OCI Service Connector Hub moves data between OCI services without integration code. It reads from Logging, Monitoring, Streaming, or Queue sources and delivers to Object Storage, Streaming, Functions, or Notifications targets. Common patterns are routing audit logs to Object Storage for compliance archival, forwarding application logs to Streaming for real-time analytics, and sending critical alarms to PagerDuty through a Notifications topic with no custom code required.

Step 1: IAM Policy

resource "oci_identity_policy" "service_connector_policy" {
  compartment_id = var.compartment_id
  name           = "service-connector-hub-policy"
  statements = [
    "Allow any-user to manage objects in compartment id COMPARTMENT_OCID where all {request.principal.type = 'serviceconnector'}",
    "Allow any-user to use stream-push in compartment id COMPARTMENT_OCID where all {request.principal.type = 'serviceconnector'}",
    "Allow any-user to use functions-family in compartment id COMPARTMENT_OCID where all {request.principal.type = 'serviceconnector'}",
    "Allow any-user to use ons-topics in compartment id COMPARTMENT_OCID where all {request.principal.type = 'serviceconnector'}"
  ]
}

Step 2: Audit Logs to Object Storage

resource "oci_objectstorage_bucket" "audit_log_archive" {
  compartment_id = var.compartment_id
  namespace      = var.tenancy_namespace
  name           = "audit-log-archive"
  access_type    = "NoPublicAccess"
  storage_tier   = "Standard"
  versioning     = "Enabled"
}

resource "oci_sch_service_connector" "audit_to_os" {
  compartment_id = var.compartment_id
  display_name   = "audit-logs-to-object-storage"
  description    = "Route all audit logs to Object Storage for compliance archival"

  source {
    kind = "logging"
    log_sources {
      compartment_id = var.compartment_id
      log_group_id   = "_Audit"
    }
  }

  target {
    kind                       = "objectStorage"
    bucket_name                = oci_objectstorage_bucket.audit_log_archive.name
    namespace                  = var.tenancy_namespace
    object_name_prefix         = "audit-logs"
    batch_rollover_size_in_mbs = 100
    batch_rollover_time_in_ms  = 60000
  }

  defined_tags = { "Operations.Environment" = "production", "Operations.ManagedBy" = "terraform" }
}

Step 3: Application Logs to Streaming

resource "oci_sch_service_connector" "app_logs_to_stream" {
  compartment_id = var.compartment_id
  display_name   = "application-logs-to-streaming"

  source {
    kind = "logging"
    log_sources {
      compartment_id = var.compartment_id
      log_group_id   = var.application_log_group_id
      log_id         = var.orders_api_log_id
    }
    log_sources {
      compartment_id = var.compartment_id
      log_group_id   = var.application_log_group_id
      log_id         = var.payments_api_log_id
    }
  }

  target {
    kind      = "streaming"
    stream_id = var.analytics_stream_id
  }

  defined_tags = { "Operations.ManagedBy" = "terraform" }
}

Step 4: Monitoring Alarms to Notifications

resource "oci_sch_service_connector" "monitoring_to_notifications" {
  compartment_id = var.compartment_id
  display_name   = "monitoring-critical-to-pagerduty"

  source {
    kind = "monitoring"
    monitoring_sources {
      compartment_id = var.compartment_id
      namespace_details {
        kind       = "selected"
        namespaces { namespace = "oci_compute" }
        namespaces { namespace = "oci_autonomous_database" }
        namespaces { namespace = "oci_lbaas" }
      }
    }
  }

  target {
    kind     = "notifications"
    topic_id = var.pagerduty_topic_id
  }

  defined_tags = { "Operations.ManagedBy" = "terraform" }
}

Operational Notes

The _Audit log group captures all OCI control plane actions: IAM changes, resource creation and deletion, configuration updates. This connector gives you a continuously updated audit archive in Object Storage without any custom code or cron job. Combined with a 7-year lifecycle policy on the target bucket, it satisfies most compliance audit log retention requirements automatically.

Configure batch_rollover_size_in_mbs and batch_rollover_time_in_ms based on latency requirements. For archival connectors, use large batches (100 MB or 10 minutes) to minimize Object Storage API calls and cost. For real-time analytics connectors to Streaming, use small batches (1 MB or 10 seconds) to reduce the lag between log generation and stream availability for downstream consumers.

Regards,
Osama

#OCI #OracleCloud #ServiceConnectorHub #Logging #Terraform #IaC #TechBlog #Oracle #PlatformEngineering #Observability #OracleCloudInfrastructure #ObjectStorage #Streaming #AuditLogs #Compliance #RealTimeAnalytics #LogManagement #CloudOps #SIEM #NoCode