oci-data-safe

OCI Data Safe

Register and assess databases with Data Safe safely. Reading assessments is safe; registration, audit-policy/retention changes, and masking are mutations and go through run_mutating / confirm. All CLI runs through oci_cli (../../scripts/common.sh). Never inline real OCIDs, IPs, service names, or credentials — use <PLACEHOLDER> tokens.

First move (always)

1. Confirm the tenancy/compartment:

   ./scripts/oci_preflight.sh -c <COMPARTMENT_OCID>
   

2. Check the KB before debugging a registration failure:

   python3 scripts/kb_lookup.py "data safe target" observability-db
   

Read ../../references/data-safe.md for the registration payloads, privilege scripts, and assessment/audit/masking commands, and ../../references/tenancy-safety.md for the safety rules.

Routing — pick the task

Request mentions…	Go to
register/onboard a target, private endpoint	Target registration
privileges, "download privilege script", grants	DB-side privileges
security posture, risky config, drift	Security & User Assessment
audit events, retention, who did what	Activity Auditing
sensitive columns, PII discovery	Data Discovery
mask/redact data for non-prod	Data Masking
NEEDS_ATTENTION / ORA-01017	Gotchas

Scope. This skill drives the OCI Data Safe service (registration, assessments, activity auditing, masking) — the security layer around the database. For security work inside the database that Data Safe doesn't own — SQL-level GRANT/REVOKE, Unified Auditing policy authoring, schema hardening — route to oracle/skills db/. See references/oracle-skills-alignment.md.

Common multi-step flows

Task	Sequence
Register a target	ensure a Data Safe private endpoint (for cloud/Exadata DB) → run the DB-side privilege script → target-database create (creds via file://) → wait the work request → read the Security Assessment
Fix NEEDS_ATTENTION / ORA-01017	rotate the DB service-account password CONTAINER=ALL → update the target credential → wait the work request → re-check lifecycle-state (KB-057)
Mask a non-prod copy	run Data Discovery (sensitive data model) → verify the target is a non-prod copy → run masking (irreversible) → confirm masked columns
Audit a time window	audit-event list --scim-query with auditEventTime bounds (NOT time_started/time_ended, KB-032) → check retention covers the window

Common tasks

# Register an Autonomous DB target (credentials via file://, never argv).
run_mutating "register ADB target" oci_cli data-safe target-database create \
  --compartment-id <COMPARTMENT_OCID> --display-name <NAME> \
  --database-details file://database-details.json \
  --credentials file://credentials.json

# Read latest Security Assessment for a target (safe).
oci_cli data-safe security-assessment list --compartment-id <COMPARTMENT_OCID> \
  --target-id <TARGET_OCID> --query 'data[0]'

# Activity audit window — scim_query, NOT time_started/time_ended.
oci_cli data-safe audit-event list --compartment-id <COMPARTMENT_OCID> \
  --scim-query '(auditEventTime ge "<RFC3339_START>") and (auditEventTime le "<RFC3339_END>")'

Key rules

• Target type drives the payload: AUTONOMOUS_DATABASE uses autonomousDatabaseId; DATABASE_CLOUD_SERVICE is keyed off dbSystemId + serviceName (not the DB OCID).
• target-database update is async (--wait-for-state SUCCEEDED) and needs --force non-interactively.
• Audit queries use scim_query for the time window.
• NEEDS_ATTENTION + ORA-01017 = stale service-account password: rotate CONTAINER=ALL, update the target credential, wait the work request.

Safety notes

• Read assessments freely; gate the rest. Registration, audit-policy/retention changes, and masking are mutations — confirm / run_mutating.
• Never print or commit credentials. file:// payloads in 0600 files under a 0700 dir, deleted in finally; redact any output.
• Mask only a verified non-prod copy — it is irreversible on the masked data.
• Never invent oci flags. Fetch the exact command shape first: python3 scripts/oci_cli_help.py <service> <op>.

Expected output

**Finding** — target/assessment state or risk (names, not OCIDs).
**Evidence** — redacted assessment / audit result.
**Action** — exact command(s); registration/masking gated by confirm/dry-run.
**Verification** — re-read the assessment / target lifecycle-state showing the result.
**KB** — KB entry used, or new KB-<n> added.

Official documentation

Data Safe. Full list in the data-safe reference.

Open Knowledge Format grounding — every doc link here is registered and liveness-checked in the oracle-docs.md index (the pack's single source of truth). When extending this skill to build an OCI customer solution, cite the most specific official page through that index so every claim stays verifiable; the non-official MCP gateway is never a source of truth.