oci-dbm-network

name	oci-dbm-network
description	Validates and configures network prerequisites for OCI DBM enablement on ADB. Checks for a DBM Private Endpoint in the VCN and verifies/adds the ingress security list rule for TCP port 1522 from the subnet CIDR. Trigger when a user says "check my network for DBM", "set up network rules for DBM", or when oci-dbm-commission directs here after the grill.

oci-dbm-network

This skill is a worker in the oci-dbm-commission chain. It does NOT generate scripts. It uses the OCI Python SDK directly to validate and fix network prerequisites required before OCI Database Management can be enabled on an Autonomous Database.

---

Inputs

These values are passed by oci-dbm-commission (or supplied directly by the user):

Input	Description	Example
compartment_ocid	OCID of the compartment containing the VCN and subnet	ocid1.compartment.oc1..aaa...
subnet_ocid	OCID of the private subnet where the ADB and DBM PE reside	ocid1.subnet.oc1.iad.aaa...
subnet_cidr	CIDR block of that subnet — used as the ingress source for port 1522	10.0.1.0/24
dbm_pe_ocid	OCID of the existing DBM Private Endpoint, or the string "none" if one does not exist yet	ocid1.dbmgmtprivateendpoint.oc1... or "none"

---

What This Skill Executes

Step 1 — Validate the DBM Private Endpoint

Check whether a DBM Private Endpoint (PE) exists in the VCN.

• Use DbManagementClient.list_private_endpoints(compartment_id=compartment_ocid) and filter results to confirm the provided dbm_pe_ocid is present and its lifecycle_state is ACTIVE.
• If dbm_pe_ocid is "none" or the PE is not found or not ACTIVE:
  • Block and instruct the user to create one manually via the OCI Console:

    Observability & Management > Database Management > Private Endpoints > Create Private Endpoint

  • Specify: same VCN and subnet as the ADB, same compartment.
  • This step cannot be automated via the SDK in the current API version. Do not attempt to create it programmatically.
  • Wait for the user to confirm the PE OCID before proceeding.

Step 2 — Check and Fix the Security List Rule for TCP 1522

Use VirtualNetworkClient.get_subnet(subnet_id=subnet_ocid) to retrieve the associated security list OCIDs, then call VirtualNetworkClient.get_security_list() on each.

Scan ingress_security_rules for a rule matching:

• protocol = 6 (TCP)
• source = subnet_cidr
• tcp_options.destination_port_range.min = 1522
• tcp_options.destination_port_range.max = 1522

If the rule is missing:

• Print the current ingress rules (before state).
• Append the new rule to the existing list and call VirtualNetworkClient.update_security_list() with the full merged list.
• Print the updated ingress rules (after state).
• Confirm the update succeeded (HTTP 200, no exception).

If the rule already exists, print it and continue.

Step 3 — Confirm and Output

Print:

• The DBM PE OCID (confirmed active)
• The security list rule confirming TCP 1522 ingress from subnet_cidr is present

Output the following values for the next skill in the chain:

dbm_pe_ocid: <ocid>
subnet_ocid: <ocid>
subnet_cidr: <cidr>
compartment_ocid: <ocid>
network_validated: true

---

Confirmation Before Finishing

Before handing off, verify:

• DbManagementClient.list_private_endpoints() returns the PE with lifecycle_state = ACTIVE
• VirtualNetworkClient.get_security_list() shows a TCP 1522 ingress rule from subnet_cidr

Do not proceed if either check fails.

---

What This Skill Hands Back

Outputs passed to oci-dbm-commission (and subsequently to oci-dbm-vault or oci-dbm-enable):

• dbm_pe_ocid — confirmed OCID of the active DBM Private Endpoint
• subnet_ocid — unchanged, forwarded for downstream skills
• compartment_ocid — unchanged, forwarded for downstream skills
• network_validated: true — signal that this step completed successfully

---

Gotcha

Port 1522, not 1521.

ADB Shared with TCPS (TLS-only) connectivity uses port 1522. The classic Oracle JDBC port 1521 is for non-TLS or dedicated infra. If the security rule is on 1521, DBM enablement will fail with a generic JDBC login timeout — no useful diagnostic is emitted. Always use 1522 for ADB Shared PE-based connectivity.