Applies toOCI Object Storage (Standard tier buckets)
Access
- Bucket visibility Private (Security Zones can block public buckets in a compartment).
- Access through IAM policies scoped to the bucket:
Allow group AppAdmins-Payments to manage objects in compartment cmp-payments-prod
where target.bucket.name = 'invoices-prod'
Allow dynamic-group dg-payments-instances to read objects in compartment cmp-payments-prod
where target.bucket.name = 'invoices-prod'
- Pre-authenticated requests (PARs) only with short expiry and for specific objects or prefixes; list them regularly.
oci os preauth-request list --bucket-name invoices-prod --output table
- Traffic from VCNs through a service gateway (stays on the Oracle network). Optional: private endpoints for Object Storage.
Encryption
- Oracle-managed keys by default; customer-managed Vault key where required:
oci os bucket update --bucket-name invoices-prod --kms-key-id <vault-key-ocid>
(The Object Storage service needs a policy to use the key in that compartment.)
Data protection
- Object versioning enabled.
- Retention rules (time-bound, locked) for audit/backup data to prevent deletion or overwrite.
- Lifecycle policy: move to Infrequent Access/Archive after N days; delete previous versions after N days.
oci os bucket update --bucket-name invoices-prod --versioning Enabled
oci os retention-rule create --bucket-name invoices-prod --display-name keep-1y --time-amount 365 --time-unit DAYS
Visibility
- Service logs for read/write on sensitive buckets.
- Cloud Guard detector for public buckets and bucket policy changes.
- Events for object deletion in critical buckets.
Availability
Standard buckets store data redundantly across fault domains (and ADs in multi-AD regions) in the region. For region resilience, use bucket replication to the DR region (see the OCI Object Storage replication post).
Warning
Replication and versioning don't protect against a compromised account with delete rights on both buckets. Locked retention rules do.