Security Zone Integration

This article describes the support of security zones by the Base Database Service.

A security zone is associated with one or more compartments in your tenancy and is created with a set of security policies called a security recipe. While you can create custom security recipes for particular use cases, this article concentrates on the Oracle-managed Maximum Security Recipe, which includes a number of curated security zone policies. The policies of a particular security recipe are enforced on any resource that is provisioned or moved into a security zone that uses the recipe. Thus, the only way to apply security zone policies is to control the compartment assignments of your Oracle Cloud Infrastructure resources.

For more information about security zones, including instructions for creating security zones and security recipes, see Overview of Security Zones.

For more information about compartments, see Compartment.

Restrictions on the Resources Located in Maximum Security Recipe Compartments

The Maximum Security Recipe includes all available security zone policies. For example, restrictions placed on databases in a security zone that uses the Maximum Security Recipe include:

• The database cannot allow public network access.
• The database must have automatic backups enabled.
• The database cannot have Data Guard associations that aren’t in compartments within the same security zone.

For a complete list of the database restrictions implemented by the Maximum Security Recipe, see Security Zone Policies.

You can also create custom recipes that do not include all possible security restrictions for the resources and assign a custom recipe to a security zone. For more information, see Managing Recipes.