> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure/oracle-cloud-setup-manual-large-enterprise-environments.md).
# Oracle Cloud Setup - Manual (Large/Enterprise Environments)
*This process is intended for customers with large environments who wish to centralize logs across many regions into a single architecture. If you wish to use Terraform, see* [*Oracle Cloud Infrastructure - Terraform Setup*](/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure/oracle-cloud-infrastructure-terraform-setup.md)*. If you wish to create multiple single-tenant setups with one device per OCI region, see* [*Oracle Cloud Infrastructure - Manual Setup (Small Environments)*](/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure/oracle-cloud-infrastructure-manual-setup-small-environments.md)*.*
To set up this integration, you will manually create the following resources using the specific parameters described in this guide:
* **Global** - auth token, compartment, group, polling policy, Expel user
* **Home Region** - central bucket, stream pool, stream, events service rule, dynamic group, IAM policy
* **Regional** - connector, application, function, VCN, subnet, service gateway, NAT gateway, routing table, security list
## Prerequisites
1. Make sure there is a user from your organization with **Admin-level cloud access** to the relevant cloud environment.
* The account you use could be your own OCI account, or it could be an administrator account.
2. Make sure you have an **email address from your organization** that can be used to associate with the Expel Machine User you will create.
* This email will be used by you to generate the API credentials for Expel.
* You should choose an organizational email you can access, like a shared security team mailbox or your work email.
## Before You Begin
Identify the region(s) you wish to include. If you wish to onboard multiple regions, you must repeat Steps 10-12 of this guide for each one.
## Step 1: Download the Function Code Files
{% file src="/files/cBrCTL6YyKx525I4QlVw" %}
The expel\_oci\_function.zip file contains the three files you need to complete this guide:
* func.py
* func.yaml
* requirements.txt
{% hint style="info" %}
Make note of the location of this file, as you will need to find and use its contents in a future step. You may also go ahead and unzip the file if you wish.
{% endhint %}
## Step 2: Generate an Auth Token
An auth token is required in order to deploy the function later in this guide. You will use it to log into Docker.
1. [Log in to OCI](https://cloud.oracle.com/).
2. In the top right, select your username/email.
3. Select the **Tokens and keys** tab.
4. In the Auth tokens section, select **Generate token**.
5. Enter a description for the token, such as "Expel token".
6. Select **Generate token**.
7. Copy the generated token, as you will need it for future steps and it will not be available again.
8. Select **Close**.
## Step 3: Create a Compartment
In this step, you will create a dedicated compartment for the log centralization resources (central bucket, VCN, function application, function, service connector, stream pool, stream, and event rules). This isolation creates a security boundary that enables precise IAM policy scoping, ensuring the Expel Collector is restricted solely to the resources required for the notification-and-fetch workflow.
1. Make sure you are in your home region.
2. Use the Search bar to navigate to **Compartments**, or go to **Identity & Security > Identity > Compartments**.
3. Select **Create compartment**.
4. For the new compartment:
* **Name** - enter a name for the compartment, such as "Expel\_Compartment". *Make note of the name you chose, as you will need it in future steps.*
* **Description** - enter a description.
* **Parent compartment** - make sure the **root compartment** is selected.
* No tags are necessary.
5. Select **Create compartment**.
6. Locate your newly created compartment in the list and select it.
7. In the details, copy and save the **compartment OCID** (you will need it in a later step).
## Step 4: Configure the Central Bucket
### Step 1: Create a Central Bucket
A bucket must be created in your home region that will act as a target for the functions. This central bucket will contain all of the logs for the regions you choose to onboard.
1. Still in your home region, use the Search bar to navigate to **Buckets**, or go to **Storage > Object Storage & Archive Storage > Buckets**.
2. Next to "Applied filters," select the compartment you created earlier in this guide.
{% hint style="warning" %}
If you do not see your compartment or if you see an error after selecting it, wait a few minutes and reload the page.
{% endhint %}
3. Select **Create bucket**.
4. For the new bucket:
* **Name** - leave the default bucket name or enter a different name, such as "Expel\_CentralBucket". *Make note of the name you chose, as you will need it in future steps.*
* **Default storage tier** - leave it as **Standard**.
* Choose the enable the **Emit object events option** (the third toggle).
5. Leave all other defaults on the page as is.
6. Select **Create bucket**.
### Step 2: Create a Lifecycle Policy Rule for the Central Bucket (Optional)
This step is not required, but it is highly recommended for cost control because it enables automatic deletion of objects outside of a safe retention window.
{% hint style="info" %}
If you do not wish to create this rule, skip to [Step 3: Create a Retention Rule for the Central Bucket.](#step-3-create-a-retention-rule-for-the-central-bucket)
{% endhint %}
1. Select your newly created central bucket in the list.
2. Select the bucket's **Policies** tab.
3. Under Lifecycle policy rules, select **Create rule**.
4. For the new rule:
* **Name** - enter a name for the rule, or use the default name.
* **Target** - leave as **Objects**.
* **Lifecycle action** - select **Delete**.
* **Number of days** - enter "14".
5. In Advanced options, make sure the State is **enabled**.
6. If an alert banner appears, select the **Try to add statements** button within the banner.
7. For the new Add IAM Policy:
* **Name** - enter a name, or use the default name.
* **Description** - enter a description, or use the default description.
* **Policy Statement** - Leave it as is.
8. Select **Create**.
9. Look for the "Policies added successfully" message.
{% hint style="warning" %}
Wait a few minutes before proceeding to the next step.
{% endhint %}
### Step 3: Create a Retention Rule for the Central Bucket
The retention rule prevents deletion of objects for a certain timeframe (this ensures the audit logs remain available during our fetching window).
1. Still in the bucket's Policies tab, under Retention rules, select **Create rule**.
2. For the new rule:
* **Name** - enter a name for the rule, or use the default name.
* **Retention rule type** - leave it as **Time-bound**.
* **Retention duration** - enter "7" and select **Days**.
3. Select **Enable retention rule lock** to prevent the rule from being inadvertently disabled.
4. Select **Create rule**.
5. Select the checkbox on the confirmation screen, then select **Create**.
## Step 5: Create a Stream Pool
The stream pool will be the container for the stream, which you will create next.
1. Still in your home region, use the Search bar to navigate to **Stream Pools**, or go to **Analytics & AI > Messaging > Streaming > Stream Pools**.
2. Select **Stream Pools**.
3. Select **Create steam pool**.
4. For the new stream pool:
* **Name** - enter a name for the stream pool, such as "Expel\_StreamPool".
* **Resource compartment** - make sure the compartment you created earlier in this guide is selected.
5. For the endpoint type, make sure **Public endpoint** is selected.
6. Leave all other defaults on the page as is.
7. Select **Create**.
## Step 6: Create a Stream
Now, you will create the stream and add it to the stream pool. The stream will function as a running log of all objects uploaded to the central bucket, helping our event poller to determine what it needs to download.
1. Still in Analytics & AI, navigate to **Streaming > Streams**.
2. Select **Create stream**.
3. Set the stream properties:
* **Name** - enter a name for the stream, such as "Expel\_Stream". *Make note of this name, as you will need it in the next step.*
* **Resource compartment** - make sure the compartment you created earlier in this guide is selected.
4. Scroll past tags and choose the **Select Existing Stream Pool option**.
{% hint style="warning" %}
If you do not see the option to select a stream pool, wait a few minutes and then reload the page.
{% endhint %}
5. Choose the stream pool you created in the previous section.
6. For the stream settings:
* **Retention** - enter "168".
* **Number of partitions** - leave it as "1".
7. Select **Create**.
8. In the list of streams, select the new stream.
9. Copy the following two values and save them, as you will need them later in this guide:
* Stream OCID
* Messages endpoint
## Step 7: Create an Events Service Rule
The rule enables you to designate which events belong in the stream.
1. Still in your home region, use the Search bar to navigate to **Rules**, or go to **Observability & Management > Events Service > Rules**.
2. Make sure you are still in the compartment you created earlier in this guide, then select **Create Rule**.
3. For the new rule:
* **Display name** - enter a name for the rule, such as "Expel\_Rule".
* **Description** - enter a description for the rule.
4. For the rule conditions:
* **Condition** - leave as **Event Type**.
* **Service Name** - select **Object Storage**.
* **Event Type** - select both **Object - Create** and **Object - Update**.
5. Select **Another Condition**.
6. For the condition:
* **Condition** - select **Attribute** as the type.
* **Attribute Name** - select **bucketName**.
* **Attribute Values** - enter the name of the central bucket you created earlier in this guide (you may also have to select it after entering the name).
7. In the Actions section:
* **Action Type** - select **Streaming**.
* **Stream Compartment** - select the compartment you created earlier in this guide (you will need to select the **+** beside the root compartment to display all other compartments).
* **Stream** - select the stream you created in the previous section.
8. Select **Create Rule**.
## Step 8: Create a Dynamic Group
This dynamic group is defined to automatically include all OCI functions located within the specified compartment. It enables the resource principal authentication for the included functions to manage other OCI resources.
{% hint style="info" %}
Before you begin, make sure you have the compartment OCID from [Step 3](#step-3-create-a-retention-rule-for-the-central-bucket).
{% endhint %}
1. Use the Search Bar to navigate to **Domains (Identity)**, or go to **Identity & Security > Domain**.
2. Change to the **root** compartment.
3. Select the **Default** domain.
4. Select the **Dynamic Groups** tab.
5. Select **Create dynamic group**.
6. For the new dynamic group:
* **Name** - enter a name for the dynamic group, such as "Expel\_DynamicGroup". *Make note of this name, as you will need it in the next step.*
* **Description** - enter a description for the group.
* Select the **Match all rules defined below** option.
7. Paste the following rule into the Rule 1 box, making sure to use the OCID for the compartment you created:
```
ALL {resource.type = 'fnfunc', resource.compartment.id = 'YOUR_COMPARTMENT_OCID'}
```
8. Select **Create**.
## Step 9: Create an IAM Policy
This policy will allow the created dynamic group to manage the objects within the central bucket.
{% hint style="info" %}
Before you begin, make sure you have the dynamic group name from [Step 8](#step-8-create-a-dynamic-group), the compartment name from [Step 3](#step-3-create-a-compartment), and central bucket name from [Step 4](#step-4-configure-the-central-bucket).
{% endhint %}
1. Still in Identity & Security, navigate to **Identity > Policies**.
2. Switch back to the compartment you created earlier in this guide, then select **Create Policy**.
3. For the new policy:
* **Name** - enter a name for the policy, such as "Expel\_Policy".
* **Description** - enter a description for the policy.
* **Compartment** - select the compartment you created earlier in this guide.
4. For the Policy Builder, select **Show manual editor**.
5. Paste the following statements into the box, making sure to use the dynamic group, compartment, and the bucket you created:
```
Allow dynamic-group DYNAMIC_GROUP_NAME to manage objects in compartment COMPARTMENT_NAME where target.bucket.name = 'CENTRAL_BUCKET_NAME'
```
6. Select **Create**.
## Step 10: Configure the Regional VCN and Application
{% hint style="info" %}
You must repeat all of these steps for each region you wish to onboard.
{% endhint %}
### Step 1: Create the VCN
Before you begin, make sure you are aware of your existing VCNs and the CIDR ranges they use. When setting up each VCN, you must select a CIDR range that does not conflict with an existing VCN.
1. Change to the region you wish to onboard.
2. Use the Search Bar to navigate to **Virtual Cloud Networks**, or go to **Networking > Virtual Cloud Networks**.
3. Make sure you are still in the compartment you created earlier in this guide, then select **Create VCN**.
4. For the new VCN:
* **VCN name** - enter a name for the VCN, such as “Expel\_RegionName\_VCN”.
* **Compartment** - make sure the compartment you created earlier in this guide is selected.
* **Configure VCN** - enter a CIDR range that does not conflict with an existing VCN. *Make note of this CIDR value, as you will need it in a later step.*
5. Toggle **Use DNS hostnames in this VCN** to **DISABLED**.
6. Leave all other values on the page as is.
7. Select **Create VCN**.
### Step 2: Create a NAT Gateway
1. Inside your new VCN, select the **Gateways tab**.
2. Scroll to the NAT Gateways section.
3. Select **Create NAT Gateway**.
4. For the new NAT gateway:
* **Name** - enter a name for the gateway, such as “Expel\_RegionName\_NATGateway”.
* **Create in compartment** - make sure the compartment you created earlier in this guide is still selected.
* Leave **Ephemeral Public IP Address** selected.
5. Select **Create NAT Gateway**.
### Step 3: Create a Service Gateway
{% hint style="info" %}
A VCN can have only one Service Gateway. If a Service Gateway already exists in this VCN, you do not need to create a new one; simply use the existing gateway.
{% endhint %}
1. Still in the Gateways tab for your VCN, scroll to the **Service Gateways** section.
2. Select **Create Service Gateway**.
3. For the new service gateway:
* **Name** - enter a name for the gateway, such as “Expel\_RegionName\_ServiceGateway”.
* **Create in compartment** - make sure the compartment you created earlier in this guide is still selected.
* **Services** - select **All \ Services in Oracle Services Network**.
4. Select **Create Service Gateway**.
### Step 4: Create a Route Table
1. Still inside your new VCN, select the **Routing** tab.
2. Select **Create Route Table**.
3. For the new route table:
* **Name** - enter a name for the route table, such as "Expel\_RegionName\_RouteTable".
* **Create in compartment** - make sure the compartment you created earlier in this guide is still selected.
4. In the Route Rules section, select **Another Route Rule**.
5. For the new rule:
* **Target Type** - select **NAT Gateway**.
* **Destination CIDR Block** - enter "0.0.0.0/0".
* **Target NAT Gateway Compartment** - make sure the compartment you created earlier in this guide is still selected.
* **Target NAT Gateway** - select the NAT gateway you created in [step 2](#step-2-create-a-nat-gateway).
* **Description** - enter a description for the rule if desired.
6. Select **Another Route Rule** to add a second rule.
7. For the new rule:
* **Target Type** - select **Service Gateway**.
* **Destination Service** - select **All \ Services in Oracle Services Network**.
* **Target Service Gateway Compartment** - make sure the compartment you created earlier in this guide is still selected.
* **Target Service Gateway** - select the service gateway you created in [step 3](#step-3-create-a-service-gateway).
8. Select **Create**.
### Step 5: Create a Security List
1. Still inside your new VCN, select the **Security** tab.
2. Select **Create Security List**.
3. For the new security list:
* **Name** - enter a name for the security list, such as "Expel\_RegionName\_SecurityList".
* **Create in Compartment** - make sure the compartment you created earlier in this guide is still selected.
4. Skip the Ingress rules.
5. Select **Another Egress Rule**.
6. For the new egress rule:
* **Stateless** - leave the toggle **DISABLED**.
* **Destination Type** - leave as **CIDR**.
* **Destination CIDR** - enter "0.0.0.0/0".
* **IP Protocol** - select **All Protocols**.
* **Description** - enter a description if desired.
7. Select **Create Security List**.
### Step 6: Create a Private Subnet
1. Still inside your new VCN, select the **Subnets** tab.
2. Select **Create Subnet**.
3. For the new subnet:
* **Name** - enter a name for the subnet, such as "Expel\_RegionName\_Subnet". *Make note of the name you chose, as you will need it in the next step.*
* **Create in compartment** - make sure the compartment you created earlier in this guide is still selected.
* **Subnet type** - leave as **Regional (Recommended)**.
* **IPv4 CIDR Block** - enter a CIDR value that is within your VCN CIDR range (example: if the VCN CIDR is 10.0.0.0/16, then the CIDR of the subnet can be 10.0.0.0/24).
4. For the IPv6 Prefixes:
* **Route Table compartment** - make sure the compartment you created earlier in this guide is still selected.
* **Route Table** - select the route table you created in [step 4](#step-4-create-a-route-table) (do not use the default route table).
* **Subnet Access** - select **Private Subnet**.
5. For the Security Lists:
* **Security List compartment** - make sure the compartment you created earlier in this guide is still selected.
* **Security List** - select the security list you created in [step 5](#step-5-create-a-security-list) (do not use the default security list)
6. Leave all other defaults on the page as is.
7. Select **Create Subnet**.
### Step 7: Create an Application
1. Use the Search Bar to navigate to **Applications**, or go to **Developer Services > Functions > Applications**.
2. Select **Create application**.
3. For the new application:
* **Name** - enter a name for the app, such as "Expel\_RegionName\_App".
* **VCN compartment** - make sure the compartment you created earlier in this guide is still selected.
* **VCN** - select the VCN you created in [step 1](#step-1-create-the-vcn).
* **Subnets compartment** - make sure the compartment you created earlier in this guide is still selected.
* **Subnets** - select the private subnet you created in the previous step.
* **Shape** - select **GENERIC\_ARM**.
4. Select **Create**.
{% hint style="warning" %}
If you have other regions you wish to onboard, [repeat all of these steps](#step-1-create-the-vcn) to configure the VCN and application for each region. When you have finished configuring all regions, or if you have no additional regions to onboard, continue to Step 11.
{% endhint %}
## Step 11: Create and Deploy the Function
In this step, you will use OCI's Cloud Shell to create and deploy the function within your newly created application.
{% hint style="info" %}
If you created multiple applications because you are onboarding multiple regions, you will need to repeat all of these steps for each application.
{% endhint %}
To access the Cloud Shell, use the **Developer Tools** menu in the top right. Wait for your machine to be created, and then begin the steps below.
### Step 1: Log in to Docker
{% hint style="info" %}
Before you begin, make sure you know the region identifier (not the region name) for each region you wish to onboard, the auth token you generated in [Step 2](#step-2-generate-an-auth-token), as well as your OCI username. This information must be entered correctly into the commands in order to successfully log into Docker.
If you need help locating the region identifier(s), see the [Troubleshooting](#region-identifier) section.
{% endhint %}
1. Make sure you are in a fresh Cloud Shell window.
2. Run the following command to get the tenancy namespace:
```
oci os ns get
```
3. Copy and save the `data` value as your **tenancy namespace** value (it should be an alphanumeric value, like `abcd1234efgh`).
4. Get the region key, replacing the REGION\_ID with the region identifier for the first region you wish to onboard:
```
oci iam region list --query "data[?name=='REGION_ID'].key | [0]" --raw-output | tr '[:upper:]' '[:lower:]'
```
5. Copy and save the **region key** value that is returned.
6. Use the tenancy namespace value, your OCI username, and the region key value in the following command to log in to Docker:
```
docker login -u 'TENANCY_NAMESPACE/OCI_USERNAME' REGION_KEY.ocir.io
```
7. When prompted for a password, enter the auth token you generated earlier in this guide.
8. Look for a `Login Succeeded!` message.
### Step 2: Use and Update the Context
{% hint style="info" %}
Before you begin, make sure you have the compartment OCID from [Step 3](#step-3-create-a-compartment), the region identifier, the region key from the previous step, and the tenancy namespace from the previous step.
{% endhint %}
1. Run the following command to list all available context:
```
fn list context
```
2. Look for a context name that matches the region you are onboarding:
* **If context exists for the region**, continue to the next step.
* **If you do not see any context for the region**, create it for the region by using the following command before continuing to the next step:
```
fn create context REGION_IDENTIFIER --provider oracle-cs
```
3. Set the region's context as the "active" one:
```
fn use context REGION_IDENTIFIER
```
4. Modify the context so that it becomes associated with the compartment you created earlier in this guide:
```
fn update context oracle.compartment-id COMPARTMENT_OCID
```
5. Associate the context to the OCI registry and also create a new repo with any name you choose:
{% hint style="warning" %}
**Your repo name must be all lowercase.** We recommend using the format expel-reponame for your chosen repo name.
{% endhint %}
```
fn update context registry REGION_KEY.ocir.io/TENANCY_NAMESPACE/REPO_NAME
```
### Step 3: Create and Deploy the Function
{% hint style="info" %}
Before you begin, make sure you have the name of your central bucket, your home region identifier, your tenancy namespace, and the names of the apps you created for each region.
{% endhint %}
1. Locate and unzip the expel\_oci\_function.zip file you downloaded at the beginning of this guide.
2. Run the following command to initialize a new function with the name "expel\_audit\_function":
```
fn init -runtime python expel_audit_function
```
3. Switch to the function's directory:
```
cd expel_audit_function
```
4. If you have already created a function in another region, skip to step 7 in this section to deploy the function. Otherwise, continue to the next step.
5. Locate the **func.py file** and edit it to update the following variables:
* **DESTINATION\_BUCKET** - replace the variable value with the name of the central bucket you created earlier in this guide (example: 'expel\_audit\_central\_bucket').
* **DESTINATION\_REGION** - replace the variable value with the region identifier for your home region (example: 'us-ashburn-1').
* **NAMESPACE** - replace the variable value with your tenancy namespace.
6. Update the function's files with the content from the zip file's func.py, func.yaml, and requirements.txt files (you may swap the files out entirely or just replace the content). You can access the function's files via their Code Editor:
7. Deploy the function, using the name of the application you created for the region:
```
fn -v deploy -app APPLICATION_NAME
```
8. Close the Cloud Shell window.
{% hint style="warning" %}
If you have other regions you wish to onboard, [repeat all of these steps](#step-11-create-and-deploy-the-function) to create and deploy the function for each region. **Make sure to start in a fresh Cloud Shell window and perform the Docker login steps using the appropriate region identifier.**
When you have finished configuring all regions, or if you have no additional regions to onboard, continue to Step 12.
{% endhint %}
## Step 12: Create a Regional Service Connector
This connector will forward all of the audit logs to the central bucket.
{% hint style="info" %}
You must create a connector for each region you wish to onboard.
{% endhint %}
1. Decide which region you wish to set up first, if you are working in more than one, and select that region in the top-right.
2. Use the Search bar to navigate to **Connector Hub**, or go to **Analytics & AI > Messaging > Connector Hub**.
3. Select **Create connector**.
4. For the new connector:
* **Connector name** - enter a name for the connector, such as "Expel\_RegionName\_Connector".
* **Description** - enter a description, such as "Forwards audit logs to the regional function".
* **Resource compartment** - select the compartment you created earlier in this guide.
5. In the Configure connector section:
* **Source** - select **Logging**.
* **Target** - select **Function**.
6. In the Configure source section:
* **Compartment name** - select the root compartment.
* **Log group** - select \_Audit.
* Select the **Include \_Audit in subcompartments** checkbox.
* Skip the Log filter task.
7. Skip the Configure task section.
8. In the Configure target section:
* **Compartment** - make sure your compartment is selected.
* **Function application** - select the function application you created earlier in this guide.
* **Function** - select expel\_audit\_function.
* Select **Show additional options** and select **Use manual settings**.
* **Batch size limit (KBs)** - enter “5120”.
* **Batch time limit (seconds)** - enter "60".
9. If an alert banner appears, select the **Create** button within the banner.
10. Look for a confirmation that your connector policy was created.
11. Select **Create** at the bottom of the page to create the connector.
{% hint style="warning" %}
If you are onboarding other regions, repeat these steps for each region.
{% endhint %}
## Step 13: Create an Expel Machine User Group
Creating a group is the first step in setting specific permissions for Expel. This group will eventually contain the Expel machine user and determine what permissions that user has.
1. Use the Search bar to navigate to **Domains (Identity)**, or go to **Identity & Security > Identity > Domains**.
2. Select the **root** compartment.
3. Select the **Default** domain.
4. Select the **User management** tab.
5. Scroll down to **Groups** and select **Create group**.
6. For the new group:
* **Name** - enter a name for the group, such as "Expel\_MachineUserGroup". *Make note of the group name you chose, as you will need it in the next section.*
* **Description** - enter a description for the group, such as "Group with audit log polling permissions".
7. Leave the "User can request access" option disabled.
8. Select **Create**.
## Step 14: Create a Polling Policy
In this step, you'll create a policy granting the new group the minimum permissions needed for Expel to poll your audit logs.
{% hint style="info" %}
Before you begin, make sure you have the stream OCID and central bucket name that you saved in earlier steps.
{% endhint %}
1. Still in Identity & Security, navigate to **Identity > Policies**.
2. Select **Create Policy**.
3. For the new policy:
* **Name** - enter a name for the policy, such as "Expel\_PollingPolicy".
* **Description** - enter a description for the policy.
* **Compartment** - select the **root** compartment.
4. For the Policy Builder, select **Show manual editor**.
5. Paste the following statements into the box, making sure to use your group name, stream OCID, and central bucket name:
```
Allow group 'Default'/'GROUP_NAME' to use stream-pull in tenancy where target.stream.id= 'YOUR_STREAM_OCID'
Allow group 'Default'/'GROUP_NAME' to read buckets in tenancy where target.bucket.name = 'CENTRAL_BUCKET_NAME'
Allow group 'Default'/'GROUP_NAME' to read objects in tenancy where target.bucket.name = 'CENTRAL_BUCKET_NAME'
Allow group 'Default'/'GROUP_NAME' to read users in tenancy
```
6. Select Create.
## Step 15: Create an Expel Machine User
You will create a new user for Expel within the group you created in [Step 13](#step-13-create-an-expel-machine-user-group). The purpose of this user is solely to generate an API key and other access values (like a fingerprint) for Expel, which you will need when you configure the security device in Workbench.
1. Still in Identity & Security, navigate to **Identity > Domains.**
2. Select the **root** compartment.
3. Select the **Default** domain.
4. Select the **User management** tab.
5. Select **Create**.
6. For the new user:
* **First name** - enter "Expel".
* **Last name** - enter "MachineUser".
* **Username/email** - enter an email address that you have access to (this email will be used to generate an API key in the next step, and also for us to contact you).
7. Leave "Use the email address as the username" **enabled**.
8. In **Groups**, select the group you created earlier in this guide.
9. Select **Create**.
10. Log out of OCI and look for the activation email from Oracle.
{% hint style="info" %}
You will need to log in as this new user to complete Step 16.
{% endhint %}
## Step 16: Obtain the Expel Credentials
These credentials will be used when you configure the security device in Workbench.
### Step 1: Generate the Credentials
1. Log in as the Expel user you created in the previous step.
2. In the top right, select your username/email.
3. Select the **Tokens and keys** tab.
4. Select **Add API key**.
5. Choose the **Generate API key pair** option.
6. Download the **private key**. This file will download as a .pem file.
7. Select **Add**.
8. In the Configuration file preview, use the **Copy** button to quickly copy out the following values:
* User
* Fingerprint
* Tenancy
* Region
### Step 2: Base64 Encode the API Keys
You must now format your private API key as a base64-encoded string, and save the output. This string is what you will use for the API key when you configure the security device in Workbench.
{% hint style="danger" %}
For security reasons, we do NOT recommend using an online Base64 encoding website.
{% endhint %}
{% tabs %}
{% tab title="Windows Systems" %}
1. Open PowerShell.
2. Run the following command (drag your .pem file into the window after entering the first part):
```
[Convert]::ToBase64String([IO.File]::ReadAllBytes(""))
```
3. Copy and save the output as your base64-encoded API key.
{% endtab %}
{% tab title="Unix-Like Systems" %}
1. Open Terminal.
2. Run the following command (drag your .pem file into the window after entering the first part):
```
base64 -i ~
```
3. Copy and save the output as your base64-encoded API key.
{% endtab %}
{% endtabs %}
{% hint style="warning" %}
You may delete the .pem file after you have successfully set up the security device in Workbench. Please retain it until then. If you need to verify that your API key was encoded correctly, see the [Troubleshooting](#base64-encoding) section.
{% endhint %}
## Step 17: Add Oracle Cloud Infrastructure as a Security Device in Workbench
{% hint style="info" %}
Before you begin, make sure you have the stream OCID, stream messages endpoint, configuration file values, region identifier, and base64-encoded API key.
{% endhint %}
1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Security Devices**. If you have multiple organizations, you must select the appropriate organization name from the list.
3. Select **Add Security Device**.
4. In the search box, type “Oracle” and then select the **Oracle Cloud Infrastructure** integration.
5. Complete the fields as follows:
* **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName OCI”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
* **Location** - enter the location of your integration, for example “cloud;” this is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
* **Stream ID** - enter the **stream OCID** you saved in an earlier step.
* **Stream endpoint** - enter the **messages endpoint** you saved in an earlier step.
* **OCI user** - enter the **user value** from the configuration file you saved in an earlier step.
* **OCI key fingerprint** - enter the **fingerprint value** from the configuration file you saved in an earlier step.
* **OCI user tenancy** - enter the **tenancy value** from the configuration file you saved in an earlier step.
* **OCI region** - enter the **region identifier** you used in an earlier step.
* **OCI user key** - enter the **base64-encoded string** for the private API key, which you created in an earlier step.
6. Select **Save**.
7. Select **No thanks, I will not provide console access** from the console access dropdown.
Your device should be created successfully within a few seconds. A few reminders:
* After your connection is healthy, it will take some time for your device to begin polling and receiving data.
* To check on the status, select the downward arrow for your device in the first column and choose **View details**.
* Polling will happen first; data will be received after that. **You must refresh the page to see updates.**
* If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, [contact our support team for help](/support/how-to-reach-us.md).
* To check if alerts are coming through, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning).
## Troubleshooting
### Device Connection Issues
The device does not connect successfully.
* Make sure you selected the correct compartment when you deployed the stacks.
* Make sure the region identifier you used was in the correct format (see [below](#region-identifier) for help).
* Verify that you downloaded the private API key and not the public one.
* Check to be sure your API key was base64-encoded correctly (see [below](#base64-encoding) for help).
* Make sure you pasted all values into the security device correctly, and that you removed any quotes; these values are case-sensitive.
* Check your CRR policy in the regional bucket to make sure it is active.
* Check your connector to make sure it is active.
You are having persistent issues.
If issues persist after checking the above, [contact Support](/support/how-to-reach-us.md). Make sure to provide:
1. The error message shown in Workbench.
2. Your tenancy OCID and home region.
3. Screenshots of your bucket list and stream details.
### Region Identifier
When you set up the region-specific policy, you must use the correct region identifier. To determine the region identifier:
1. In the upper right, select **Manage regions**.\
2. Locate your region to find its region identifier.
### Base64 Encoding
To verify your API key, you can decode your Base64 string and make sure the key matches the one in your .pem file.
{% tabs %}
{% tab title="Windows Systems" %}
Open PowerShell and run:
```
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('YOUR-BASE64-STRING'))
```
{% endtab %}
{% tab title="Unix-Like Systems" %}
Open Terminal and run:
```
printf "%s" "YOUR-BASE64-STRING" | base64 -d
```
{% endtab %}
{% endtabs %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.expel.io/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure/oracle-cloud-setup-manual-large-enterprise-environments.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.