If you are unsure what the OCI UK Sovereign Cloud in, please check this out.

This week I’ve been helping a customer to deploy an OCI Landing Zone (the One Operating Entity variant) to their tenancy using Terraform, we ran into a couple of issues that I wanted to document and hopefully help others.

This is caused by two of the Terraform input configuration files having some hardcoded references to the OCI Commercial Cloud (OC1) rather than the UK Sovereign Cloud (OC4), which need to be updated for the configuration to apply correctly – otherwise the terraform apply command will fail.

Issue 1 ❌ – oci_open_lz_one-oe_iam.auto.tfvars.json has references to the services highlighted in the screenshot below:

To resolve this, replace Fssoc1Prod, objectstorage-eu-frankfurt-1 with Fssoc4Prod, objectstorage-uk-gov-london-1

The file should then look like this:

Issue 2 ❌ – oci_open_lz_one-oe_security_cisl1.auto.tfvars.json has 40 references to Security Policies using their actual OCIDs from OC1 – Commercial (see examples below):

The easiest way to fix this is by doing a find and replace of all instances of .oc1.. replacing this with .oc4..

Which should then look something like this:

Note❗️- If you are using the CIS2 version of this configuration file instead of the CIS1 version (as I used) you will also need to make these changes.

That’s it!

I was playing around with Terraform in my lab the other day and attempted to run a destroy operation to tear down everything I’d built – this was to avoid any unnecessary charges for resources that I’m not actively using in my test tenancy 💷.

The destroy operation kept failing with a 409-Conflict error which stated that the subnet it was trying to delete had references to a VNIC, this made no sense at all as everything had been provisioned with Terraform…..and the VM instances attached to the subnet had been deleted earlier in the destroy operation 😤.

I figured out what was actualluy blocking the deletion…..it was a VNIC attached to the subnet, however it wasn’t a VNIC that I (or Terraform!) had created.

As part of the testing I’d done post-build, I had attached the Cloud Shell to a Virtual Cloud Network & Subnet – this enabled me to SSH into a VM instance that didn’t have a public IP address assigned (as I’ve previously wrote about here).

The fix for this was simple, I just needed to close the Cloud Shell session (which detaches the VNIC from the subnet) and retry the destroy operation – which worked this time ✅.

If you run into the following error when using an OCI Generative AI Agent that attempts to use a SQL Tool

User Error: Failed to execute DB query with Error – NotAuthorizedOrNotFound: Authorization failed or requested resource not found with http status 404

If you are like me, the reason for this error is that you didn’t read the manual 🤦, this error is typically returned because the Generative AI Agent service does not have permission to the Database Connection and Key Vault – which is required to connect to the database and run the query generated by the agent.

The fix for this is to create a policy that grants the necessary permissions to the Generative AI Agents service – which is documented here (below for reference too).

Allow any-user to use database-tools-connections in compartment <compartment-name> where request.principal.type='genaiagent'

Allow any-user to read database-tools-family in compartment <compartment-name> where request.principal.type='genaiagent'

Allow any-user to read secret-family in compartment <compartment-name> where request.principal.type='genaiagent'

One thing I’ve been caught out with in the past with OCI Gen AI is when an AI model gets retired and my apps that specifically call the model start to fail as the model is no longer available!

The fix for this isn’t particularly difficult, it’s just a case of updating the code to point to the new model name (via model_id), this can be quite stressful though when you are about to deliver a demo to a customer 😫.

I was really pleased to see the introduction of model aliases (Cohere-only at this time), so rather than using a hardcoded reference to a specific model version you can now use the following aliases, which will always point to the latest version of the Cohere Command R and Coheren Command R+ models.

cohere.command-latest points to cohere.command-r-08-20204
cohere.command-plus-latest points to cohere.command-r-plus-08-2024

Full details are included in the documentation 📖.

Yesterday I added a new AI profile to an Oracle Autonomous Database using the Database Actions UI, when testing this new profile I received the following error:

This appears to be caused by Database Actions not creaing the profile correctly, the fix was to manually create the profile using the following SQL statement:

BEGIN
  DBMS_CLOUD_AI.CREATE_PROFILE(
      profile_name => 'TestProfile',
      attributes   => '{"provider": "oci",
                        "credential_name": "TESTCREDS",
                        "object_list": [{"owner": "ADMIN"}],
                        "model": "cohere.command-r-plus-08-2024",
                        "region": "uk-london-1"
                       }');
END;
/

This created a profile named TestProfile that uses the existing saved credentials named TESTCREDS to connect to the cohere.command-r-plus-08-2024 model in the uk-london-1 region – for some reason the Database Actions UI hardcodes the region to Chicago (which is another reason to create the profile manually!)

In addition to this, it gives the profile access to all objects owned by the account named ADMIN.

Obvouisly, you’ll need to update these with the relevant values for your environment.

After doing this, it was able to successfull connect:

In this short video, I step through how to create an Oracle Generative AI Agent and then configure a tool within the Agent to connect to a public API that performs URL shortening. This uses the new (as of July 2025) API Endpoint Calling Tool functionality within the Generative AI Agents Service.

This allows users to ask the agent to shorten a URL, the agent then calls a public API that can shorten URLs (https://cleanuri.com/docs) and returns a shortened URL to the user.