Working on Oracle Cloud: Compartments, IAM Policies, Security and Billing

Oracle Cloud Infrastructure (OCI) has become a credible alternative to the larger providers on price and performance, and its free tier is unusually generous. What makes OCI feel different is its organizational model: resources live in compartments, and access is granted to groups through written policies. This guide explains the services, the compartment and policy model, the security baseline for a tenancy, and how billing works. For what is included at no cost, see our guide to Oracle Cloud Always Free.

What you can build on Oracle Cloud #

Developers use OCI for isolated environments and the Arm-based Always Free compute; businesses use it for production workloads and database-heavy applications; app teams use the container and functions services to build APIs and full-stack applications.

Compartments: how OCI organizes resources #

Every tenancy has a root compartment. Under it you create compartments to organize resources by project, environment or department, and you can nest them up to six levels deep. Compartments matter for two reasons:

• Access control. When you write a policy, you specify the compartment it applies to. Grouping resources by compartment is what makes least-privilege access practical.
• Cost tracking. Cost analysis can be filtered by compartment, so a well-designed hierarchy doubles as a cost report structure.

Compartments can be moved within the hierarchy; policies may be updated automatically depending on where they are attached, so review policies after a move.

Users, groups and policies #

OCI IAM grants permissions to groups, not directly to users. A user is created with a unique name and email address, receives an activation email from Oracle, and is added to one or more groups. Policies then define what group members may do and where. The policy syntax is readable once you have seen it:

allow group <group-name> to <verb> <resource-type> in <location> where <condition>

The verbs run from inspect (list) through read, use and manage, and the location is a compartment or the tenancy. A typical first policy lets a developers group manage compute instances in a development compartment while only reading them in production.

Securing an OCI tenancy #

1. Use a strong password and MFA for the tenancy administrator. Oracle requires passwords of at least 8 characters with lowercase, uppercase, numeric and special characters.
2. Stop using the administrator for daily work. Create IAM users, put them in groups and grant access through policies.
3. Organize with compartments from the start; retrofitting a compartment structure later is painful.
4. Set budgets and alerts in Billing and Cost Management.
5. Review security lists and network security groups so only required traffic reaches instances. Remember that Oracle Linux and Ubuntu images also run a host firewall.
6. Enable audit and Cloud Guard. The Audit service records API calls; Cloud Guard flags risky configurations.

Management essentials #

• Compartment hierarchy that mirrors how you think about projects and environments.
• Policies written per group and per compartment, reviewed when teams change.
• Tags for cost allocation across compartments.
• Backups for block volumes and databases, with a tested restore.
• Cost monitoring through Cost Analysis, filtered by compartment and tag.
• Administrator changes are handled through Oracle’s service request process rather than informally.

How Oracle Cloud billing works #

• Free Trial: a one-time credit (US$300 at the time of writing) valid for up to 30 days, usable on most OCI services.
• Always Free resources: a fixed set of compute, database, storage and networking allowances that do not expire and remain available after the trial.
• Pay As You Go: no commitment; you pay for usage above the Always Free allowances.
• Upgrading: can be done at any time from the Upgrade link in the Console banner, and you keep access to your resources after upgrading.
• Trial expiry: the account stays active and Always Free resources continue. Paid resources created with trial credit are reclaimed unless you upgrade.
• Region note: Free Tier and Always Free are not available in US Government Cloud regions, and Always Free compute can only be created in your home region.

Cost habits: set a budget alert immediately after upgrading, look for the Always Free-eligible label when creating resources, right-size flexible shapes, and delete resources you no longer use. Our guide to free trials and credits compared shows how Oracle’s offer stacks up.

A first-week checklist for a new tenancy #

1. Enable MFA on the administrator and create an IAM user for yourself in an Administrators group.
2. Create compartments for at least dev and prod, and a shared network compartment if teams will share a VCN.
3. Write one policy per team group scoped to its compartment, and test it with a non-admin user.
4. Set a budget with an alert before creating paid resources.
5. Create a VCN with the wizard and tighten the default security list.
6. Turn on Cloud Guard and review its first findings.

Official references #

The OCI documentation covers compartments, IAM policy syntax, billing and the free tier. Our Oracle Cloud platform overview summarizes the platform and how to sign up officially.

Frequently asked questions #

How do I manage an Oracle Cloud account?

Through the OCI Console, or the OCI CLI, SDKs and Terraform provider for automation. Resources are organized with compartments and access is managed with groups and policies.

How deep can compartments go?

Up to six levels below the root compartment. Most teams need two or three.

What happens to my resources when the trial ends?

Always Free resources keep running. Resources beyond the Always Free limits that were funded by trial credit are stopped and later reclaimed unless you upgrade to Pay As You Go.