Description

Ensure no cloud resources, such as instances, buckets, VCNs, databases, or topics, are created directly in the root compartment of the tenancy. Resources should be placed in dedicated child compartments, where access can be granted, monitored, and limited per team or workload.

Rationale

Policies written for the root compartment apply to the whole tenancy, so resources placed there are hard to isolate and protect with narrow permissions. Anyone who needs access to one root resource often ends up with access to far more than they should. Keeping resources in child compartments supports least privilege and makes access easier to review.

Impact

  • Resources can be protected with compartment-specific policies

  • Access is easier to review and limit

  • Moving some resources may briefly affect running workloads

Default Value

By default, the Console may suggest the root compartment when creating resources, so resources are often created there by mistake.

Pre-Requisites

  • Tenancy administrator access

  • At least one active non-root compartment

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the Profile menu, select Tenancy, and copy the tenancy OCID.

  3. Open Resource Explorer (go to https://cloud.oracle.com/search) and select Advanced resource query.

  4. Run the query: query all resources where compartmentId = '<tenancy-ocid>'

  5. Ignore resources that must stay in the root, such as policies, compartments, tag namespaces, and identity domains.

  6. If any other resources are listed, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Run the Resource Explorer query from the test plan to list the resources in the root compartment.

  3. For each resource, open its details page, select Move resource (or Change compartment) from the Actions menu, choose the correct child compartment, and confirm.

  4. Update any policies that referred to the root compartment for these resources.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the moved resource, select Move resource, and choose the root compartment again.

Reference