IAM and Compartments

Oracle Cloud Infrastructure Identity and Access Management (IAM) controls who can access your resources and what actions they can perform. Combined with compartments, IAM provides a powerful framework for organising and securing your cloud environment.

---

Tenancy and Compartments

Tenancy

Your tenancy is the root container for all OCI resources. When you sign up, your tenancy is created with:

• A home region — where your IAM resources are mastered
• A root compartment — the top-level compartment (same OCID as the tenancy)
• An administrator user — the initial user with full access

Compartments

Compartments are logical containers for organising resources:

• Every resource belongs to exactly one compartment
• Compartments can be nested up to six levels deep
• IAM policies are applied at the compartment level
• Resources in a compartment can interact with resources in other compartments (if policies allow)

Root Compartment (Tenancy)
├── Production
│   ├── Networking
│   ├── Compute
│   └── Databases
├── Development
│   ├── Networking
│   └── Compute
└── Shared-Services
    ├── Security
    └── Monitoring

Compartment Best Practices

1. Mirror your organisational structure — teams, projects, or environments
2. Apply least-privilege policies — each compartment gets only the policies it needs
3. Use compartment quotas — limit resource consumption per compartment
4. Track costs by compartment — built-in cost analysis by compartment

---

IAM Users and Groups

Users

An IAM user is an identity that can:

• Sign in to the OCI Console
• Use the CLI or SDKs with API keys
• Be assigned to one or more groups

Groups

Groups are collections of users that share the same permissions:

Group: NetworkAdmins
├── User: alice
├── User: bob
    → Policy: Allow group NetworkAdmins to manage virtual-network-family in compartment Networking

---

IAM Policies

Policies are the mechanism for granting permissions in OCI. They use a human-readable syntax:

Allow group <group-name> to <verb> <resource-type> in compartment <compartment-name>

Policy Verbs

Verb	Permissions
inspect	List resources and view metadata
read	Inspect + read the content of resources
use	Read + perform actions on existing resources
manage	Full control — create, update, delete

Policy Examples

Allow group Developers to manage instances in compartment Development
Allow group DBAdmins to manage database-family in compartment Databases
Allow group Auditors to inspect all-resources in tenancy
Allow group NetworkAdmins to manage virtual-network-family in compartment Networking

Resource Types

Common resource types: