The image illustrates the architecture of an Oracle Integration 3 deployment on top of a Oracle Self-Service Landing Zone. It shows a tenancy within which are a collection of these management groups:

The included compartment are:
The network admins communicate with the optional enclosing compartment, which contains a primary VCN, itself containing three subnets: a web subnet, an app subnet, and a database subnet. Access to these subnets is controled by a security list. Each subnet has a table that identifes a destination and the service through which it reaches that target : The VCN also contains four network security groups: bastion network security grooup; load balancer network security group; apps network security group; and database network security group. Access each security group is controlled by a security list.

Also within the is an OAC VCN, which contains a provisioning subnet.

Security admins communicate with the security compartment, which contains these services: AppDev admins communicate with the apps compartment, which contains these services (note that some are disabled in this architecture): Database admins communicate with the database compartment, which contains these service, all of which are disabled in this architecture:

Internet users communicate with the primary VCN through an Internet gateway, whereas the primary VCN respnds through a NAT gateway. A customer data center uses a site-to-site VPN or FastConnect to access either the primary VCN or OAC VCN through DRG, which then passes traffic through DRG attachments to each VCN. Botht hese VCNS can then direct traffic to OSN instances through service gateways.