Home / OCI

OCIHow-toIntermediate

OCI landing zone foundation: compartments, the CIS landing zone and Security Zones

Design an OCI compartment hierarchy, deploy the CIS-aligned OCI landing zone with Terraform, and add Security Zones, quotas and tag defaults before workloads arrive.

Deepak Bhardwaj2 min read

Applies toOracle Cloud Infrastructure tenancies (OCI Core Landing Zone / CIS Landing Zone Terraform)

1. Compartments are the backbone

In OCI, compartments are the unit of access control, quotas, budgets and policy scope. Design them before creating anything.

root (tenancy)
└── cmp-landingzone
    ├── cmp-network        (VCNs, DRG, load balancers shared by apps)
    ├── cmp-security       (Vault, Cloud Guard targets, bastions, logging)
    ├── cmp-appdev
    │   ├── cmp-payments-prod
    │   └── cmp-payments-nonprod
    ├── cmp-database       (DB systems, Autonomous DBs)
    └── cmp-exainfra       (Exadata infrastructure, if any)

Keep nothing in the root compartment except IAM. Compartments can be nested up to six levels; don't go that deep.

2. Deploy the landing zone as code

Oracle publishes the OCI Core Landing Zone (successor of the CIS Landing Zone) Terraform configuration. It creates:

  • Compartments for network, security, application and database.
  • Groups and policies per role (network admins, security admins, app admins, DB admins, auditors).
  • VCNs (three-tier or hub-and-spoke), with optional DRG and network firewall.
  • Cloud Guard, Vulnerability Scanning, Events + Notifications, Logging, Vault, budgets.
git clone https://github.com/oci-landing-zones/terraform-oci-core-landingzone.git
cd terraform-oci-core-landingzone
# set tenancy_ocid, region, service_label and network options in a .tfvars file
terraform init && terraform plan -var-file=prod.tfvars && terraform apply -var-file=prod.tfvars

Review the variables carefully (service label, CIDRs, whether to create a DRG). Re-running Terraform is how you change the foundation later.

3. Security Zones

Security Zones enforce recipes on a compartment (for example: no public buckets, block volumes must use customer-managed keys, no public subnets for databases). Apply a strict recipe to production database compartments.

4. Quotas

Stop surprise spend and keep capacity for production:

zero compute-core quotas in tenancy
set compute-core quota standard-e5-core-count to 64 in compartment cmp-payments-prod
set compute-core quota standard-e5-core-count to 16 in compartment cmp-payments-nonprod

5. Regions

Subscribe to your DR region early (for example Mumbai + Hyderabad). Some resources and IAM replicate tenancy-wide, but networks, vaults and logging must be created per region. Run the landing zone in the DR region too (the configuration supports multi-region deployment patterns).

Foundation checklist

  • Compartment tree agreed and created by Terraform
  • Administrators in groups; no daily use of the tenancy admin account
  • Cloud Guard enabled with a reporting region
  • Budgets per top compartment with alerts
  • Tag namespaces and defaults (see the tagging post)
  • DR region subscribed and its network built

Related fixes