☁️ Azure Oracle Resource Anchor Terraform Module

Links an Azure resource group to an Oracle Cloud Infrastructure compartment, so Oracle Database@Azure resources have somewhere to land on the OCI side (azurerm_oracle_resource_anchor). Targets hashicorp/azurerm ~> 4.0.

• 🔗 Creates the Azure-side object that links a resource group to an Oracle Cloud Infrastructure compartment, and reports that compartment's OCID.
• ⚠️ This family is not a Microsoft resource provider. Everything here lives under the third-party Oracle.Database provider, and what it creates exists in OCI as well as in Azure.
• 🔑 RBAC is written against Oracle.Database/*. A role scoped to Microsoft.* grants nothing here.
• 📋 Three inputs, total: name, resource_group_name, tags. There is no location — the region is computed from the resource group.
• 🕳️ The family's one invisible dependency. No sibling module consumes this anchor's id, so Terraform cannot infer that the anchor must exist first. Use depends_on.
• 💥 Destroying the anchor severs the compartment link that sibling resources depend on, and no plan says so.

💡 Why it matters: This is the smallest module in the family and the right one to read first, because it is where the family's defining fact becomes visible. Almost everything that goes wrong with Oracle Database@Azure in Terraform is a provider-registration, tenant-onboarding, or RBAC-namespace problem rather than a configuration error — and all three surface here, at the cheapest possible resource to fail on.

If this module saves you time, please consider supporting its continued development:

• ⭐ Star the repository on GitHub.
• 🤝 Connect on LinkedIn: linkedin.com/in/microsoftexpert
• ☕ Buy me a coffee: buymeacoffee.com/microsoftexpert

flowchart LR
  rg["terraform-azurerm-resource-group"]
  vnet["terraform-azurerm-virtual-network: the subnet must be DELEGATED for Oracle Database@Azure"]
  kv["terraform-azurerm-key-vault: holds the admin_password, read at plan time"]
  nsg["terraform-azurerm-network-security-group: the only thing guarding the SCAN listener ports"]
  anchor["terraform-azurerm-oracle-resource-anchor: links the resource group to an OCI COMPARTMENT. No location input, it is computed."]
  exa["terraform-azurerm-oracle-exadata-infrastructure: the RACK. Every argument force-new except tags."]
  vault["terraform-azurerm-oracle-exascale-database-storage-vault: sized ONCE, there is NO grow operation"]
  cluster["terraform-azurerm-oracle-cloud-vm-cluster: the GI cluster. Use hostname_actual, not hostname, for connections."]
  dbsrv["azurerm_oracle_db_servers DATA SOURCE: OCI OCIDs that do not exist until the rack does"]
  adb["terraform-azurerm-oracle-autonomous-database: keystone plus for_each BACKUPS. Network posture is a ONE-WAY DOOR."]
  cfb["terraform-azurerm-oracle-autonomous-database-clone-from-backup: a POINT-IN-TIME restore into a NEW database"]
  cfd["terraform-azurerm-oracle-autonomous-database-clone-from-database: a clone of CURRENT state, optionally refreshable"]
  note["PEERS, NOT CHILDREN: both clones import to the SAME Oracle.Database/autonomousDatabases path the keystone uses, so each IS an autonomous database"]

  rg -->|"resource_group_name"| anchor
  rg -->|"resource_group_name, location"| exa
  rg -->|"resource_group_name, location"| vault
  rg -->|"resource_group_name, location"| cluster
  rg -->|"resource_group_name, location"| adb
  anchor -->|"REQUIRED FIRST, but NO module consumes its id, so use depends_on"| exa
  anchor -->|"same invisible dependency"| adb
  exa -->|"id as cloud_exadata_infrastructure_id"| cluster
  exa -->|"read AFTER it exists"| dbsrv
  dbsrv -->|"OCIDs as db_servers"| cluster
  vault -->|"NO Terraform link exists. Aligned by REGION and ZONE only."| cluster
  vnet -->|"id plus a delegated subnet id"| cluster
  vnet -->|"id plus subnet id, the PRIVATE posture"| adb
  nsg -->|"restricts the unencrypted SCAN port 1521"| cluster
  kv -->|"secret read as admin_password"| adb
  kv -->|"secret read as admin_password"| cfb
  kv -->|"secret read as admin_password"| cfd
  adb -->|"id as source_autonomous_database_id"| cfb
  adb -->|"id as source_autonomous_database_id"| cfd
  note -->|"why they are separate modules"| cfb
  note -->|"why they are separate modules"| cfd

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class exa keystone;
  class anchor,vault,cluster,adb,cfb,cfd me;
  class rg,vnet,kv,nsg,dbsrv,note sib;

flowchart TB
  third["READ FIRST: this family is NOT a Microsoft resource provider. Everything lives under the third-party Oracle.Database provider."]
  dual["so what these modules create exists in ORACLE CLOUD INFRASTRUCTURE as well as in Azure. Two clouds, one Terraform apply."]
  reg["consequence one: Oracle.Database must be REGISTERED explicitly. It is not a Microsoft namespace and is not registered by default."]
  rbac["consequence two: least-privilege roles are written against Oracle.Database/* . A role scoped to Microsoft.* grants NOTHING here."]
  onboard["consequence three: the TENANT needs Oracle Database@Azure onboarding, the marketplace subscription and the Azure-to-Oracle account link. Without it nothing under Oracle.Database can be created at all."]
  job["THE ANCHOR'S JOB: link an Azure resource group to an OCI COMPARTMENT, giving the family's resources somewhere to land on the OCI side"]
  tiny["the input surface is THREE fields: name, resource_group_name, tags. That is all."]
  noloc["there is NO location argument. The region is COMPUTED from the resource group, which is unusual in this library."]
  compart["linked_compartment_id is COMPUTED and is the module's real product: the OCID someone with OCI console access needs, and the form Oracle support asks for"]
  invisible["THE FAMILY'S ONE INVISIBLE DEPENDENCY: no sibling module consumes the anchor's id, so Terraform CANNOT infer that the anchor must exist first"]
  fix["so a composition that needs the ordering states it with depends_on, or relies on the resource group they share"]
  destroy["and destroying the anchor SEVERS the OCI compartment link that sibling resources depend on. Destroy those first. No plan says so."]
  notags["tags apply on the AZURE side only. They are not propagated to the linked OCI compartment."]
  this["terraform-azurerm-oracle-resource-anchor"]
  keystone["azurerm_oracle_resource_anchor.this"]

  third -->|"read this first"| dual
  dual -->|"so"| reg
  reg -->|"and"| rbac
  rbac -->|"and"| onboard
  onboard -->|"prerequisites"| this
  job -->|"the job"| tiny
  tiny -->|"note"| noloc
  noloc -->|"computed"| compart
  compart -->|"the real product"| this
  invisible -->|"remedy"| fix
  fix -->|"ordering"| destroy
  destroy -->|"hazard"| this
  notags -->|"boundary"| this
  this -->|"creates"| keystone

  classDef me fill:#0078D4,stroke:#004578,color:#fff;
  classDef keystone fill:#004578,stroke:#001f3f,color:#fff;
  classDef sib fill:#eef2f7,stroke:#b8c4d0,color:#1b1b1b;
  class this me;
  class keystone keystone;
  class third,dual,reg,rbac,onboard,job,tiny,noloc,compart,invisible,fix,destroy,notags sib;

Resource inventory

Schema notes that bite — confirmed against the live provider schema and its documentation:

• Oracle.Database is a third-party resource provider. It must be registered explicitly on the subscription, and RBAC for it is written against Oracle.Database/*.
• name and resource_group_name are force-new.
• There is no location argument, and the region does not follow the resource group. The provider sends Location: "global" — hard-coded and unconditional — so the location output always reads global regardless of where the resource group lives. Unusual in this library, where regional resources take a location value.
• linked_compartment_id is computed and is the module's real product.
• tags are the only mutable field, and they are not propagated to the linked OCI compartment.
• No sibling module consumes this anchor's id, so the ordering it establishes is invisible to Terraform's dependency graph.

⚠️ Note the namespace. Least-privilege custom roles for this family are written against Oracle.Database/*, not Microsoft.*. A carefully-scoped role covering only Microsoft providers grants nothing here, and the resulting failure is an authorization error that looks like a bug rather than a missing grant.

• The Oracle.Database resource provider registered on the subscription. This is the prerequisite most likely to be missing, because it is not a Microsoft namespace and is not registered by default.
• Oracle Database@Azure onboarding completed for the tenant — the marketplace subscription and the link between the Azure tenant and an Oracle Cloud account. Without it, nothing under Oracle.Database can be created, and the failure is a tenant-level one this module cannot report.
• An existing resource group in a region where Oracle Database@Azure is offered. The supported set is smaller than Azure's overall footprint.

terraform-azurerm-oracle-resource-anchor/
├── providers.tf   # required_version + the pinned azurerm provider. No provider block.
├── variables.tf   # name, resource_group_name, tags, timeouts
├── main.tf        # the keystone anchor
├── outputs.tf     # id, name, resource_group_name, computed location, linked_compartment_id
├── README.md      # this document
├── SCOPE.md       # the cross-module contract
├── LICENSE        # MIT
└── .gitignore

provider "azurerm" {
  features {}
}

module "oracle_anchor" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-oracle-resource-anchor.git?ref=v1.0.0"

  name                = "anchor-oracle-prod"
  resource_group_name = module.rg.name

  tags = { workload = "oracle-database" }
}

ℹ️ The caller configures the provider, its authentication, and the mandatory features {} block. This module declares none of them.

💡 No location — the provider hard-codes it to global. See example 3.

Consumes

Emits

# The prerequisite most likely to be missing.
az provider register --namespace Oracle.Database
az provider show --namespace Oracle.Database --query registrationState

Beyond provider registration, the TENANT needs:
  - an Oracle Database@Azure marketplace subscription, and
  - the link between the Azure tenant and an Oracle Cloud account.

module "oracle_anchor" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-oracle-resource-anchor.git?ref=v1.0.0"

  name                = "anchor-oracle-prod"
  resource_group_name = module.rg.name
  # no location — the anchor takes its region from the resource group
}

output "where_it_landed" {
  value = module.oracle_anchor.location
}

output "oci_compartment" {
  value = module.oracle_anchor.linked_compartment_id
}
# => "ocid1.compartment.oc1..aaaaaaaa..."

module "oracle_anchor" {
  source              = "git::.../terraform-azurerm-oracle-resource-anchor.git?ref=v1.0.0"
  name                = "anchor-oracle-prod"
  resource_group_name = module.rg.name
}

# FRAGMENT: shown to make the point about the missing dependency edge. The rack's own required
# inputs are in the end-to-end example below.
module "exadata" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-oracle-exadata-infrastructure.git?ref=v1.0.0"

  zones               = local.oracle_zone
  resource_group_name = module.rg.name
  # ⚠️ nothing here references module.oracle_anchor — Terraform sees NO dependency

  depends_on = [module.oracle_anchor] # ...so state it explicitly
}

# module.oracle_anchor.azurerm_oracle_resource_anchor.this will be destroyed

# ✅ A custom role that actually works for this family.
module "oracle_operator_role" {
  source = "git::.../terraform-azurerm-role-definition.git?ref=v1.0.0"

  scope                        = "scope"

  name        = "Oracle Database at Azure Operator"
  permissions = {
    actions = [
      "Oracle.Database/resourceAnchors/*",
      "Oracle.Database/cloudExadataInfrastructures/*",
      "Oracle.Database/cloudVmClusters/*",
      "Oracle.Database/autonomousDatabases/*",
    ]
  }
}

# ❌ A carefully-scoped role that grants nothing here.
actions = ["Microsoft.Resources/*", "Microsoft.Network/*"]

tags = {
  workload    = "oracle-database"
  cost-centre = "platform"
}

locals {
  oracle_groups = {
    prod = "rg-oracle-prod"
    test = "rg-oracle-test"
  }
}

module "oracle_anchors" {
  source   = "git::https://github.com/microsoftexpert/terraform-azurerm-oracle-resource-anchor.git?ref=v1.0.0"
  for_each = local.oracle_groups

  name                = "anchor-oracle-${each.key}"
  resource_group_name = each.value

  tags = { environment = each.key }
}

  # module.oracle_anchor.azurerm_oracle_resource_anchor.this must be replaced
-/+ resource "azurerm_oracle_resource_anchor" "this" {
      ~ name = "anchor-oracle-prod" -> "anchor-oracle-production" # forces replacement
    }

terraform import 'module.oracle_anchor.azurerm_oracle_resource_anchor.this' \
  '/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-oracle-prod/providers/Oracle.Database/resourceAnchors/anchor-oracle-prod'

provider "azurerm" {
  features {}
}

module "rg" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-resource-group.git?ref=v1.0.0"

  name     = "rg-oracle-prod"
  location = "eastus" # the anchor's region follows from here
}

# 1 · The anchor. Apply this first, on its own, the very first time —
#     it is the cheapest place to discover a provider-registration or onboarding problem.
module "oracle_anchor" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-oracle-resource-anchor.git?ref=v1.0.0"

  name                = "anchor-oracle-prod"
  resource_group_name = module.rg.name

  tags = { workload = "oracle-database" }
}

# 2 · The rack. Note the depends_on — nothing here references the anchor.
module "exadata" {
  source = "git::https://github.com/microsoftexpert/terraform-azurerm-oracle-exadata-infrastructure.git?ref=v1.0.0"

  name                = "exa-oracle-prod"
  resource_group_name = module.rg.name
  location            = module.rg.location

  display_name  = "Oracle Production Exadata"
  shape         = "Exadata.X9M"
  zones         = ["2"]
  compute_count = 2
  storage_count = 3

  customer_contacts = ["oracle-platform@example.com"] # a team alias — force-new

  depends_on = [module.oracle_anchor] # the ordering Terraform cannot infer
}

output "oracle_landing_zone" {
  value = {
    anchor_id       = module.oracle_anchor.id
    region          = module.oracle_anchor.location          # computed
    oci_compartment = module.oracle_anchor.linked_compartment_id # record this
  }
}

variable "resource_group_name" {
  type = string
  # ℹ️ The anchor's `location` follows from this group rather than being supplied — which is why this
  #    module has no `location` variable, unlike every other module in this family.
  # ⚠️ Immutable: changing it forces a new anchor to be created.
}

variable "timeouts" {
  type = object({
    create = optional(string)
    read   = optional(string)
    update = optional(string)
    delete = optional(string)
  })
  default = null
  # ⚠️ Deleting the anchor is not a local operation. It severs the link to an OCI compartment that
  #    sibling Oracle Database@Azure resources depend on. Destroy those first.
}

🔒 Nothing sensitive is accepted or emitted. The compartment OCID is an identifier, not a credential.

• The third-party provider namespace leads the documentation deliberately. Almost everything that goes wrong with Oracle Database@Azure in Terraform is a provider-registration, tenant-onboarding or RBAC-namespace problem rather than a configuration error, and all three fail here first. A reader who learns that from the smallest module in the family saves themselves discovering it on a multi-hour Exadata apply.

• The module has no location variable because the resource has no location argument. The provider marks it computed, following the resource group. Adding an input for consistency with the rest of the library would mean inventing something the provider does not accept.

• linked_compartment_id is treated as the module's product, not as an incidental attribute. An anchor whose OCID nobody recorded is an anchor that will be hunted for in a state file during an incident. The output description says what it is for rather than what it is.

• The invisible dependency is documented rather than solved with a synthetic input. This module could accept an unused handle purely to create a graph edge, but a variable that exists only to influence ordering misrepresents what the resource does. Naming the gap and pointing at depends_on is more honest and equally actionable.

• The destroy hazard follows from the same fact and is stated separately anyway. Because no sibling references the anchor, Terraform cannot order the destroys correctly either — so the warning belongs in its own place rather than as a footnote to the creation-ordering note.

• Provider registration is deliberately out of scope. It is a subscription-level concern, and a module that registered namespaces as a side effect of creating a resource would be reaching well outside what its name promises.

• Tags are documented as stopping at the Azure boundary, because the natural assumption is that a tag on an Azure resource covers the cost it generates. Here a substantial part of that cost is incurred on the OCI side, where these tags do not reach.

• tags is the only mutable field, which makes this module unusually unforgiving for its size: two of its three inputs force replacement, and a replacement is an OCI compartment relink.

• Before the first apply: register Oracle.Database and confirm tenant onboarding.
• Before the first apply: confirm the identity holds Oracle.Database/*, not only Microsoft.*.
• Before adding siblings: add depends_on pointing at this module.
• Before planning a destroy: destroy the Oracle resources that depend on the compartment link first.
• After the first apply: record linked_compartment_id somewhere a human can find it.

terraform init -backend=false
terraform validate
terraform fmt -check

• Pin the source to a tag — ?ref=v1.0.0 — never a branch.
• Plan-only from here. A human applies from CI.
• ⚠️ On a first deployment, apply this module alone before anything else in the family. It is the cheapest place to discover a registration or onboarding failure.
• ⚠️ Read any plan that replaces or destroys this anchor as a compartment-relink plan, not a rename.
• ℹ️ Only tags updates in place.
• ℹ️ Record linked_compartment_id after apply — it is what Oracle support will ask for.

terraform validate and terraform fmt -check are the offline gate. They confirm:

• name and resource_group_name are present and typed correctly;
• the timeouts value is an object of Go duration strings - but note that a key the type does not declare is SILENTLY DISCARDED rather than refused, so a misspelling here produces no error anywhere and the provider default quietly applies;
• the module declares no provider block.

What only plan and apply exercise:

• whether the resource group exists;
• whether the anchor name is already taken.

What no Terraform command checks at any stage, and which is where this module actually fails:

• whether the Oracle.Database resource provider is registered on the subscription;
• whether the tenant is onboarded to Oracle Database@Azure;
• whether the identity holds Oracle.Database/* permissions rather than only Microsoft.*;
• whether the resource group's region offers Oracle Database@Azure at all.

Outputs:

id                    = "/subscriptions/00000000-.../resourceGroups/rg-oracle-prod/providers/Oracle.Database/resourceAnchors/anchor-oracle-prod"
linked_compartment_id = "ocid1.compartment.oc1..aaaaaaaaexampleexampleexample"
location              = "eastus"
name                  = "anchor-oracle-prod"
resource_group_name   = "rg-oracle-prod"

ℹ️ Note the Oracle.Database segment in the Resource ID rather than a Microsoft.* one — the clearest single indication that this family is not what most azurerm resources are.

💡 linked_compartment_id is the value worth copying somewhere durable.

• azurerm_oracle_resource_anchor — provider documentation for this resource.
• Oracle Database@Azure overview — what the service is and how the Azure and OCI sides relate.
• Onboard to Oracle Database@Azure — the tenant-level prerequisite.
• Azure resource providers and registration — why a third-party namespace needs registering.
• OCI compartments — what linked_compartment_id points at.
• Sibling modules in this family: terraform-azurerm-oracle-exadata-infrastructure, terraform-azurerm-oracle-cloud-vm-cluster, terraform-azurerm-oracle-exascale-database-storage-vault, terraform-azurerm-oracle-autonomous-database.
• This module's SCOPE.md.

💙 "Infrastructure as Code should be standardized, consistent, and secure."