Resource Isolation

Compartments are a fundamental component of Oracle Cloud Infrastructure that allow you to create a heterogeneous collection of resources for organization, security isolation, and access control.

To learn more about compartments, see Managing Compartments.

Organize your cloud resources in logically separate compartments, for the purposes of measuring usage and billing, controlling access, and isolating resources. A common approach is to create a compartment for each major part of your organization.

Use the following checklist:

Done?	Security Controls and Recommendations
	Isolate departmental resources in compartments.
	Use compartments and IAM policies to allow access to only users who need permission to access specific resources.
	Create child compartments and write IAM policies for each compartment if more organizational layers are required.
	Use compartment quotas to limit the number of resources that can be created.
	Avoid writing IAM policies at the level of the root compartment.
	Limit the resources that an instance principal can manage by specifying a compartment in the IAM policy.
	Write IAM policies to ensure that only authorized users can move child compartments to a different parent compartment and move resources from one compartment to another.

The following graphic shows how you can use policies and compartments to control access by users and instances to resources in specific compartments.

Description of the illustration compartments-png.png