blockmine 1.21.0 → 1.23.0

package/.claude/skills/cloud-engineering/resources/oci-patterns.md

@@ -0,0 +1,1198 @@
+# Oracle Cloud Infrastructure (OCI) Patterns
+
+Comprehensive guide to Oracle Cloud Infrastructure covering core services, architectural patterns, and best practices for building scalable, reliable, and secure cloud infrastructure on OCI.
+
+## Table of Contents
+
+- [OCI Service Overview](#oci-service-overview)
+- [Compute Services](#compute-services)
+- [Storage Services](#storage-services)
+- [Database Services](#database-services)
+- [Networking Services](#networking-services)
+- [Container and Kubernetes Services](#container-and-kubernetes-services)
+- [Serverless Services](#serverless-services)
+- [Identity and Security](#identity-and-security)
+- [Monitoring and Management](#monitoring-and-management)
+- [Common Patterns](#common-patterns)
+- [Best Practices](#best-practices)
+- [Anti-Patterns](#anti-patterns)
+
+## OCI Service Overview
+
+### Service Categories
+
+```
+Compute:         Compute Instances, Bare Metal, Container Engine (OKE), Functions
+Storage:         Object Storage, Block Volumes, File Storage, Archive Storage
+Database:        Autonomous Database, Base Database, MySQL, PostgreSQL, NoSQL
+Networking:      VCN, Load Balancer, FastConnect, DNS, VPN, Service Gateway
+Security:        IAM, Vault, Bastion, WAF, Cloud Guard
+Monitoring:      Monitoring, Logging, Events, Notifications, APM
+DevOps:          DevOps Service, Resource Manager (Terraform), API Gateway
+Analytics:       Data Integration, Data Flow, Analytics Cloud
+```
+
+### OCI Regions and Availability Domains
+
+```
+Region:              Geographic area (e.g., us-ashburn-1, uk-london-1)
+Availability Domain: Isolated data centers within region (AD-1, AD-2, AD-3)
+Fault Domain:        Logical grouping within AD for high availability
+```
+
+## Compute Services
+
+### Compute Instances
+
+**VM Shapes:**
+```
+Standard (VM.Standard):      General purpose workloads
+DenseIO (VM.DenseIO):        High local NVMe storage
+GPU (VM.GPU):                ML training, graphics rendering
+HPC (BM.HPC):                High-performance computing
+Bare Metal (BM.Standard):    No virtualization overhead
+Flexible (VM.Standard.E4.Flex): Custom CPU/memory ratio
+```
+
+**Example: Compute Instance with Terraform:**
+```hcl
+# compute_instance.tf
+resource "oci_core_instance" "app_server" {
+  availability_domain = data.oci_identity_availability_domain.ad1.name
+  compartment_id      = var.compartment_id
+  display_name        = "app-server-${var.environment}"
+  shape               = "VM.Standard.E4.Flex"
+
+  # Flexible shape configuration
+  shape_config {
+    ocpus         = 2
+    memory_in_gbs = 16
+  }
+
+  # Boot volume
+  create_vnic_details {
+    subnet_id        = oci_core_subnet.private.id
+    assign_public_ip = false
+    hostname_label   = "app-server"
+  }
+
+  source_details {
+    source_type = "image"
+    source_id   = data.oci_core_images.oracle_linux.images[0].id
+    boot_volume_size_in_gbs = 100
+  }
+
+  # Cloud-init configuration
+  metadata = {
+    ssh_authorized_keys = file("~/.ssh/id_rsa.pub")
+    user_data           = base64encode(file("${path.module}/cloud-init.yaml"))
+  }
+
+  # High availability
+  fault_domain = "FAULT-DOMAIN-1"
+
+  # Tags
+  freeform_tags = {
+    Environment = var.environment
+    ManagedBy   = "terraform"
+    Application = "web-app"
+  }
+}
+
+# Instance pool for auto-scaling
+resource "oci_core_instance_pool" "app_pool" {
+  compartment_id = var.compartment_id
+  display_name   = "app-instance-pool"
+
+  instance_configuration_id = oci_core_instance_configuration.app.id
+
+  placement_configurations {
+    availability_domain = data.oci_identity_availability_domain.ad1.name
+    primary_subnet_id   = oci_core_subnet.private.id
+
+    fault_domains = [
+      "FAULT-DOMAIN-1",
+      "FAULT-DOMAIN-2",
+      "FAULT-DOMAIN-3"
+    ]
+  }
+
+  size = 3
+
+  load_balancers {
+    backend_set_name = oci_load_balancer_backend_set.app.name
+    load_balancer_id = oci_load_balancer_load_balancer.public.id
+    port             = 8080
+    vnic_selection   = "PrimaryVnic"
+  }
+}
+
+# Auto-scaling configuration
+resource "oci_autoscaling_auto_scaling_configuration" "app" {
+  compartment_id       = var.compartment_id
+  display_name         = "app-autoscaling"
+  auto_scaling_resources {
+    id   = oci_core_instance_pool.app_pool.id
+    type = "instancePool"
+  }
+
+  policies {
+    display_name = "cpu-based-autoscaling"
+    policy_type  = "threshold"
+    capacity {
+      initial = 3
+      max     = 10
+      min     = 2
+    }
+
+    rules {
+      display_name = "scale-out-rule"
+      action {
+        type  = "CHANGE_COUNT_BY"
+        value = 1
+      }
+      metric {
+        metric_type = "CPU_UTILIZATION"
+        threshold {
+          operator = "GT"
+          value    = 75
+        }
+      }
+    }
+
+    rules {
+      display_name = "scale-in-rule"
+      action {
+        type  = "CHANGE_COUNT_BY"
+        value = -1
+      }
+      metric {
+        metric_type = "CPU_UTILIZATION"
+        threshold {
+          operator = "LT"
+          value    = 25
+        }
+      }
+    }
+  }
+}
+```
+
+### Bare Metal Instances
+
+**When to Use:**
+- No virtualization overhead for maximum performance
+- Oracle Database workloads
+- Compliance requirements
+- Large memory requirements (up to 2TB)
+
+```hcl
+resource "oci_core_instance" "bare_metal_db" {
+  availability_domain = data.oci_identity_availability_domain.ad1.name
+  compartment_id      = var.compartment_id
+  display_name        = "oracle-db-server"
+  shape               = "BM.Standard2.52"  # 52 OCPUs, 768 GB memory
+
+  create_vnic_details {
+    subnet_id = oci_core_subnet.database.id
+  }
+
+  source_details {
+    source_type = "image"
+    source_id   = data.oci_database_db_system_shapes.db_shapes.db_system_shapes[0].id
+  }
+
+  # Local NVMe storage
+  launch_options {
+    boot_volume_type = "ISCSI"
+  }
+}
+```
+
+## Storage Services
+
+### Object Storage
+
+**Storage Tiers:**
+```
+Standard:    Frequent access, immediate availability
+Infrequent:  Accessed less than once per month, 90-day retention
+Archive:     Long-term retention, restore time required
+```
+
+**Example: Object Storage Bucket:**
+```hcl
+# object_storage.tf
+resource "oci_objectstorage_bucket" "application_data" {
+  compartment_id = var.compartment_id
+  namespace      = data.oci_objectstorage_namespace.ns.namespace
+  name           = "application-data-${var.environment}"
+  access_type    = "NoPublicAccess"
+
+  # Versioning for data protection
+  versioning = "Enabled"
+
+  # Storage tier
+  storage_tier = "Standard"
+
+  # Object lifecycle policy
+  retention_rules {
+    display_name = "retention-policy"
+    duration {
+      time_amount = 90
+      time_unit   = "DAYS"
+    }
+  }
+
+  # Automatic tiering
+  auto_tiering = "InfrequentAccess"
+
+  freeform_tags = {
+    Environment = var.environment
+    DataClass   = "sensitive"
+  }
+}
+
+# Pre-authenticated request for temporary access
+resource "oci_objectstorage_preauthrequest" "temporary_upload" {
+  namespace    = data.oci_objectstorage_namespace.ns.namespace
+  bucket       = oci_objectstorage_bucket.application_data.name
+  name         = "temp-upload-link"
+  access_type  = "ObjectWrite"
+  time_expires = timeadd(timestamp(), "24h")
+  object_name  = "uploads/"
+}
+```
+
+### Block Volumes
+
+**Volume Types:**
+```
+Balanced:           Baseline performance, cost-effective
+Higher Performance: Increased IOPS and throughput
+Ultra High:         Maximum performance for critical workloads
+```
+
+**Example: Block Volume with Backup:**
+```hcl
+# block_volume.tf
+resource "oci_core_volume" "application_data" {
+  availability_domain = data.oci_identity_availability_domain.ad1.name
+  compartment_id      = var.compartment_id
+  display_name        = "app-data-volume"
+  size_in_gbs         = 500
+
+  # Performance tier
+  vpus_per_gb = 20  # Higher performance
+
+  # Encryption
+  is_auto_tune_enabled = true
+
+  # Volume groups for consistent backups
+  volume_group_id = oci_core_volume_group.app.id
+}
+
+# Attach to instance
+resource "oci_core_volume_attachment" "app_data_attachment" {
+  attachment_type = "paravirtualized"
+  instance_id     = oci_core_instance.app_server.id
+  volume_id       = oci_core_volume.application_data.id
+  device          = "/dev/oracleoci/oraclevdb"
+}
+
+# Backup policy
+resource "oci_core_volume_backup_policy_assignment" "app_backup" {
+  asset_id  = oci_core_volume.application_data.id
+  policy_id = data.oci_core_volume_backup_policies.default_policies.volume_backup_policies[0].id
+}
+```
+
+### File Storage Service (FSS)
+
+**Example: NFS File System:**
+```hcl
+# file_storage.tf
+resource "oci_file_storage_file_system" "shared_storage" {
+  availability_domain = data.oci_identity_availability_domain.ad1.name
+  compartment_id      = var.compartment_id
+  display_name        = "shared-application-storage"
+}
+
+resource "oci_file_storage_mount_target" "mount_target" {
+  availability_domain = data.oci_identity_availability_domain.ad1.name
+  compartment_id      = var.compartment_id
+  subnet_id           = oci_core_subnet.private.id
+  display_name        = "mount-target-ad1"
+
+  hostname_label = "fss-mt"
+}
+
+resource "oci_file_storage_export" "export" {
+  export_set_id  = oci_file_storage_mount_target.mount_target.export_set_id
+  file_system_id = oci_file_storage_file_system.shared_storage.id
+  path           = "/shared"
+
+  export_options {
+    source                         = "10.0.0.0/16"
+    access                         = "READ_WRITE"
+    identity_squash                = "NONE"
+    require_privileged_source_port = false
+  }
+}
+```
+
+## Database Services
+
+### Autonomous Database
+
+**Database Workload Types:**
+```
+ATP (Transaction Processing):  OLTP workloads
+ADW (Data Warehouse):          Analytics and reporting
+APEX:                          Low-code application development
+AJD (JSON):                    JSON document store
+```
+
+**Example: Autonomous Database:**
+```hcl
+# autonomous_database.tf
+resource "oci_database_autonomous_database" "app_db" {
+  compartment_id           = var.compartment_id
+  db_name                  = "APPDB"
+  display_name             = "application-database-${var.environment}"
+  admin_password           = var.db_admin_password
+  db_workload              = "OLTP"  # ATP
+  cpu_core_count           = 2
+  data_storage_size_in_tbs = 1
+
+  # Auto-scaling
+  is_auto_scaling_enabled = true
+  is_auto_scaling_for_storage_enabled = true
+
+  # High availability
+  is_dedicated = false
+  is_free_tier = false
+
+  # Network access
+  subnet_id                    = oci_core_subnet.database.id
+  nsg_ids                      = [oci_core_network_security_group.db.id]
+  is_mtls_connection_required  = true
+
+  # Backup configuration
+  is_data_guard_enabled = true
+  db_version            = "19c"
+
+  # License
+  license_model = "LICENSE_INCLUDED"
+
+  freeform_tags = {
+    Environment = var.environment
+    DatabaseType = "autonomous"
+  }
+}
+
+# Autonomous Database backup
+resource "oci_database_autonomous_database_backup" "manual_backup" {
+  autonomous_database_id = oci_database_autonomous_database.app_db.id
+  display_name           = "manual-backup-${formatdate("YYYY-MM-DD", timestamp())}"
+}
+```
+
+### MySQL Database Service
+
+**Example: MySQL HeatWave:**
+```hcl
+# mysql_database.tf
+resource "oci_mysql_mysql_db_system" "app_mysql" {
+  compartment_id      = var.compartment_id
+  shape_name          = "MySQL.VM.Standard.E4.4.64GB"
+  subnet_id           = oci_core_subnet.database.id
+  availability_domain = data.oci_identity_availability_domain.ad1.name
+
+  admin_password = var.mysql_admin_password
+  admin_username = "admin"
+
+  # High availability
+  is_highly_available = true
+
+  # Data storage
+  data_storage_size_in_gb = 100
+
+  # Backup
+  backup_policy {
+    is_enabled        = true
+    retention_in_days = 7
+    window_start_time = "02:00"
+  }
+
+  # HeatWave cluster for analytics
+  is_heat_wave_cluster_attached = true
+  heat_wave_cluster {
+    shape_name = "MySQL.HeatWave.VM.Standard.E3"
+    cluster_size = 2
+  }
+
+  display_name = "mysql-db-${var.environment}"
+
+  freeform_tags = {
+    Environment = var.environment
+  }
+}
+```
+
+## Networking Services
+
+### Virtual Cloud Network (VCN)
+
+**Example: Production VCN with Multiple Tiers:**
+```hcl
+# vcn.tf
+resource "oci_core_vcn" "production" {
+  compartment_id = var.compartment_id
+  cidr_blocks    = ["10.0.0.0/16"]
+  display_name   = "production-vcn"
+  dns_label      = "prodvcn"
+
+  is_ipv6enabled = false
+
+  freeform_tags = {
+    Environment = "production"
+  }
+}
+
+# Internet Gateway for public subnets
+resource "oci_core_internet_gateway" "public" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.production.id
+  display_name   = "internet-gateway"
+  enabled        = true
+}
+
+# NAT Gateway for private subnets
+resource "oci_core_nat_gateway" "private" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.production.id
+  display_name   = "nat-gateway"
+  block_traffic  = false
+}
+
+# Service Gateway for OCI services
+resource "oci_core_service_gateway" "oci_services" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.production.id
+  display_name   = "service-gateway"
+
+  services {
+    service_id = data.oci_core_services.all_services.services[0].id
+  }
+}
+
+# Public subnet
+resource "oci_core_subnet" "public" {
+  compartment_id      = var.compartment_id
+  vcn_id              = oci_core_vcn.production.id
+  cidr_block          = "10.0.1.0/24"
+  display_name        = "public-subnet"
+  dns_label           = "public"
+  route_table_id      = oci_core_route_table.public.id
+  security_list_ids   = [oci_core_security_list.public.id]
+  prohibit_public_ip_on_vnic = false
+}
+
+# Private subnet (application tier)
+resource "oci_core_subnet" "private_app" {
+  compartment_id      = var.compartment_id
+  vcn_id              = oci_core_vcn.production.id
+  cidr_block          = "10.0.10.0/24"
+  display_name        = "private-app-subnet"
+  dns_label           = "app"
+  route_table_id      = oci_core_route_table.private.id
+  security_list_ids   = [oci_core_security_list.private_app.id]
+  prohibit_public_ip_on_vnic = true
+}
+
+# Private subnet (database tier)
+resource "oci_core_subnet" "private_db" {
+  compartment_id      = var.compartment_id
+  vcn_id              = oci_core_vcn.production.id
+  cidr_block          = "10.0.20.0/24"
+  display_name        = "private-db-subnet"
+  dns_label           = "db"
+  route_table_id      = oci_core_route_table.private.id
+  security_list_ids   = [oci_core_security_list.private_db.id]
+  prohibit_public_ip_on_vnic = true
+}
+
+# Route tables
+resource "oci_core_route_table" "public" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.production.id
+  display_name   = "public-route-table"
+
+  route_rules {
+    network_entity_id = oci_core_internet_gateway.public.id
+    destination       = "0.0.0.0/0"
+    destination_type  = "CIDR_BLOCK"
+  }
+}
+
+resource "oci_core_route_table" "private" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.production.id
+  display_name   = "private-route-table"
+
+  route_rules {
+    network_entity_id = oci_core_nat_gateway.private.id
+    destination       = "0.0.0.0/0"
+    destination_type  = "CIDR_BLOCK"
+  }
+
+  route_rules {
+    network_entity_id = oci_core_service_gateway.oci_services.id
+    destination       = data.oci_core_services.all_services.services[0].cidr_block
+    destination_type  = "SERVICE_CIDR_BLOCK"
+  }
+}
+```
+
+### Load Balancer
+
+**Example: Public Load Balancer with Health Checks:**
+```hcl
+# load_balancer.tf
+resource "oci_load_balancer_load_balancer" "public" {
+  compartment_id = var.compartment_id
+  display_name   = "public-load-balancer"
+  shape          = "flexible"
+
+  shape_details {
+    minimum_bandwidth_in_mbps = 10
+    maximum_bandwidth_in_mbps = 100
+  }
+
+  subnet_ids = [
+    oci_core_subnet.public.id
+  ]
+
+  is_private = false
+
+  freeform_tags = {
+    Environment = var.environment
+  }
+}
+
+# Backend set
+resource "oci_load_balancer_backend_set" "app" {
+  load_balancer_id = oci_load_balancer_load_balancer.public.id
+  name             = "app-backend-set"
+  policy           = "ROUND_ROBIN"
+
+  health_checker {
+    protocol          = "HTTP"
+    port              = 8080
+    url_path          = "/health"
+    return_code       = 200
+    interval_ms       = 10000
+    timeout_in_millis = 3000
+    retries           = 3
+  }
+
+  session_persistence_configuration {
+    cookie_name = "APP_SESSION"
+  }
+}
+
+# SSL certificate
+resource "oci_load_balancer_certificate" "ssl_cert" {
+  load_balancer_id = oci_load_balancer_load_balancer.public.id
+  certificate_name = "ssl-certificate"
+
+  ca_certificate     = file("${path.module}/certs/ca.crt")
+  private_key        = file("${path.module}/certs/server.key")
+  public_certificate = file("${path.module}/certs/server.crt")
+}
+
+# HTTPS listener
+resource "oci_load_balancer_listener" "https" {
+  load_balancer_id         = oci_load_balancer_load_balancer.public.id
+  name                     = "https-listener"
+  default_backend_set_name = oci_load_balancer_backend_set.app.name
+  port                     = 443
+  protocol                 = "HTTP"
+
+  ssl_configuration {
+    certificate_name        = oci_load_balancer_certificate.ssl_cert.certificate_name
+    verify_peer_certificate = false
+    protocols               = ["TLSv1.2", "TLSv1.3"]
+  }
+
+  connection_configuration {
+    idle_timeout_in_seconds = 300
+  }
+}
+```
+
+## Container and Kubernetes Services
+
+### Container Engine for Kubernetes (OKE)
+
+**Example: Production OKE Cluster:**
+```hcl
+# oke_cluster.tf
+resource "oci_containerengine_cluster" "app_cluster" {
+  compartment_id     = var.compartment_id
+  kubernetes_version = "v1.27.2"
+  name               = "app-cluster-${var.environment}"
+  vcn_id             = oci_core_vcn.production.id
+
+  # Cluster endpoint configuration
+  endpoint_config {
+    is_public_ip_enabled = false
+    subnet_id            = oci_core_subnet.kubernetes_api.id
+    nsg_ids              = [oci_core_network_security_group.k8s_api.id]
+  }
+
+  # Options
+  options {
+    service_lb_subnet_ids = [oci_core_subnet.public.id]
+
+    # Add-ons
+    add_ons {
+      is_kubernetes_dashboard_enabled = false
+      is_tiller_enabled               = false
+    }
+
+    # Admission controllers
+    admission_controller_options {
+      is_pod_security_policy_enabled = true
+    }
+
+    # Kubernetes network config
+    kubernetes_network_config {
+      pods_cidr     = "10.244.0.0/16"
+      services_cidr = "10.96.0.0/16"
+    }
+
+    # Persistent volume config
+    persistent_volume_config {
+      freeform_tags = {
+        Environment = var.environment
+      }
+    }
+  }
+
+  freeform_tags = {
+    Environment = var.environment
+  }
+}
+
+# Node pool
+resource "oci_containerengine_node_pool" "app_node_pool" {
+  cluster_id         = oci_containerengine_cluster.app_cluster.id
+  compartment_id     = var.compartment_id
+  kubernetes_version = "v1.27.2"
+  name               = "app-node-pool"
+  node_shape         = "VM.Standard.E4.Flex"
+
+  node_shape_config {
+    ocpus         = 2
+    memory_in_gbs = 16
+  }
+
+  # Multi-AD placement
+  node_config_details {
+    placement_configs {
+      availability_domain = data.oci_identity_availability_domain.ad1.name
+      subnet_id           = oci_core_subnet.kubernetes_workers.id
+
+      fault_domains = [
+        "FAULT-DOMAIN-1",
+        "FAULT-DOMAIN-2",
+        "FAULT-DOMAIN-3"
+      ]
+    }
+
+    size = 3
+
+    # Node pool options
+    is_pv_encryption_in_transit_enabled = true
+
+    # Freeform tags for nodes
+    freeform_tags = {
+      Environment = var.environment
+      NodePool    = "app"
+    }
+
+    node_pool_pod_network_option_details {
+      cni_type = "FLANNEL_OVERLAY"
+    }
+  }
+
+  # Image
+  node_source_details {
+    image_id    = data.oci_containerengine_node_pool_option.oke_node_pool_option.sources[0].image_id
+    source_type = "IMAGE"
+  }
+
+  # SSH access
+  ssh_public_key = file("~/.ssh/id_rsa.pub")
+
+  # Initial node labels
+  initial_node_labels {
+    key   = "environment"
+    value = var.environment
+  }
+}
+```
+
+## Serverless Services
+
+### Functions
+
+**Example: OCI Function:**
+```yaml
+# func.yaml
+schema_version: 20180708
+name: process-image
+version: 0.0.1
+runtime: python
+entrypoint: /python/bin/fdk /function/func.py handler
+memory: 256
+timeout: 120
+```
+
+```python
+# func.py
+import io
+import json
+import oci
+from fdk import response
+
+def handler(ctx, data: io.BytesIO = None):
+    signer = oci.auth.signers.get_resource_principals_signer()
+    object_storage = oci.object_storage.ObjectStorageClient(config={}, signer=signer)
+
+    try:
+        body = json.loads(data.getvalue())
+        bucket_name = body.get("bucketName")
+        object_name = body.get("objectName")
+
+        # Process object
+        namespace = object_storage.get_namespace().data
+        obj = object_storage.get_object(namespace, bucket_name, object_name)
+
+        # Your processing logic here
+        result = process_data(obj.data.content)
+
+        return response.Response(
+            ctx,
+            response_data=json.dumps({"status": "success", "result": result}),
+            headers={"Content-Type": "application/json"}
+        )
+    except Exception as e:
+        return response.Response(
+            ctx,
+            response_data=json.dumps({"status": "error", "message": str(e)}),
+            headers={"Content-Type": "application/json"},
+            status_code=500
+        )
+
+def process_data(content):
+    # Your data processing logic
+    return {"processed": True}
+```
+
+**Terraform Configuration:**
+```hcl
+# functions.tf
+resource "oci_functions_application" "app" {
+  compartment_id = var.compartment_id
+  display_name   = "image-processing-app"
+  subnet_ids     = [oci_core_subnet.private_app.id]
+
+  config = {
+    STORAGE_NAMESPACE = data.oci_objectstorage_namespace.ns.namespace
+  }
+
+  freeform_tags = {
+    Environment = var.environment
+  }
+}
+
+resource "oci_functions_function" "process_image" {
+  application_id = oci_functions_application.app.id
+  display_name   = "process-image"
+  image          = "${var.ocir_region}.ocir.io/${data.oci_objectstorage_namespace.ns.namespace}/process-image:0.0.1"
+  memory_in_mbs  = 256
+  timeout_in_seconds = 120
+
+  config = {
+    BUCKET_NAME = oci_objectstorage_bucket.images.name
+  }
+}
+```
+
+## Identity and Security
+
+### Identity and Access Management (IAM)
+
+**Example: Compartment Structure and Policies:**
+```hcl
+# iam.tf
+# Root compartment structure
+resource "oci_identity_compartment" "production" {
+  compartment_id = var.tenancy_ocid
+  description    = "Production environment"
+  name           = "production"
+}
+
+resource "oci_identity_compartment" "network" {
+  compartment_id = oci_identity_compartment.production.id
+  description    = "Network resources"
+  name           = "network"
+}
+
+resource "oci_identity_compartment" "compute" {
+  compartment_id = oci_identity_compartment.production.id
+  description    = "Compute resources"
+  name           = "compute"
+}
+
+# Dynamic group for instance principals
+resource "oci_identity_dynamic_group" "app_instances" {
+  compartment_id = var.tenancy_ocid
+  description    = "Application instances"
+  name           = "app-instances"
+  matching_rule  = "ALL {instance.compartment.id = '${oci_identity_compartment.compute.id}'}"
+}
+
+# Policy for instance principals
+resource "oci_identity_policy" "app_instances_policy" {
+  compartment_id = oci_identity_compartment.production.id
+  description    = "Policy for application instances"
+  name           = "app-instances-policy"
+
+  statements = [
+    "Allow dynamic-group app-instances to manage objects in compartment production",
+    "Allow dynamic-group app-instances to read secret-bundles in compartment production",
+    "Allow dynamic-group app-instances to use metrics in compartment production"
+  ]
+}
+
+# User group
+resource "oci_identity_group" "developers" {
+  compartment_id = var.tenancy_ocid
+  description    = "Developer group"
+  name           = "developers"
+}
+
+# Policy for developers
+resource "oci_identity_policy" "developers_policy" {
+  compartment_id = oci_identity_compartment.production.id
+  description    = "Developer permissions"
+  name           = "developers-policy"
+
+  statements = [
+    "Allow group developers to manage all-resources in compartment production where request.permission != 'COMPARTMENT_DELETE'",
+    "Allow group developers to read audit-events in compartment production",
+    "Allow group developers to use cloud-shell in tenancy"
+  ]
+}
+```
+
+### Vault and Key Management
+
+**Example: Vault with Encryption Keys:**
+```hcl
+# vault.tf
+resource "oci_kms_vault" "production_vault" {
+  compartment_id = var.compartment_id
+  display_name   = "production-vault"
+  vault_type     = "DEFAULT"
+
+  freeform_tags = {
+    Environment = "production"
+  }
+}
+
+# Master encryption key
+resource "oci_kms_key" "database_encryption_key" {
+  compartment_id = var.compartment_id
+  display_name   = "database-encryption-key"
+
+  key_shape {
+    algorithm = "AES"
+    length    = 32
+  }
+
+  management_endpoint = oci_kms_vault.production_vault.management_endpoint
+
+  protection_mode = "HSM"  # Hardware Security Module
+}
+
+# Secret for database password
+resource "oci_vault_secret" "db_password" {
+  compartment_id = var.compartment_id
+  secret_name    = "database-admin-password"
+  vault_id       = oci_kms_vault.production_vault.id
+  key_id         = oci_kms_key.database_encryption_key.id
+
+  secret_content {
+    content_type = "BASE64"
+    content      = base64encode(var.db_admin_password)
+  }
+}
+```
+
+## Monitoring and Management
+
+### Monitoring and Alarms
+
+**Example: Monitoring and Alerting:**
+```hcl
+# monitoring.tf
+# Alarm for high CPU
+resource "oci_monitoring_alarm" "high_cpu" {
+  compartment_id        = var.compartment_id
+  display_name          = "high-cpu-alarm"
+  is_enabled            = true
+  metric_compartment_id = var.compartment_id
+  namespace             = "oci_computeagent"
+  query                 = "CpuUtilization[1m].mean() > 80"
+  severity              = "CRITICAL"
+
+  destinations = [oci_ons_notification_topic.alerts.id]
+
+  repeat_notification_duration = "PT2H"
+
+  body = "CPU utilization is above 80% for instances in production"
+
+  freeform_tags = {
+    Environment = "production"
+  }
+}
+
+# Notification topic
+resource "oci_ons_notification_topic" "alerts" {
+  compartment_id = var.compartment_id
+  name           = "production-alerts"
+}
+
+# Email subscription
+resource "oci_ons_subscription" "email_alerts" {
+  compartment_id = var.compartment_id
+  endpoint       = "ops-team@example.com"
+  protocol       = "EMAIL"
+  topic_id       = oci_ons_notification_topic.alerts.id
+}
+
+# Slack webhook subscription
+resource "oci_ons_subscription" "slack_alerts" {
+  compartment_id = var.compartment_id
+  endpoint       = var.slack_webhook_url
+  protocol       = "HTTPS_CUSTOM"
+  topic_id       = oci_ons_notification_topic.alerts.id
+}
+```
+
+### Logging
+
+**Example: Log Groups and Logs:**
+```hcl
+# logging.tf
+resource "oci_logging_log_group" "application_logs" {
+  compartment_id = var.compartment_id
+  display_name   = "application-log-group"
+}
+
+# VCN flow logs
+resource "oci_logging_log" "vcn_flow_logs" {
+  display_name = "vcn-flow-logs"
+  log_group_id = oci_logging_log_group.application_logs.id
+  log_type     = "SERVICE"
+
+  configuration {
+    source {
+      category    = "all"
+      resource    = oci_core_vcn.production.id
+      service     = "flowlogs"
+      source_type = "OCISERVICE"
+    }
+
+    compartment_id = var.compartment_id
+  }
+
+  is_enabled         = true
+  retention_duration = 30
+}
+
+# Load balancer access logs
+resource "oci_logging_log" "lb_access_logs" {
+  display_name = "lb-access-logs"
+  log_group_id = oci_logging_log_group.application_logs.id
+  log_type     = "SERVICE"
+
+  configuration {
+    source {
+      category    = "access"
+      resource    = oci_load_balancer_load_balancer.public.id
+      service     = "loadbalancer"
+      source_type = "OCISERVICE"
+    }
+
+    compartment_id = var.compartment_id
+  }
+
+  is_enabled         = true
+  retention_duration = 30
+}
+```
+
+## Common Patterns
+
+### Pattern 1: Multi-Tier Web Application
+
+```
+┌─────────────────────────────────────────────────┐
+│              Internet Gateway                    │
+└────────────────┬────────────────────────────────┘
+                 │
+┌────────────────▼────────────────────────────────┐
+│         Public Subnet (Load Balancer)           │
+│  ┌──────────┐  ┌──────────┐  ┌──────────┐      │
+│  │   LB-1   │  │   LB-2   │  │  Bastion │      │
+│  └──────────┘  └──────────┘  └──────────┘      │
+└────────────────┬────────────────────────────────┘
+                 │
+┌────────────────▼────────────────────────────────┐
+│      Private Subnet (Application Tier)          │
+│  ┌──────────┐  ┌──────────┐  ┌──────────┐      │
+│  │  App-1   │  │  App-2   │  │  App-3   │      │
+│  └──────────┘  └──────────┘  └──────────┘      │
+└────────────────┬────────────────────────────────┘
+                 │
+┌────────────────▼────────────────────────────────┐
+│       Private Subnet (Database Tier)            │
+│         ┌───────────────────┐                   │
+│         │ Autonomous DB     │                   │
+│         │ (Multi-AD)        │                   │
+│         └───────────────────┘                   │
+└─────────────────────────────────────────────────┘
+```
+
+### Pattern 2: Disaster Recovery with Cross-Region Replication
+
+```hcl
+# Primary region (Phoenix)
+provider "oci" {
+  alias  = "phoenix"
+  region = "us-phoenix-1"
+}
+
+# DR region (Ashburn)
+provider "oci" {
+  alias  = "ashburn"
+  region = "us-ashburn-1"
+}
+
+# Primary Autonomous Database
+resource "oci_database_autonomous_database" "primary" {
+  provider = oci.phoenix
+  # ... configuration
+
+  is_data_guard_enabled = true
+}
+
+# Object Storage replication
+resource "oci_objectstorage_replication_policy" "cross_region" {
+  bucket            = oci_objectstorage_bucket.primary.name
+  namespace         = data.oci_objectstorage_namespace.ns.namespace
+  name              = "cross-region-replication"
+  destination_bucket_name = oci_objectstorage_bucket.dr.name
+  destination_region_name = "us-ashburn-1"
+}
+```
+
+## Best Practices
+
+### Compartment Design
+
+1. **Hierarchical Structure:**
+   - Root: Tenancy
+   - Level 1: Environment (prod, staging, dev)
+   - Level 2: Workload type (network, compute, database)
+   - Level 3: Application or service
+
+2. **Least Privilege:**
+   - Use dynamic groups for instance principals
+   - Separate compartments for different security zones
+   - Regular policy reviews and audits
+
+### High Availability
+
+1. **Multi-AD Deployment:**
+   - Distribute resources across all availability domains
+   - Use fault domains within ADs
+   - Regional subnets for automatic failover
+
+2. **Backup and Recovery:**
+   - Enable automatic backups for databases
+   - Use volume groups for consistent snapshots
+   - Test recovery procedures regularly
+
+### Cost Optimization
+
+1. **Right-Sizing:**
+   - Use flexible shapes for variable workloads
+   - Leverage auto-scaling
+   - Monitor resource utilization
+
+2. **Reserved Capacity:**
+   - Purchase capacity reservations for steady workloads
+   - Use burstable instances for development
+
+3. **Storage Tiering:**
+   - Move infrequently accessed data to lower tiers
+   - Enable auto-tiering for Object Storage
+   - Archive old backups
+
+### Security
+
+1. **Network Security:**
+   - Use Network Security Groups (NSGs) instead of Security Lists
+   - Implement micro-segmentation
+   - Enable VCN flow logs
+
+2. **Encryption:**
+   - Enable encryption at rest for all data
+   - Use customer-managed keys in Vault
+   - Encrypt data in transit with TLS
+
+3. **Identity Management:**
+   - Enable MFA for all users
+   - Use federation for SSO
+   - Regular access reviews
+
+## Anti-Patterns
+
+❌ **Single AD deployment** - No fault tolerance
+❌ **Overprovisioning** - Wasting capacity and cost
+❌ **Using Security Lists only** - Less granular than NSGs
+❌ **No tagging strategy** - Can't track costs or resources
+❌ **Manual infrastructure** - Use Resource Manager (Terraform)
+❌ **Ignoring backup policies** - Risk of data loss
+❌ **Exposing databases publicly** - Security risk
+❌ **No monitoring** - Can't detect issues proactively
+❌ **Weak IAM policies** - Too permissive access
+❌ **Ignoring service limits** - Plan for growth
+
+## Related Resources
+
+- [OCI Documentation](https://docs.oracle.com/en-us/iaas/Content/home.htm)
+- [OCI Terraform Provider](https://registry.terraform.io/providers/oracle/oci/latest/docs)
+- [OCI Architecture Center](https://docs.oracle.com/solutions/)
+- [OCI CLI Reference](https://docs.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/)
+
+---
+
+**Note:** This guide covers Oracle Cloud Infrastructure patterns and best practices. For multi-cloud strategies including OCI, see [multi-cloud-strategies.md](multi-cloud-strategies.md).