OCI Guarded Data Pipelines
Pipeline that moves data between isolated security domains with scanning and audit.
| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| accelerator | enum | none | gpu | asic | no | none | inherited |
| concurrency | integer | — | no | — | inherited |
| fanoutStrategy | enum | none | push | pull | hybrid | no | none | inherited |
| fanoutThreshold | integer | — | no | — | inherited |
| idempotent | boolean | — | no | false | inherited |
| instances | integer | — | no | — | inherited |
| malwareScanning | boolean | — | no | — | inherited |
| managed | boolean | — | no | false | ▸ true |
| peeredPipeline | boolean | — | no | — | inherited |
| rateControl | enum | none | fixed | aimd | no | none | inherited |
| schedule | string | — | no | — | inherited |
| transferAudited | boolean | — | no | — | inherited |
| trigger | enum | queue | stream | schedule | batch | manual | yes | — | inherited |
| vulnerabilityScanning | boolean | — | no | — | inherited |
Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.
push-fanout-without-celebrity-path
Pure push fan-out over a social graph is brutal at the tail: one post from an account with millions of followers becomes millions of cache writes. A follower threshold above which readers merge at read time bounds that write amplification.
- — all of these hold:
- — the node's `fanoutStrategy` is "push"
- — the node's `fanoutThreshold` has no value
- — the design contains a node of kind graph-database
shared-worker-pool-across-queues
One worker pool consuming several queues lets a slow or poisoned queue starve the others. That is precisely what the design's per-queue isolation requirement forbids.
- — all of these hold:
- — the node has more than 1 incoming edge from a queue
- — the design requirement `isolation.perQueue` is true
stateful-node-without-zone-redundancy
A stateful compute node pinned to exactly one availability zone disappears with that zone, and its state goes with it. Nodes inside a cell are exempt, because there the cell is deliberately single-zone and redundancy comes from the other cells.
- — all of these hold:
- — the node's `stateless` is false
- — the node sits inside exactly 1 availability-zone group
- — this does not hold:
- — the node sits inside at least one cell group
nodes:
- { id: "guarded-data-pipelines", component: "oci-guarded-data-pipelines" }SchedulerXalibaba-schedulerxAmazon AppFlowaws-appflowAWS B2B Data Interchangeaws-b2b-data-interchangeAWS Batchaws-batchAWS Glue DataBrewaws-databrewAWS DataSyncaws-datasyncAWS Deadline Cloudaws-deadline-cloudAWS Entity Resolutionaws-entity-resolutionAmazon EventBridge Scheduleraws-eventbridge-schedulerAWS Fault Injection Serviceaws-fisAWS Glue crawleraws-glue-crawlerAWS Glue for Ray jobaws-glue-ray-jobAWS Application Migration Serviceaws-mgnAmazon MSK Connectaws-msk-connectAmazon SageMaker AI Training Jobaws-sagemaker-training-jobAWS Systems Manageraws-systems-managerAWS Thinkbox Deadline 10aws-thinkbox-deadlineAWS Glue jobglue-jobAzure Automationazure-automationAzure Batchazure-batchAzure Chaos Studioazure-chaos-studioAzure Data Factoryazure-data-factoryAzure Data Shareazure-data-shareAzure Database Migration Serviceazure-database-migration-serviceMicrosoft Entra Connect Syncazure-entra-connect-syncMicrosoft Graph Data Connectazure-graph-data-connectAzure Storage Moverazure-storage-moverAzure Update Managerazure-update-managerBrowser Runcloudflare-browser-runCloudflare Snippetscloudflare-snippetsCloudflare Zarazcloudflare-zarazAirbyteairbyteAirflow DAGairflow-dagChaos Meshchaos-meshChunkrchunkrContainer workercontainer-workerCron jobcron-jobDaytonadaytonaE2Be2bEmbulkembulk
and 42 more → Worker page# yaml-language-server: $schema=../../schema/component.schema.json # Guarded Data Pipelines: a pipeline that moves data between security domains that are kept physically, # logistically and network isolated from each other, peering with the pipeline on the far side. From the # "gdp" service reference, the only documentation Oracle publishes for it: the service scans transferred # data for malware and vulnerabilities and audits and logs the transfer. No default is stated for any of # those controls, so none is recorded here. schemaVersion: "1" type: "component" id: "oci-guarded-data-pipelines" kind: "worker" provider: "oci" docs: "https://docs.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/gdp.html" defaults: managed: true properties: malwareScanning: type: "boolean" vulnerabilityScanning: type: "boolean" transferAudited: type: "boolean" peeredPipeline: type: "boolean"