Description
Ensure the tenancy has at least one active compartment other than the root compartment, so that resources can be organized by team, application, or environment. Compartments are the main way to separate resources and control who can access them in OCI.
Rationale
Without child compartments, all resources end up in the root compartment, where policies apply to the whole tenancy. This makes it impossible to give a team access to only its own resources. Creating compartments is the foundation for least-privilege policies, separate environments, and cleaner cost and access reviews.
Impact
Enables separation of resources by team or environment
Allows narrow, compartment-level policies
Resources may need to be moved into the new compartments
Default Value
By default, a new tenancy has only the root compartment, plus in some cases a ManagedCompartmentForPaaS compartment created by Oracle.
Pre-Requisites
Tenancy administrator access
A compartment design, such as one per environment or team
Test Plan
Sign in to the OCI Console at https://cloud.oracle.com.
Open the navigation menu, select Identity & Security, and under Identity select Compartments.
Verify that at least one compartment other than the root is listed with the state Active (ignore ManagedCompartmentForPaaS).
If none exist, follow the implementation steps.
Implementation Steps
Sign in to the OCI Console at https://cloud.oracle.com.
Open the navigation menu, select Identity & Security, and under Identity select Compartments.
Select Create compartment.
Enter a name and description, select the root compartment as the parent, and select Create compartment.
Move resources from the root compartment into the new compartment where appropriate.
Backout Plan
Sign in to the OCI Console at https://cloud.oracle.com.
Open the navigation menu, select Identity & Security, and under Identity select Compartments.
Move any resources out of the new compartment, then open it and select Delete.
Reference