Uninstall the OCI integration

If you set the integration up through the Oracle Resource Manager stack, Terraform created every resource and tracks it in the stack's state. Destroying the stacks removes everything in the correct dependency order.

1. In the OCI console, go to Developer Services > Resource Manager > Stacks.

2. Select your region, then open the New Relic metrics stack.

3. Select Destroy and wait for the job to reach Succeeded.

4. Select Delete stack.

5. Repeat steps 2–4 for the logging stack in that region.

6. Repeat steps 1–5 for every region you instrumented.

7. Switch to your home region and destroy the policy stack and the WIF setup stack the same way.

   팁

   If every stack destroyed successfully, you're done — skip to Verify nothing is left. Use manual deletion only if a stack is missing, has drifted, or its destroy job failed.

Use this if you applied New Relic's Terraform configuration yourself rather than through Resource Manager.

You need the original working directory and its state — the local terraform.tfstate file, or access to the remote backend you configured it with. Terraform can only destroy what its state describes.

1. Change into the configuration you applied, initialize it, and select the workspace if you used one:

   bash

   카피

   $
   cd <path-to-your-newrelic-oci-configuration>
   $
   terraform init
   $
   terraform workspace select <workspace>

2. Confirm the state still describes your resources:

   bash

   카피

   $
   terraform state list

   If this returns nothing, or far fewer resources than you expect, the state is gone or incomplete. Delete manually in the OCI console instead — destroying from a partial state leaves resources behind and still costs you money.

3. Destroy each configuration, supplying the same variable values you applied with:

   bash

   카피

   $
   terraform destroy -var-file=<your-vars-file>.tfvars

   Review the plan before confirming. Different variable values can point the run at the wrong region or fail to resolve resources, leaving them orphaned.

4. Work in reverse dependency order. For each region you instrumented, destroy the logging configuration first, then metrics. Only once every region is clear, destroy the policy configuration and then the workload identity federation configuration, both in your home region.

   중요

   Don't use terraform destroy -target to pick off individual resources. It skips the dependency graph, and on this configuration that strands the VCN gateways and the connector hubs — the two things that keep costing you money.

   팁

   If every destroy completed cleanly, skip to Verify nothing is left. If any run errored partway, re-run it once — OCI occasionally rejects a delete while a dependent resource is still terminating — then delete whatever remains manually in the OCI console.

Use these steps if any of the following apply:

• You set the integration up by hand rather than through Resource Manager or Terraform.

• The Resource Manager stack record no longer exists, or its destroy job failed.

• Your Terraform state file is missing, incomplete, or has drifted from what is actually deployed.

• A destroy run from either option left resources behind.

  Work through the steps in order — later steps depend on earlier ones.

  All resources live in the New Relic compartment. It's named newrelic_compartment_ORM_DO_NOT_REMOVE_<id> when Resource Manager or Terraform created it, and newrelic_compartment_DO_NOT_REMOVE if you created it by hand. Match on the prefix rather than the full name — see Resource name reference.

  Delete the Service Connector Hubs

  This is the step that stops data flowing and stops the recurring cost. Do it first.

  1. In the OCI console, go to Analytics & AI > Messaging > Connectors.
  2. Set the compartment to the New Relic compartment.
  3. Delete every connector whose target is a New Relic function — there is one for metrics and, if you enabled logs, one for logging.
  4. Repeat for every region you instrumented.

  Delete the functions and function applications

  1. Go to Developer Services > Functions > Applications.
  2. Open newrelic-<prefix>-<region>-metrics-function-app and delete the function newrelic-<prefix>-<region>-metrics-function, then delete the application.
  3. If you enabled logs, delete the logging function and its application the same way.
  4. Repeat for every instrumented region.

  Delete the container registry repository

  Delete the repository after the function, because the function runs from the image it holds.

  1. Go to Developer Services > Containers & Artifacts > Container Registry.
  2. Set the compartment to the New Relic compartment.
  3. Delete the repository that holds the New Relic metrics function image, newrelic-<prefix>/oci-metrics-forwarder.
  4. Repeat for every instrumented region.

  Delete the VCN, subnet, and gateways

  1. Go to Networking > Virtual cloud networks.
  2. Open newrelic-<prefix>-<region>-metrics-vcn.
  3. Delete the NAT gateway, service gateway, and the internet gateway named NRMetricsInternetGateway.
  4. Delete the private subnet newrelic-<prefix>-<region>-metrics-vcn-private-subnet.
  5. Delete the VCN.
  6. Repeat for the logging VCN and for every instrumented region.

  Delete the vault, key, and secrets

  1. Go to Identity & Security > Vault in your home region.

  2. Open newrelic_vault_ORM_DO_NOT_REMOVE_<id>.

  3. Schedule deletion for both secrets: newrelic_ingest_api_key_ORM_DO_NOT_REMOVE_<id> and newrelic_user_api_key_ORM_DO_NOT_REMOVE_<id>.

  4. Schedule deletion for the key newrelic_key_ORM_DO_NOT_REMOVE_<id>.

  5. Schedule deletion for the vault.

     중요

     OCI schedules vault, key, and secret deletion rather than deleting immediately. The minimum waiting period is 7 days.

  Delete the dynamic group and policies

  1. Go to Identity & Security > Domains > Dynamic groups.
  2. Delete newrelic_dynamic_group_ORM_DO_NOT_REMOVE_<id>.
  3. Go to Identity & Security > Policies and delete these three, if present:
     • newrelic_metrics_policy_ORM_DO_NOT_REMOVE_<id>
     • newrelic_logs_policy_ORM_DO_NOT_REMOVE_<id>
     • newrelic_common_policy_ORM_DO_NOT_REMOVE_<id>

  Delete the workload identity federation resources

  You created these when you set up authentication. Deleting them permanently revokes New Relic's ability to authenticate to your tenancy.

  1. Go to Identity & Security > Domains and open the identity domain you used.
  2. Under Integrated applications, deactivate then delete:
     • newrelic-ida-app-orm
     • newrelic-token-exchange-app-orm
  3. Under Users, delete newrelic-wif-svc-user-orm.
  4. Under Groups, delete newrelic-svc-user-group-orm.
  5. Under Settings > Identity propagation trust, delete the New Relic trust configurations.
  6. Go to Identity & Security > Policies and delete newrelic-svc-user-policy-orm.

  Delete the New Relic compartment

  A compartment must be empty before you can delete it, so do this last.

  1. Go to Identity & Security > Compartments.
  2. Open the New Relic compartment and confirm it contains no resources.
  3. Select Delete.

If you onboarded using the guided setup wizard and an OCI Resource Manager stack:

1. In the OCI console, go to Developer Services > Resource Manager > Stacks.

2. Select the compartment where you deployed the logging integration stack (for example, newrelic-compartment). If you don't recall the compartment, check the original deployment job's logs — Resource Manager > Jobs > (your deployment job) > Logs — which record the compartment used.

3. Select the stack named oci-log-integration (or your custom stack name).

4. Select Terraform Actions, then select Destroy.

5. Confirm the destroy job. Resource Manager automatically deletes the Service Connector Hub instances (including audit connectors), the OCI forwarder function and its application, the log groups and Object Storage buckets the stack created, and the associated IAM policies and dynamic groups.

6. Once the destroy job completes successfully, select Edit Stack, then Delete Stack, to remove the stack definition.

   팁

   Then follow Verify nothing is left, Verify the logs teardown, and Unlink the account in New Relic. If the destroy job fails or the stack is missing, see Troubleshoot deprovisioning issues or delete manually in the OCI console.

Use this if you deployed the integration with your own Terraform or OpenTofu modules rather than through Resource Manager.

1. From your OCI Terraform workspace, run a plan check to review what it will remove:

   bash

   카피

   $
   terraform plan -destroy

2. Change into the folder containing the Terraform configuration for this integration, then destroy it:

   bash

   카피

   $
   terraform destroy -auto-approve

3. Confirm OCI destroyed every provisioned resource: oci_service_connector_hub, oci_functions_function, oci_identity_policy, and oci_identity_dynamic_group.

4. If you used the newrelic Terraform provider to link the account, remove the newrelic_cloud_oci_integrations resource block from your configuration and reapply — otherwise, follow Unlink the account in New Relic.

   팁

   Then follow Verify nothing is left, Verify the logs teardown, and Unlink the account in New Relic. If a destroy run errors partway or leaves resources behind, see Troubleshoot deprovisioning issues or delete manually in the OCI console.

Use these steps if you created the logging resources by hand, following the step-by-step setup guide. Work through them in order to avoid dependency locks.

1. Delete the service connectors. Select the compartment you used when you manually created the integration (for example, newrelic-compartment), go to Analytics & AI > Messaging > Service Connector Hub, and delete every connector that streams to the New Relic function — for example, newrelic-logs-* and newrelic-logs-*-audit.

2. Delete the OCI function and application. With the same compartment selected, go to Developer Services > Functions, delete the function oci-log-forwarder, then delete its parent function application.

3. Delete the secret, and the vault if it's dedicated. Go to Identity & Security > Vault and schedule deletion for the New Relic ingest key secret stored there. If you created a vault specifically for this integration, delete the vault too — if you reused an existing vault, delete only the secret.

4. Delete the IAM policies and dynamic group. Go to Identity & Security > Identities > Policies and delete the integration policy that grants the dynamic group access (typically created under the root compartment), then go to Identity & Security > Dynamic Groups and delete the forwarder dynamic group.

   팁

   Then follow Verify nothing is left, Verify the logs teardown, and Unlink the account in New Relic.

Destroying the stack fails with HTTP 409 Conflict: Resource is being used by another process. This usually means an active Service Connector Hub batch or function execution is holding a lock on the underlying compartment or subnet resources. In Analytics & AI > Messaging > Service Connector Hub, select the connector and select Deactivate, wait 2–3 minutes for active function invocations to drain, then re-run the ORM Destroy action.

The stack destroy fails when deleting oci_identity_policy or oci_identity_dynamic_group. This usually means the user or service principal running the destroy job lacks tenancy-level policy management rights — for example, policies deployed at the tenancy root require manage policies in tenancy. Confirm the user performing the teardown belongs to the Administrators group, or has these tenancy-root rights directly:

Allow group <Admin_Group> to manage policies in tenancy
Allow group <Admin_Group> to manage dynamic-groups in tenancy

If that doesn't resolve it, delete the policy statement manually in the OCI console under Identity & Security > Identities > Policies, then re-run the destroy operation to clear the state.

This usually means a secondary connector — an audit connector or a manual log connector created outside the ORM stack — is still active. Run an OCI Search query across the tenancy to find active connectors:

query serviceconnector resources

Delete any connector whose target is Functions pointing to oci-log-forwarder.

This is expected OCI behavior, not an error. OCI Vault secrets enforce a mandatory minimum 7-day retention period before hard deletion, to prevent accidental key destruction — but OCI disables the secret payload for reads as soon as you schedule deletion, so the log forwarder can't use it during the retention window either.