OCI Governance Should Have Custom Compartments Created

oci setup config

oci iam compartment list --compartment-id-in-subtree false --access-level ACCESSIBLE

TENANCY_OCID="<your-tenancy-ocid>"

COMPARTMENT_NAME="custom-governance-comp"
COMPARTMENT_DESC="Custom compartment for governance / resource segregation"

oci iam compartment create \
  --compartment-id "$TENANCY_OCID" \
  --name "$COMPARTMENT_NAME" \
  --description "$COMPARTMENT_DESC"

oci iam compartment list \
  --compartment-id "$TENANCY_OCID" \
  --access-level ANY \
  --compartment-id-in-subtree false \
  --all \
  | jq '.data[] | {name, id, "lifecycle-state"}'

for env in dev test prod; do
  oci iam compartment create \
    --compartment-id "$TENANCY_OCID" \
    --name "comp-$env" \
    --description "Compartment for $env environment"
done

import oci
from oci.identity import IdentityClient

# ------------ CONFIGURATION ------------
OCI_CONFIG_FILE = "~/.oci/config"
OCI_PROFILE = "DEFAULT"  # change if needed

# Desired compartment structure
# Each entry is: { name, description, parent_key }
# parent_key 'TENANCY_ROOT' means direct child of tenancy
DESIRED_COMPARTMENTS = [
    {"key": "SEC_GOV_ROOT", "name": "security-governance-root",
     "description": "Root compartment for security & governance resources",
     "parent_key": "TENANCY_ROOT"},

    {"key": "SEC_MONITORING", "name": "security-monitoring",
     "description": "Compartment for governance and security monitoring services",
     "parent_key": "SEC_GOV_ROOT"},

    {"key": "COMPLIANCE_LOGS", "name": "compliance-logs",
     "description": "Compartment for compliance-related logs and artifacts",
     "parent_key": "SEC_GOV_ROOT"},
]


def get_compartment_by_name(identity_client, parent_ocid, name):
    """
    Return the first ACTIVE compartment with a given name under a parent,
    or None if not found.
    """
    comps = oci.pagination.list_call_get_all_results(
        identity_client.list_compartments,
        parent_ocid,
        compartment_id_in_subtree=False,
        access_level="ANY"
    ).data

    for c in comps:
        if c.name == name and c.lifecycle_state == "ACTIVE":
            return c
    return None


def main():
    # Load config
    config = oci.config.from_file(OCI_CONFIG_FILE, OCI_PROFILE)

    # Create Identity client
    identity_client = IdentityClient(config)

    tenancy_id = config["tenancy"]

    # Cache map: key -> compartment_ocid
    compartment_ids = {}

    # The tenancy root is a special "parent"
    compartment_ids["TENANCY_ROOT"] = tenancy_id

    # Process in multiple passes until all parents are resolved
    # This allows children to reference parents defined earlier in the list
    remaining = DESIRED_COMPARTMENTS.copy()

    # Continue until all compartments created or no more progress
    while remaining:
        progress_made = False
        still_remaining = []

        for item in remaining:
            parent_key = item["parent_key"]

            if parent_key not in compartment_ids:
                # Parent not yet created/resolved
                still_remaining.append(item)
                continue

            parent_ocid = compartment_ids[parent_key]
            name = item["name"]
            description = item["description"]

            # Check if compartment already exists
            existing = get_compartment_by_name(identity_client, parent_ocid, name)

            if existing:
                print(f"[INFO] Compartment '{name}' already exists: {existing.id}")
                compartment_ids[item["key"]] = existing.id
            else:
                print(f"[INFO] Creating compartment '{name}' under parent {parent_ocid}...")
                create_details = oci.identity.models.CreateCompartmentDetails(
                    compartment_id=parent_ocid,
                    name=name,
                    description=description
                )
                response = identity_client.create_compartment(create_details)
                new_comp = response.data
                print(f"[INFO] Created compartment '{name}' with OCID: {new_comp.id}")
                compartment_ids[item["key"]] = new_comp.id

            progress_made = True

        if not progress_made:
            raise RuntimeError(
                "Could not resolve parents for some compartments; "
                "check 'parent_key' values and ordering."
            )

        remaining = still_remaining

    print("\n[SUMMARY] Final compartment mapping:")
    for k, v in compartment_ids.items():
        print(f"  {k}: {v}")


if __name__ == "__main__":
    main()

# Create a custom compartment instead of using the root tenancy
resource "oci_identity_compartment" "APP_COMPARTMENT" {
  # Replace with your tenancy OCID (root)
  compartment_id = "ocid1.tenancy.oc1..ROOT_TENANCY_OCID"

  name        = "APP_COMPARTMENT_NAME"   # e.g. "prod-apps"
  description = "Application resources compartment for PROD"
  enable_delete = false
}

# Example: place governed resources into the custom compartment,
# not directly into the root tenancy.
resource "oci_core_vcn" "APP_VCN" {
  # Previously this was set to the tenancy OCID (root); that is what
  # triggered the governance finding. It must point to a custom compartment.
  compartment_id = oci_identity_compartment.APP_COMPARTMENT.id

  cidr_block   = "10.0.0.0/16"
  display_name = "APP_VCN"
  dns_label    = "appvcn"
}

# Repeat the same pattern for every OCI resource that is currently
# using the root tenancy OCID as compartment_id:
# - Change compartment_id from "ocid1.tenancy.oc1..ROOT_TENANCY_OCID"
#   to oci_identity_compartment.APP_COMPARTMENT.id (or other custom compartment).
#
# Example for an OCI Logging log group used by Governance Monitoring:
resource "oci_logging_log_group" "GOV_MONITORING_LOG_GROUP" {
  compartment_id = oci_identity_compartment.APP_COMPARTMENT.id

  display_name = "gov-monitoring-logs"
  description  = "Log group for governance / CIS monitoring"
}

# NOTE: Moving existing resources between compartments is effectively a move
# operation in OCI. When you change compartment_id in Terraform for resources
# that already exist, OCI may treat it as a move or a replace depending on
# the resource type; confirm impact before applying in production.