10 OCI Compartment Best Practices

Oracle Cloud Infrastructure (OCI) Compartments are a great way to organize and manage resources in your cloud environment. Compartments allow you to group related resources together and apply policies to them. They also provide a way to control access to resources and ensure that only authorized users can access them.

In this article, we will discuss 10 best practices for using OCI Compartments. We will cover topics such as compartment naming conventions, compartment hierarchy, and compartment access control. By following these best practices, you can ensure that your OCI environment is secure and well-organized.

1. Create a compartment for each project

Creating a compartment for each project allows you to easily manage access and permissions. You can assign specific roles to users or groups of users, so they only have access to the resources that are relevant to their project. This helps ensure that your environment is secure and compliant with any security policies you may have in place.

It also makes it easier to track usage and costs associated with each project. By having separate compartments, you can quickly identify which projects are consuming more resources than others, allowing you to make adjustments as needed.

2. Use the tenancy root compartment only to create new compartments and users

The tenancy root compartment is the top-level container for all of your resources in OCI. It’s important to keep this compartment secure and organized, so it’s best practice to use it only for creating new compartments and users. This will help you maintain a clear structure and hierarchy within your cloud environment.

By using the tenancy root compartment only for creating new compartments and users, you can ensure that all other resources are kept separate from each other. This helps reduce the risk of unauthorized access or accidental deletion of critical resources. Additionally, it makes it easier to manage permissions across different compartments and users.

3. Do not use the tenancy root compartment for any other purpose

The tenancy root compartment is the top-level container for all other compartments and resources in your OCI environment. It’s important to keep this compartment clean and organized, as it will be used by the system to manage access control policies across all of your resources.

If you use the tenancy root compartment for any other purpose, such as storing data or running applications, then it can become cluttered and difficult to manage. This can lead to security issues, as well as performance problems due to resource contention. Therefore, it’s best practice to create separate compartments for each application or service that you deploy on OCI, and only use the tenancy root compartment for administrative tasks.

4. Create a separate compartment for every application or service that you run on Oracle Cloud Infrastructure

Compartments are the basic building blocks of OCI and provide a way to organize resources into logical groups. By creating separate compartments for each application or service, you can easily control access to those resources by assigning users and groups to specific compartments. This helps ensure that only authorized personnel have access to sensitive data and applications.

Additionally, compartmentalizing your resources makes it easier to monitor usage and costs associated with each application or service. You can also use tags to further refine resource organization and cost tracking.

5. Limit access to resources in your tenancy by using IAM policies

IAM policies are a powerful tool for controlling access to resources in your tenancy. By using IAM policies, you can limit who has access to specific compartments and the resources within them. This helps ensure that only authorized users have access to sensitive data or services. Additionally, it allows you to easily revoke access when needed.

Using IAM policies also makes it easier to audit user activity and track changes over time. This is especially important if you need to comply with regulations such as GDPR or HIPAA.

6. Use dynamic groups to manage permissions

Dynamic groups allow you to assign permissions based on user attributes, such as job title or department. This makes it easier to manage access control and ensure that users only have the permissions they need for their role. It also reduces the risk of accidentally granting too many privileges to a single user.

Using dynamic groups also helps reduce the amount of time spent managing permissions since changes can be made quickly and easily. This is especially useful when onboarding new employees or making changes to existing roles.

7. Avoid granting permission directly to individual users

When you grant permission directly to individual users, it can be difficult to track who has access to what resources. This makes it hard to audit and manage permissions over time. It also increases the risk of unauthorized access if a user leaves the organization or changes roles.

Instead, use groups to assign permissions. Create separate groups for each type of user (e.g., admins, developers, etc.) and add users to those groups. Then, assign permissions to the group instead of the individual user. This will make it easier to keep track of who has access to which resources and ensure that only authorized users have access.

8. Grant least privilege

Least privilege means that users and services are only granted the permissions they need to do their job. This helps reduce the risk of unauthorized access or malicious activity, as well as accidental misconfigurations. It also makes it easier to audit user activities and identify potential security issues.

To ensure least privilege is being followed in your OCI compartments, you should use IAM policies to grant specific permissions to users and services. You should also regularly review these policies to make sure they are up-to-date and still meet the needs of your organization.

9. Use tags to organize your resources

Tags are key-value pairs that you can assign to your resources. They help you categorize and organize them, making it easier to find the resources you need when you need them. For example, if you have multiple compartments for different teams or projects, you can use tags to identify which compartment a resource belongs to. This makes it much easier to manage and track all of your resources across compartments.

You can also use tags to control access to resources. By assigning specific tags to certain users, you can grant them access only to those resources with the same tag. This is especially useful in multi-tenant environments where you want to ensure that each user has access only to the resources they need.

10. Use resource-level tagging to control which resources are visible to users

Resource-level tagging allows you to control which resources are visible to users. This is important because it helps ensure that only the right people have access to the right resources, and that no one can accidentally or maliciously gain access to sensitive data. It also makes it easier to audit who has access to what resources, as well as track changes over time.

Using resource-level tagging also ensures that all of your resources are properly organized and labeled for easy identification. This makes it much easier to find specific resources when needed, and reduces the risk of misconfiguration or accidental deletion.