DevSecOps in Oracle Cloud

Erik Benner is the vice president of Enterprise Transformation at Mythics, LLC, and an Oracle ACE Director. He is an expert strategist for both federal, state, and local government, as well as commercial customers across the United States. His customer engagements range from enterprise cloud transformations and data center modernization to large-scale virtualization projects and Oracle Engineered Systems implementations. Erik’s passion for volunteering is evident through his role as the president of the Cloud Computing Special Interest Group (SIG), co-chair of the OATUG Oracle Enterprise Manager SIG, and active participation in user groups sitting on various committees. He frequently presents at conferences such as Oracle CloudWorld, Oracle FedForum, East Coast Oracle, ASCEND, and Blueprint4d. Having worked with Oracle and Sun Systems since the mid-’90s, Erik is well-versed in most of the core Oracle technologies, including Oracle Cloud, Oracle Linux, and Oracle Databases.When not flying to the far points of the country from the Atlanta metro area, he enjoys spending time with his family at their observatory, where the telescopes outnumber the people, or on cloudy nights blowing glass in his private glass studio.Ahmed Aboulnaga has a professional focus in technical management, architecture, and consulting within Oracle, Java, and cloud technologies, having implemented enterprise solutions for commercial, government, and global customers throughout his career. Ahmed is an Oracle ACE, published author, and frequently presents on new and trending technologies at major conferences. Currently residing in the Washington DC region, Ahmed holds a master’s degree in computer science from George Mason University.Dhrumil Patel is a Solutions Architect at Mythics, LLC. He works closely with the sales and engineering team to provide Oracle Cloud Infrastructure (OCI), thought leadership, and solutioning expertise. He also works with Oracle and internal/external clients to develop highly automated and efficient digital transformation processes and cloud migration processes. Prior to his current role, he held the position of Senior Principal Consultant. He worked with his clients to administer and maintain their on-premises and cloud environments’ footprints. Moreover, he has years of experience as a DBA Consultant.

• Introduction xxiiChapter 1 Introduction to OCI and DevSecOps 1What Is DevSecOps? 4Why DevSecOps? 5What Makes Up a DevSecOps Team? 6Benefits of OCI 7OCI Free Services 9Summary 10Chapter 2 Oracle Cloud Infrastructure—Governance 11Tenancy Account Management and Governance 11Creating a New Tenancy 12Organizational Governance 15Cloud Advisor 20Cost Management 22Performance 24High Availability 25Billing and Budgets 26Dashboards 32Summary 36Chapter 3 Oracle IaaS—Security 37Identity and Access Management (IAM) 37Security Zones 39Bastions 44Threat Intelligence Service 49Web Application Firewall (WAF) 54Firewall 65Vault 80Audit 84Summary 87Chapter 4 Oracle IaaS—Cloud-NativeTechnologies 89Functions 90Setting Up the Tenancy 91Creating the Application 92Setting Up the Linux Host 95Creating and Running a Function 104Streams 107Events 108Oracle Kubernetes Engine (OKE) 112Docker 113Key Terms 113Summary 119Chapter 5 Oracle IaaS—Network 121Getting Started with OCI Networking 121Understanding Concepts and Terminology 121Walking Through a Basic Network Architecture Diagram 122Creating Your First VCN and Subnet 124Creating a VCN 124Creating a Subnet 125Updating the Security List 126Connecting VCNs Through Local Peering 127Creating Local Peering Gateways and Establishing Peering 128Adding a New Route Rule to the Route Table 129Creating Network Security Groups (NSGs) 130Attaching VNIC to the Network Security Group 131Creating Flow Logs 132Using Network Path Analyzer 133Understanding Gateways 136Securing Your Network 136Summary 137Chapter 6 Oracle IaaS—Compute 139Building a VM 139X86 and ARM, AMD vs. Intel… What’s the Scoop? 145A VM Is More Than a VM; There Are Options… 147OS Images and the Marketplace 153Custom OS Images 160Summary 163Chapter 7 Oracle IaaS—Storage 165Block Volume 166Creating and Attaching 166Configuring Performance 169Performing a Backup 172Object Storage 175File Storage 176Archive Storage 179How to Secure Your Storage 179Summary 181Chapter 8 Oracle DBaaS—Databases 183Oracle’s DBaaS Offerings 183Database as a Base Database Service 186Exadata Cloud Service and Exadata Cloud@Customer 186Autonomous Database Services 187MySQL and MySQL HeatWave 189NoSQL 190How to Provision Databases 191Provisioning Base Database Service 191Provisioning the Autonomous Database Service 196Provisioning MySQL Database 199Provisioning the NoSQL Database 204Summary 205Chapter 9 OCI DevOps Service 207Overview of OCI DevOps 208Deployment Environments 210Deployment Strategies 210DevOps Components and Resources 211How to Create a Working Sample Project 214Creating Compute Instances to Deploy To 215Granting Permissions to Compute Instance Run Command Plug 215Creating an Artifact Registry to Host Artifacts 216Uploading a Script to the Artifact Registry 216Creating a Notification Topic 218Creating a DevOps Project 218Creating an Environment in the DevOps Project 218Adding an Artifact from the Artifact Registry to the DevOps Project 219Adding an Instance Group Deployment Configuration Artifact 220Creating a Deployment Pipeline 222Running the Deployment Pipeline 222Summary 224Chapter 10 Data Safe 225Security Assessment 225User Assessment 228Data Discovery 230Data Masking 236Activity Auditing 241Alerts 243How to Add a Database 244Registering an Autonomous Database 245Registering an Oracle Base Database System 247Registering an On-Premises Database 253Summary 255Chapter 11 Identity and Access Management 257Compartments 257Users 258Database Passwords 258API Keys 263Groups 269Dynamic Groups 269Policies 273Federation 277Summary 292Chapter 12 Operating System Security 293Oracle Ksplice 293Oracle Autonomous Linux 296Vulnerability Scanning Service (VSS) 298Summary 301Chapter 13 Observability and Management 303OCI Logging Service 303Log Format 303Log Types 305Log Groups 307Exercise 1: Enabling a Service Log 307Exercise 2: Creating a Custom Log 311Oracle Cloud Logging Analytics 313Setting Up Logging Analytics for the First Time 313Downloading and Installing the Management Agent 317Clearing and Resetting Logging Analytics 320Summary 320Chapter 14 Cloud Guard 321Initial Configuration 322Recipe Management 331Using Detector Recipes 331Using Responder Recipes 332Accessing Cloud Guard Recipes 332Managing Detector Recipes 333Managing Responder Recipes 334Security Zones 338Adding a New Security Zone 340Summary 343Chapter 15 An Introduction to Ansible 345What Is Ansible? 345What Is OLAM? 346Sizing the Deployment 348OCI Authentication 350Getting the OCI Information 350Adding the OLAM Credential 353Collections and Modules 354Installing the OCI Collection on Your OCI Development System 354Playbooks 356Introduction to YAML 359Summary 362Chapter 16 Using Ansible in OCI 363Using Ansible 363Writing Playbooks 363Sample Playbooks 369Common OCI Playbooks 374Summary 382Chapter 17 Ansible—Installing and ConfiguringOLAM 383Installation 383Preparing Linux 383Setting Up PostgreSQL 385Installing OLAM 387OLAM Management 392Resource Management 394Templates 395Credentials 399Projects 401Inventory 403Hosts 408Access Management 410Organizations 410Users 412Teams 414OLAM Administrative Options 416Credential Types 416Notifications 417Management Jobs 418Instance Groups 420Applications 420Execution Environments 420Summary 421Chapter 18 Ansible Full Stack Sample 423Ansible in the Real World 423Planning a Team 423Creating Users 423Creating Teams 426Setting Up an Inventory 439Summary 451Chapter 19 Infrastructure as Code 453The Problem That IaC Solves 454Introducing Terraform as an IaC Tool 454Terraform Concepts and Terminology 455Declarative Approach 457State File 457Immutable Infrastructure 457Plug-ins 458Terraform and OCI 459Terraform Best Practices 459Summary 460Chapter 20 Terraform API with Examples 461Setting Up Terraform in OCI 461Downloading and Installing Terraform 461Creating RSA Keys Required for API Signing 463Adding a Policy for the User to Read OCI Resources 465Exercise 1: Running Terraform for the First Time 466Creating a Working Directory 466Creating an Initial Terraform Script 466Running Terraform Initialize for the First Time 467Running terraform plan for the First Time 468Running terraform apply for the First Time 469Exercise 2: Parameterizing Terraform Configuration 471Exercise 3: Understanding the Terraform OCI Documentation 473Updating Terraform Configuration from the Terraform OCI Documentation 474Running the Terraform Script to Create and List a Block Volume 478Updating a Resource 482Parameterizing from Other Output 483Debugging Errors 484Summary 485Chapter 21 Terraform Sample Use Case 487Confirming IAM Policies 489Setting Up Terraform 489Applying the Changes 490Creating a New Compartment 490Applying the Changes 491Rerunning Terraform Apply with No Changes 491Rerunning Terraform Apply After a Change in Terraform Configuration 493Rerunning Terraform Apply After a Change on the OCI Console 494Creating a Virtual Cloud Network 494Defining a VCN Module 494Defining Security Lists and Ingress/Egress Rules 495Defining the Private and Public Subnets 498Updating the Outputs File 499Applying the Changes 500Creating a Compute Instance 502Applying the Changes 504Creating an Autonomous Database 505Applying the Changes 506Replicating to a Production Environment 507Using Other Terraform Commands 508Formatting Terraform Configuration 508Validating Terraform Configuration 508Listing All Resources in the Terraform State 508Displaying Details of All Resources from the Terraform State 509Viewing the Terraform Output 510Destroying Resources 510Destroying the Entire Infrastructure 511Destroying a Single Terraform Resource 511Stopping/Starting Instances with Terraform 511Summary 512Chapter 22 Enterprise Manager Cloud ControlInstallation 515Installing and Configuring the Repository Database 517Installing and Configuring Oracle Management Service 522OPatch 526Oracle Enterprise Manager 13cUpdate 12 for OMS 526Oracle Enterprise Manager 13cRelease 5 Update 12 for Oracle Management Agent 527Installing and Configuring Oracle Analytics Server 529Installing JDK 529Installing FMWInfrastructure 530Installing OAS 531Configuring OAS 532Integrating OAS with Oracle Enterprise Manager 534Configuring Security Infrastructure 534Configuring the Required OAS Datasource 537Setting OAS Support for Oracle Enterprise Manager-Provided Reports 538Summary 546Chapter 23 Using Oracle Enterprise Manager Cloud Control 547Setting Up Administrators and Users 551Monitoring OCI Environments 554Monitoring OCI Compute Instance 554Monitoring OCI Autonomous Database 558Integrating Oracle Enterprise Manager with OCI 564Setting Up Preferred Credentials 564Creating an Enterprise Manager Target Group 568Creating an Oracle Enterprise Manager Super Administrator 569Creating a Global Named Credential 570Incorporating Best Practices 578Monitoring Database Security 579Patching Oracle Enterprise Manager 579Sizing Oracle Enterprise Manager 580Summary 581 9780138029418 TOC 4/11/2025