Tenancy has at least one active non-root compartment

Check ID: identity_non_root_compartment_exists
Provider: Oracle Cloud (OCI)
Service: identity
Severity: HIGH
Categories: identity-access, trust-boundaries
Resource type: Compartment

What this check verifies

OCI tenancy includes at least one active non-root compartment. Only compartments below the root level are considered, indicating that resources are organized outside the root scope.

Risk

Using only the root compartment removes segmentation and forces broad tenancy-wide access. This endangers confidentiality and integrity through cross-project visibility, mis-scoped policies, and accidental changes with global impact, and can affect availability via bulk deletions or misconfigurations.

Recommendation

Create dedicated non-root compartments per workload, environment, or team; avoid placing resources in the root compartment. Apply granular policies at the compartment level to enforce least privilege and separation of duties. Use a clear hierarchy and tags, and review the design regularly as the tenancy evolves.

Remediation

CLI
Terraform
Dashboard steps

oci iam compartment create —compartment-id <tenancy_ocid> —name <compartment_name> —description ‘<description>’

# Creates a non-root compartment under the tenancy to pass the check
resource "oci_identity_compartment" "<example_resource_name>" {
  compartment_id = "<example_resource_id>" # Critical: parent OCID (tenancy) for non-root compartment
  name           = "<example_resource_name>" # Critical: compartment name
  description    = "compartment"             # Critical: required to create
}

References

https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcompartments.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_non_root_compartment_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

No resources exist in the root compartment Password policy expires passwords within 365 days

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires