Check ID: identity_no_resources_in_root_compartment
Provider: Oracle Cloud (OCI)
Service: identity
Severity: HIGH
Categories: trust-boundaries, identity-access
Resource type: Compartment

​
What this check verifies

OCI root compartment is evaluated for the presence of user resources. The finding highlights any assets created at the tenancy root and provides a count per resource_type.

​
Risk

Resources in the root compartment inherit broad tenancy-level policies, weakening least privilege. Compromise or error can enable wide unauthorized access, lateral movement, and destructive changes, degrading confidentiality and integrity, while complicating audits and quota governance.

​
Recommendation

Reserve the root compartment for governance only.
  • Create workload-specific child compartments
  • Scope IAM to them per least privilege and separation of duties
  • Enforce boundaries with quotas and tags
  • Update automation to avoid root placement
  • Regularly audit and relocate stray resources

​
Remediation

# Place resources in a non-root compartment to avoid creating them in the root
resource "oci_core_vcn" "<example_resource_name>" {
  compartment_id = "<example_compartment_id>" # CRITICAL: ensure this is a non-root compartment OCID to pass the check
  cidr_block     = "10.0.0.0/16"
  display_name   = "<example_resource_name>"
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_no_resources_in_root_compartment. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks