The OCI command-line interface (oci) and the Exadata/DB System management CLI (dbaascli) are the tools of choice for automating Oracle database operations on OCI. This article covers real-world scenarios with complete, runnable commands — including the complex case of creating a Data Guard standby when the primary database uses Oracle Key Vault (OKV) for TDE key management.
Reference Environment All commands use the following environment:
Region: eu-frankfurt-1 Compartment: prod-compartment (OCID: ocid1.compartment.oc1..aaaaxxxx) Primary DB System: prod-db-system Hostname: proddb01.prod.subnet.vcn.oraclevcn.com Database: PRODCDB (CDB + PDB: PDB_PROD) Shape: VM.Standard.E4.Flex (4 OCPUs, 60 GB RAM) DB Version: 19.22.0.0 DB Home OCID: ocid1.dbhome.oc1.eu-frankfurt-1.aaaaxxxx Database OCID: ocid1.database.oc1.eu-frankfurt-1.aaaaxxxx Standby DB System: standby-db-system (to be created) Hostname: stbydb01.stby.subnet.vcn.oraclevcn.com AD: AD-2 (primary is AD-1) OKV Server: okv01.prod.example.com (port 5695) OKV Wallet: /etc/oracle/okv/ (on each DB System compute node) Jump/Admin Host: admin01.prod.example.com OCI CLI version: 3.x.x Python: 3.9 Part 1: OCI-CLI — Foundation Commands Install and Configure OCI-CLI # [oracle@admin01.prod.example.com ~] # Install OCI CLI bash -c "$(curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh)" # Configure with API key authentication oci setup config # Prompts: # User OCID: ocid1.user.oc1..aaaaxxxx # Tenancy OCID: ocid1.tenancy.oc1..aaaaxxxx # Region: eu-frankfurt-1 # Generate new API key pair: Y # Key file location: ~/.oci/oci_api_key.pem # Upload the generated public key to OCI Console: Identity → Users → API Keys → Add Useful OCI-CLI Shortcut: Environment Variables # [oracle@admin01.prod.example.com ~] # Set frequently used OCIDs as environment variables export OCI_COMPARTMENT=ocid1.compartment.oc1..aaaaxxxx export OCI_PRIMARY_DB_SYSTEM=ocid1.dbsystem.oc1.eu-frankfurt-1.aaaaxxxx export OCI_PRIMARY_DB=ocid1.database.oc1.eu-frankfurt-1.aaaaxxxx export OCI_PRIMARY_DB_HOME=ocid1.dbhome.oc1.eu-frankfurt-1.aaaaxxxx export OCI_REGION=eu-frankfurt-1 # Also useful: set output format to table for human-readable output export OCI_CLI_TABLE_OUTPUT_STYLE=table Part 2: Creating a Data Guard Standby via OCI-CLI Step 1: Verify Primary Database Status # [oracle@admin01.prod.example.com ~] oci db database get \ --database-id $OCI_PRIMARY_DB \ --query 'data.{Name:"db-name", State:"lifecycle-state", "DB Unique Name":"db-unique-name", Version:"db-version"}' \ --output table +-------------------+--------+--------------------+-----------+ | DB Unique Name | Name | State | Version | +-------------------+--------+--------------------+-----------+ | PRODCDB | PRODCDB| AVAILABLE | 19.22.0.0 | +-------------------+--------+--------------------+-----------+ Step 2: Get the Subnet OCID for the Standby AD # [oracle@admin01.prod.example.com ~] # Find the standby subnet in AD-2 oci network subnet list \ --compartment-id $OCI_COMPARTMENT \ --query 'data[?contains("display-name",`stby`)].{Name:"display-name", OCID:id, AD:"availability-domain"}' \ --output table Step 3: Create the Data Guard Association (New DB System) This single command provisions the standby DB System, configures redo transport, and establishes Data Guard:
...