Coming from Azure or AWS, OCI feels familiar until you hit compartments and OCIDs. Once those click, the rest of the console makes sense.
Tenancy
Your tenancy is your OCI account: one root compartment, one set of identity domains, one bill. It has a home region, where identity changes are made; IAM is global but writes go to the home region.
oci iam tenancy get --tenancy-id $TENANCY_OCID --query 'data.{name:name, home:"home-region-key"}'
oci iam region-subscription list --query 'data[].{region:"region-name", home:"is-home-region", status:status}' --output table
Compartments
A compartment is a logical folder for resources and the main boundary for access policies and budgets. Every resource lives in exactly one compartment.
- Compartments can nest (up to six levels below root).
- Policies are written per compartment:
Allow group NetworkAdmins to manage virtual-network-family in compartment Network. - Compartments are global: a compartment contains resources from every region.
A typical starting tree:
root
├── Network (VCNs, DRGs, shared by all)
├── Security (Vault, Cloud Guard targets)
├── Shared-Services
└── Workloads
├── App1-Prod
└── App1-NonProd
oci iam compartment list --compartment-id $TENANCY_OCID --compartment-id-in-subtree true \
--access-level ACCESSIBLE --all --query 'data[].{name:name, state:"lifecycle-state"}' --output table
Tip
Moving a resource between compartments is supported for most services, but policies that referenced the old compartment no longer apply to it. Plan your tree early.
OCIDs
Every resource has an Oracle Cloud ID:
ocid1.instance.oc1.eu-frankfurt-1.anthe...xyz
| | | | |
| type realm region unique part
version
Global resources (compartments, users, groups) have no region in the OCID. Most CLI commands need OCIDs, not names, so you will look them up a lot:
oci compute instance list --compartment-id $COMP --display-name web01 \
--query 'data[0].id' --raw-output
Regions, availability domains, fault domains
| Level | What it is | Protects against |
|---|---|---|
| Region | A geographic area (e.g. eu-frankfurt-1) | Regional disaster (needs a second region) |
| Availability domain (AD) | One or more data centres in a region; some regions have 3, many have 1 | Data-centre failure |
| Fault domain (FD) | A group of hardware inside an AD; 3 per AD | Hardware or rack failure, planned maintenance |
oci iam availability-domain list --compartment-id $TENANCY_OCID --query 'data[].name' --output table
oci iam fault-domain list --compartment-id $TENANCY_OCID --availability-domain "Uocm:EU-FRANKFURT-1-AD-1" --query 'data[].name'
AD names include a tenancy-specific prefix (Uocm:), so copy them from the list rather than typing them.
In single-AD regions, spread instances across the three fault domains for high availability.
Realms
A realm is a set of regions that share infrastructure. The commercial realm is oc1. Government and sovereign clouds are separate realms with separate tenancies. Most people only meet oc1.
Where you will use each
| Task | You need |
|---|---|
| Launch an instance | Compartment OCID, AD name, subnet OCID, image OCID |
| Write a policy | Group name, compartment name |
| Set a budget | Compartment |
| Plan HA | ADs (multi-AD regions) or fault domains |
Get set up quickly
Cloud Shell in the console is already configured with your user and region. Locally:
oci setup config # creates ~/.oci/config and an API signing key
oci iam region list --output table
oci os ns get # quick test: prints your Object Storage namespace
Prevent it next time
- Create compartments before resources; avoid putting anything in root.
- Tag resources with owner and environment from day one (defined tags).
- Keep a shared page of the important OCIDs (compartments, VCNs, DRGs) so people stop asking for them.