This image shows an Oracle Cloud Infrastructure tenancy with compartments, an Identity Domain with User Groups and Dynamic Groups, and the following resources in the Root compartment: Tags, Budget, IAM Policies, ZPR Policies, Events, Cloud Guard, Budget Events, Notifications, and Topic. Budget Events, Notifications, and Topic appear in a box with a dotted line. The following are in user groups: Cost Admins, Storage Admins, Cred Admins, Auditors, IAM Admins, Announcement Readers, Access Governance Admins, Network Admins, Security Admins, App Admins, Database Admins, and Exadata Admins.

An enclosing compartment is located inside the Root compartment and contains IAM policies and a Security Zone. The following compartments reside within the enclosing compartment: Network, Security, App, Database, and Exadata. The template provisions Alarms, Events, Notifications, Topic, and Subscriber resources inside the Network, Security, App, Database, and Exadata compartments.

The Network compartment can have up to nine standalone Virtual Cloud Networks (VCNs): three three-tier VCNs, three OKE VCNs, and three Exadata VCNs. The three-tier VCNs can have up to four regional subnets: a Web subnet, an App subnet, a Database subnet, and an optional Bastion subnet. The OKE VCNs can have up to five regional subnets: a Services subnet, a Worker subnet, an API subnet, a Management subnet, and an optional Pods subnet. The Exadata VCN has two regional private subnets: a Client subnet and a Backup subnet. The Network compartment also has Alarms, Events, Notifications, Topic, and Subscriber resources.

The type of VCN drives which gateways are attached to them. The standard three-tier VCNs and OKE VCNs can have all VCN gateways, while Exadata VCNs are attached to a Service Gateway and can be attached to a Dynamic Routing Gateway (DRG) are:
- An internet gateway used for bi-directional connectivity to the public internet.
- A NAT gateway used for one-way connectivity from resources in the private subnets to the public internet.
- A Service gateway used for one-way connectivity to the Oracle services network (OSN).
- A Dynamic Routing Gateway used for private connectivity to the on-premises network in the Customer Data Center.
Network access to the resources in each of the subnets is controlled by separate network security groups. Databases have an extra layer of protection provided by Zero Trust Packet Routing (ZPR) policies.

The Security compartment hold security resources, such as Vault and Keys, Vulnerability Scanning, Logging, Service Connector Hub, Bastion, Object Storage Buckets, Alarms, Events, Notifications, Subscriber, and Topic resources.

The App compartment is provisioned with Alarms, Events, Notifications, Subscribers, and Topic resources. The App compartment can contain other application-related resources that you might need in addition to those provisioned by the template. For example, the template does not provision the following resources: Functions, Container Engine for Kubernetes clusters, Compute instances, Block Storage, Streaming, and File Storage.

The Database compartment is for any database resources that you want to provision. It is provisioned with Alarms, Events, Notifications, Subscribers, and Topic resources. The template does not provision the databases, including Oracle Autonomous Transaction Processing (ATP), Oracle Autonomous Data Warehouse, and VM Database.

The Exadata compartment is for Exadata resources, including the infrastructure, VM clusters and database systems. It is provisioned with Alarms, Events, Notifications, Subscribers, and Topic resources. The template does not provision the Exadata system.

The arrows at the top indicate overall admin permissions granted to management groups over resources across the compartments, as follows:

Cost Admins manage Budget in the Root compartment.
IAM Admins Tags, User Groups, Dynamic Groups, and IAM Policies in the Enclosing compartment.
Network Admins manage resources in the Network compartment.
Security Admins manage Cloud Guard, IAM events, Network events, ZPR policies in the Root compartment, and the Security Zone in the Network compartment. Security Admins also manage resources in the Security compartment.
App Admins manage resources in the App compartment.
Database Admins manage resources in the Database compartment.
Exadata Admins manage resources in the Exadata compartment.