patching.
  current_state:
    - "3 Oracle DBs on Exadata X6 (EBS R12 prod, SAP, Data Warehouse)"
    - "200 concurrent users, peak during fiscal close"
    - "2TB total data across all databases"
    - "No DR — single site in Mexico City data center"
    - "Manual patching quarterly — SOX audit finding pending"
    - "HW refresh due in 6 months ($1.8M quote)"
  target_state: >
    OCI ExaCS X11M in Queretaro (prod) with Data Guard standby in Sao Paulo for
    cross-region DR. Hub-spoke networking via DRG, dual FastConnect 10Gbps for
    redundancy, WAF for web applications, OCI Vault for TDE key management.
    SOX compliance via automated patching and audit logging.
  timeline: "Migration Q3-Q4 2026 (16 weeks) — conditional on board approval Q2"

service_tiering:
  - name: "EBS R12 Production"
    tier: "Platinum"
    uptime: "99.99%"
    rto: "1 hour"
    rpo: "15 minutes"
    justification: "Business-critical ERP — fiscal close depends on this"
  - name: "SAP Database"
    tier: "Gold"
    uptime: "99.95%"
    rto: "4 hours"
    rpo: "1 hour"
    justification: "Critical but lower user count"
  - name: "Data Warehouse"
    tier: "Silver"
    uptime: "99.9%"
    rto: "8 hours"
    rpo: "4 hours"
    justification: "Reporting — can tolerate longer recovery"

architecture_principles:
  design:
    - id: "D-01"
      name: "Operational Simplicity"
      summary: "Prefer managed services with automated patching"
      rationale: "SOX requires documented patching — ExaCS automates this"
    - id: "D-05"
      name: "HA for Business Continuity"
      summary: "Design for HA proportional to business impact"
      rationale: "EBS is Platinum tier — needs cross-region DR"
    - id: "D-06"
      name: "Defense in Depth"
      summary: "Multiple security layers, not single perimeter"
      rationale: "SOX compliance requires network segmentation + encryption + audit"
  deployment:
    - id: "P-01"
      name: "Infrastructure as Code"
      summary: "All infrastructure defined in Terraform"
      rationale: "Reproducible environments, audit trail for SOX"

architecture:
  description: >
    Dual-region ExaCS deployment: Queretaro (primary) + Sao Paulo (DR standby).
    Hub-spoke networking with DRG provides segmented VCNs for each workload tier.
    Dual FastConnect 10Gbps from Mexico City provides redundant connectivity.
    WAF protects EBS web tier. OCI Vault manages TDE encryption keys externally.

    Key components:
    - ExaCS X11M Quarter Rack in Queretaro (3 databases)
    - Data Guard to ExaCS standby in Sao Paulo (EBS + SAP)
    - Hub VCN with DRG for inter-spoke routing
    - Dual FastConnect 10Gbps from Mexico City DC
    - WAF for EBS R12 web access
    - OCI Vault for TDE key management (SOX)
    - OCI Logging + Audit for compliance
  visual:
    regions:
      - name: "Queretaro (Primary)"
        services:
          - name: "ExaCS X11M (3 DBs)"
            type: "database"
          - name: "Hub VCN + DRG"
            type: "networking"
          - name: "WAF"
            type: "security"
          - name: "OCI Vault"
            type: "security"
      - name: "Sao Paulo (DR)"
        services:
          - name: "ExaCS Standby (Data Guard)"
            type: "database"
          - name: "Spoke VCN"
            type: "networking"

decisions:
  - title: "ExaCS over ADB-S"
    decision: "Use ExaCS instead of ADB-S for all 3 databases"
    rationale: >
      EBS R12 requires OS-level access for patches and customizations.
      SAP on Oracle requires specific Oracle features not available on ADB-S.
      DW benefits from ExaCS storage performance. All 3 share the same
      Exadata infrastructure for cost efficiency.
    alternatives: "ADB-S (rejected — EBS needs OS access), DBCS (rejected — no Exadata performance)"

  - title: "Cross-Region DR with Data Guard"
    decision: "Active Data Guard from Queretaro to Sao Paulo"
    rationale: >
      RPO<15min requires real-time redo shipping. Sao Paulo provides geographic
      separation for disaster scenarios. Data Guard supports automatic failover
      with FSDR for RTO<1h.
    alternatives: "Backup/restore (rejected — RPO 24h), Same-region standby (no geo separation)"

  - title: "Hub-Spoke Networking"
    decision: "Hub VCN with DRG for inter-spoke routing and segmentation"
    rationale: >
      SOX requires network segmentation between environments. Hub-spoke with DRG
      provides centralized security controls (WAF, NSG) while isolating workloads.
    alternatives: "Flat VCN (rejected — no segmentation for SOX)"

  - title: "Dual FastConnect"
    decision: "Two 10Gbps FastConnect circuits from Mexico City"
    rationale: >
      Single FastConnect is a documented single point of failure. Dual circuits
      provide redundancy for the EBS production workload.
    alternatives: "Single FastConnect + IPSec VPN backup (acceptable for lower tiers)"

  - title: "OCI Vault for TDE Keys"
    decision: "External key management via OCI Vault instead of Oracle Wallet"
    rationale: >
      SOX requires separation of duties for encryption key management.
      OCI Vault provides FIPS 140-2 Level 3 HSM-backed key storage.
    alternatives: "Oracle Wallet on ExaCS (simpler but no separation of duties)"

ha_dr:
  description: >
    Primary in Queretaro with Active Data Guard to Sao Paulo. FSDR orchestrates
    failover for RTO<1h. EBS and SAP databases replicated; DW rebuilt from backup
    in DR scenario (Silver tier — 8h RTO acceptable).
  tiers:
    - tier: "Platinum — EBS R12"
      technology: "ExaCS + Active Data Guard + FSDR automatic failover"
      rto: "1 hour"
      rpo: "15 minutes"
    - tier: "Gold — SAP"
      technology: "ExaCS + Active Data Guard"
      rto: "4 hours"
      rpo: "1 hour"
    - tier: "Silver — DW"
      technology: "ExaCS + RMAN backup to Object Storage"
      rto: "8 hours"
      rpo: "4 hours"

security:
  controls:
    identity:
      - "OCI IAM with federated identity (SAML 2.0 to corporate AD)"
      - "Separate admin compartments per environment"
      - "MFA required for all admin operations"
      - "Break-glass emergency access procedures"
    network:
      - "Hub-spoke VCN with DRG — workload isolation"
      - "WAF for EBS R12 web tier"
      - "NSG rules per spoke — deny-all default"
      - "Dual FastConnect — no public internet exposure"
    data_protection:
      - "TDE encryption at rest with OCI Vault (FIPS 140-2 L3)"
      - "Encryption in transit (TLS 1.2+ / native Oracle Net encryption)"
      - "Data Guard redo encryption"
    monitoring:
      - "OCI Audit for all API calls (SOX)"
      - "OCI Logging for network flows"
      - "Database Audit with Unified Auditing"
      - "OCI Events + Notifications for security alerts"
  compliance:
    - "SOX — automated patching, audit logging, separation of duties"

environment_catalogue:
  environments:
    - name: "Production (Queretaro)"
      sizing: "ExaCS X11M Quarter Rack — 3 databases (EBS, SAP, DW)"
      isolation: "Dedicated Exadata infrastructure"
      cost_pct: 100
    - name: "DR Standby (Sao Paulo)"
      sizing: "ExaCS X11M Quarter Rack — 2 databases (EBS, SAP standby)"
      isolation: "Dedicated Exadata infrastructure"
      cost_pct: 70
    - name: "Pre-Production"
      sizing: "DBCS VM — reduced sizing for testing"
      isolation: "Shared infrastructure, separate compartment"
      cost_pct: 15
  cost_notes:
    - "DR standby runs at 70% — Active Data Guard requires matching shape"
    - "Pre-prod uses DBCS VMs, not ExaCS — sufficient for functional testing"
    - "Dev/Test environment excluded — customer uses on-prem for dev"

cost:
  line_items:
    - component: "ExaCS X11M Quarter Rack — Queretaro (Prod)"
      monthly_payg: "$18,500"
      monthly_byol: "$8,200"
      notes: "2 DB servers, 3 storage servers, BYOL"
    - component: "ExaCS X11M Quarter Rack — Sao Paulo (DR)"
      monthly_payg: "$18,500"
      monthly_byol: "$8,200"
      notes: "ADG standby, BYOL"
    - component: "ADB-S 16 ECPU (DW alternative — future)"
      monthly_payg: "$2,400"
      monthly_byol: "$1,200"
      notes: "Optional — migrate DW to ADB-S in Phase 2"
    - component: "FastConnect 10Gbps Dual"
      monthly_payg: "$3,060"
      notes: "2 x $1,530/month"
    - component: "OCI Vault"
      monthly_payg: "$500"
      notes: "HSM-backed key management"
    - component: "Object Storage (50TB backup)"
      monthly_payg: "$1,200"
      notes: "RMAN backups + DW backup"
    - component: "WAF + Logging + Monitoring"
      monthly_payg: "$800"
      notes: "WAF for EBS web tier + audit logging"
    - component: "TOTAL"
      monthly_payg: "$45,000"
      monthly_byol: "$23,200"
      notes: "BYOL saves 48%"
  assumptions:
    - "BYOL assumes existing Oracle Database EE licenses with active support"
    - "ExaCS pricing based on current OCI list prices"
    - "DR standby at full rate (ADG requires active compute)"
    - "No middleware licensing included (EBS app tier on compute VMs)"
    - "FastConnect partner charges not included"
  show_byol: true

cost_comparison:
  title: "Cost Comparison: On-Prem HW Refresh vs OCI Migration"
  col_headers: ["Component", "On-Prem Refresh (5yr)", "OCI ExaCS BYOL", "Delta"]
  rows:
    - item: "Infrastructure (hardware/cloud)"
      current: "$1,800,000 upfront"
      oci: "$278,400/yr"
      savings: "Break-even at 3.2 years"
    - item: "Annual Support & Maintenance"
      current: "$220,000/yr"
      oci: "Included in OCI"
      savings: "-100%"
    - item: "DR Infrastructure"
      current: "$0 (no DR today)"
      oci: "$98,400/yr"
      savings: "New capability — no DR today"
    - item: "Data Center (power/cooling/space)"
      current: "$80,000/yr"
      oci: "$0"
      savings: "-100%"
    - item: "DBA Operations (patching)"
      current: "$60,000/yr (part-time DBA)"
      oci: "$0 (automated)"
      savings: "-100%"
    - item: "TOTAL ANNUAL (year 1)"
      current: "$2,160,000"
      oci: "$376,800"
      savings: "-83%"
    - item: "TOTAL 3-YEAR TCO"
      current: "$2,880,000"
      oci: "$1,130,400"
      savings: "-$1.75M (61%)"

migration:
  phases:
    - name: "Phase 1: Foundation"
      duration: "4 weeks"
      milestones:
        - "OCI tenancy + networking provisioned"
        - "ExaCS Quarter Rack deployed in Queretaro"
        - "FastConnect dual circuits active"
        - "OCI Vault + IAM configured"
    - name: "Phase 2: EBS Migration"
      duration: "6 weeks"
      milestones:
        - "EBS R12 database migrated via ZDM"
        - "Data Guard to Sao Paulo configured"
        - "WAF + network security validated"
        - "SOX audit controls verified"
    - name: "Phase 3: SAP + DW Migration"
      duration: "4 weeks"
      milestones:
        - "SAP database migrated"
        - "DW migrated + Data Guard for SAP"
        - "RMAN backup for DW to Object Storage"
    - name: "Phase 4: Cutover + Decommission"
      duration: "2 weeks"
      milestones:
        - "Production cutover (planned downtime window)"
        - "On-prem Exadata X6 decommissioned"
        - "Go-live monitoring active"
  tools:
    - "Oracle Zero Downtime Migration (ZDM)"
    - "Data Guard Broker for DR setup"
    - "FSDR for failover orchestration"
    - "Terraform OCI provider for IaC"
  downtime: "Planned 4-hour maintenance window for final cutover per database"

operational_raci:
  model: "co_managed"
  raci_items:
    - activity: "ExaCS Infrastructure Patching"
      oracle: "R"
      customer: "I"
    - activity: "Database Patching (quarterly)"
      oracle: "C"
      customer: "R"
    - activity: "Data Guard Monitoring"
      oracle: "C"
      customer: "R"
    - activity: "Backup & Recovery"
      oracle: "R"
      customer: "C"
    - activity: "Security (IAM, NSG, Vault)"
      oracle: "C"
      customer: "R"
    - activity: "SOX Audit Evidence"
      oracle: "C"
      customer: "R"
    - activity: "Capacity Planning"
      oracle: "C"
      customer: "R"
    - activity: "Incident Response (Sev1)"
      oracle: "C"
      customer: "R"

risks:
  - risk: "EBS R12 customizations may require OS-level changes post-migration"
    severity: "HIGH"
    probability: "Medium"
    mitigation: "Inventory all customizations pre-migration; test in Pre-Prod"
  - risk: "FastConnect provisioning delay (partner-dependent)"
    severity: "MEDIUM"
    probability: "Medium"
    mitigation: "Start FastConnect provisioning in Phase 1 week 1; IPSec VPN as interim"
  - risk: "SAP certification on ExaCS version"
    severity: "MEDIUM"
    probability: "Low"
    mitigation: "Verify SAP Note for ExaCS X11M support before migration"
  - risk: "Data Guard network latency Queretaro-Sao Paulo"
    severity: "LOW"
    probability: "Low"
    mitigation: "Test redo apply lag; async mode acceptable for SAP (Gold tier)"
  - risk: "SOX audit during migration window"
    severity: "MEDIUM"
    probability: "Medium"
    mitigation: "Maintain dual-write during transition; both systems auditable"

scorecard:
  pillars:
    - name: "Security & Compliance"
      status: "PASS"
      passed: 24
      total: 26
    - name: "Reliability & Resilience"
      status: "PASS_WITH_RECOMMENDATIONS"
      passed: 7
      total: 8
    - name: "Performance & Cost"
      status: "PASS"
      passed: 5
      total: 5
    - name: "Operational Efficiency"
      status: "PASS_WITH_RECOMMENDATIONS"
      passed: 9
      total: 10
    - name: "Distributed Cloud"
      status: "NOT_APPLICABLE"
      passed: 0
      total: 0
  recommendations:
    - "45/49 checks passed — strong architecture for regulated workload"
    - "Add runbook for Data Guard failover testing (quarterly DR drill)"
    - "Consider OCI Database Management for centralized fleet monitoring"
    - "Define capacity growth plan for fiscal close peak periods"

next_steps:
  steps:
    - "Board approval for OCI migration budget — CFO — by 2026-05-15"
    - "Provision OCI tenancy + ExaCS in Queretaro — Carlos Mendoza — by 2026-06-01"
    - "Start FastConnect provisioning with partner — Network team — by 2026-06-01"
    - "EBS customization inventory and Pre-Prod testing — DBA team — by 2026-06-15"
    - "Schedule SOX audit coordination meeting — Compliance — by 2026-06-01"
  contact_info: "Carlos Mendoza — Solutions Architect, Oracle Cloud Infrastructure"