# Troubleshooting

## Terraform Plan Fails Because Of Authentication

Check:

- correct OCIDs
- correct region
- API key fingerprint
- private key path
- IAM permissions to create resources

## Autonomous Database Does Not Accept The Configured Version

Remove or adjust `adb_db_version` in `terraform.tfvars`. Database version availability depends on region, tenancy, and service limits. For a real Oracle Deep Data Security lab, use a version compatible with Oracle AI Database 26ai.

## Autonomous Database Name Already Exists

Autonomous Database `db_name` must be unique in the tenancy and region. If apply fails with a message such as `a database named DDSLAB already exists`, change the value in `terraform.tfvars`:

```hcl
adb_db_name = "DDSLAB2"
```

Then create a new plan. Do not reuse the old `tfplan`:

```bash
rm -f tfplan
terraform plan -out tfplan
terraform apply tfplan
```

If you intended to use an existing Autonomous Database instead of creating a new one, do not apply the Terraform ADB resource. Run the SQL scenario scripts directly against the existing database connection string.

## Bastion Image Is Not Compatible With Shape

When `enable_compute_bastion = true`, the image OCID must be compatible with `bastion_shape` in the selected region. If apply fails with `Shape ... is not valid for image ...`, either:

- set `enable_compute_bastion = false` and use OCI Bastion Service; or
- select a compatible platform image for the configured shape and region.

Example OCI CLI lookup for an Oracle Linux image compatible with `VM.Standard.E5.Flex`:

```bash
oci compute image list \
  --region eu-madrid-1 \
  --compartment-id <compartment_ocid> \
  --operating-system "Oracle Linux" \
  --shape VM.Standard.E5.Flex \
  --sort-by TIMECREATED \
  --sort-order DESC \
  --query 'data[0].id' \
  --raw-output
```

Use the returned OCID in `terraform.tfvars`:

```hcl
bastion_image_ocid = "ocid1.image.oc1.eu-madrid-1..."
```

## Database Is Not Reachable

Check:

- the client is inside the VCN or connected through VPN, FastConnect, or bastion
- NSG allows port `1522`
- wallet and mTLS are configured
- private endpoint DNS resolves correctly

## Scenario SQL Fails

Check:

- database version is compatible with Oracle Deep Data Security
- executor has privileges to create schema objects, end users, data roles, and data grants
- SQL files were executed in the correct order
- previous scenario state was reset

## Reset Does Not Remove Everything

Run the scenario `sql/99_reset.sql` and manually validate remaining objects. In shared environments, confirm before dropping schemas.