OCI Overview

An overview of OCI's architecture

This page provides a high-level overview of core OCI services from a security perspective. These services are key to building comprehensive security coverage across your environment, but this list is not exhaustive.

Organization & Account Structure

OCI Organization
└── Tenancy(ies)
     └── Compartment(s) (optional)
          └── Resource(s)

Organization Management is a feature that can be optionally enabled to provide organizational governance across multiple OCI tenancies. The tenancy where this is enabled becomes the parent tenancy. Within each tenancy, resources are organized using Compartments, OCI's construct for logical grouping and resource organization. Compartments can be nested to reflect organizational structures such as environments, departments, or teams, and can be leveraged for resource organization, and more. Tenancies are the recommended method of security isolation in OCI where workloads, environments (dev/prod), and security functions (logging, auditing) are separated into dedicated tenancies. Within a tenancy, compartments serve as a secondary organizational layer; IAM policies scoped to a compartment apply to all resources within it, including child compartments. All compartments within a tenancy share the same identity namespace and billing boundary, The Tenancy Administrator is the highest-privilege identity in OCI, with unrestricted access to all resources across all compartments. A compromise of the Tenancy Administrator is effectively a compromise of the entire tenancy. Oracle recommends not using the Tenancy Administrator for day-to-day operations, instead creating dedicated admin groups with scoped IAM policies for specific functions. The break-glass administrator account should use a local password and must not be federated; Oracle recommends using the Default OCI IAM identity domain for OCI resource management.

Policy & Governance

Logging & Monitoring

Identity & Access Management

Security & Threat Detection

Network Security