# Ensure no resources exist in the root compartment

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698516456280-ensure-no-resources-exist-in-the-root-compartment
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure no cloud resources, such as instances, buckets, VCNs, databases, or topics, are created directly in the root compartment of the tenancy. Resources should be placed in dedicated child compartments, where access can be granted, monitored, and limited per team or workload.

**Rationale**

Policies written for the root compartment apply to the whole tenancy, so resources placed there are hard to isolate and protect with narrow permissions. Anyone who needs access to one root resource often ends up with access to far more than they should. Keeping resources in child compartments supports least privilege and makes access easier to review.

**Impact**

-   Resources can be protected with compartment-specific policies
    
-   Access is easier to review and limit
    
-   Moving some resources may briefly affect running workloads
    

**Default Value**

By default, the Console may suggest the root compartment when creating resources, so resources are often created there by mistake.

**Pre-Requisites**

-   Tenancy administrator access
    
-   At least one active non-root compartment
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the Profile menu, select Tenancy, and copy the tenancy OCID.
    
3.  Open Resource Explorer (go to https://cloud.oracle.com/search) and select Advanced resource query.
    
4.  Run the query: query all resources where compartmentId = '<tenancy-ocid>'
    
5.  Ignore resources that must stay in the root, such as policies, compartments, tag namespaces, and identity domains.
    
6.  If any other resources are listed, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Run the Resource Explorer query from the test plan to list the resources in the root compartment.
    
3.  For each resource, open its details page, select Move resource (or Change compartment) from the Actions menu, choose the correct child compartment, and confirm.
    
4.  Update any policies that referred to the root compartment for these resources.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the moved resource, select Move resource, and choose the root compartment again.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/compartments/managingcompartments.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/compartments/managingcompartments.htm)
    
-   [https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-IAM/check-for-root-compartment-resources.html](https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-IAM/check-for-root-compartment-resources.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.