{"id":971,"date":"2026-04-17T08:08:29","date_gmt":"2026-04-17T08:08:29","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-security-guide-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/"},"modified":"2026-04-17T08:08:29","modified_gmt":"2026-04-17T08:08:29","slug":"oracle-cloud-security-guide-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/oracle-cloud-security-guide-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/","title":{"rendered":"Oracle Cloud Security Guide Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Security, Identity, and Compliance"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Security, Identity, and Compliance<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>Oracle Cloud\u2019s <strong>Security Guide<\/strong> is <strong>not a billable, \u201cenable\/disable\u201d cloud service<\/strong> in the same way that Compute, Object Storage, or Vault are. In Oracle Cloud Infrastructure (OCI), <strong>Security Guide<\/strong> is the <strong>official documentation guide<\/strong> that explains OCI\u2019s security model and describes how to use OCI security capabilities (IAM, networking controls, encryption, logging\/auditing, governance, and more) to design and operate secure workloads.<\/p>\n\n\n\n<p>In simple terms: <strong>Security Guide is the playbook<\/strong>. It tells you <em>what to secure<\/em>, <em>why it matters<\/em>, and <em>how to configure OCI services safely<\/em>.<\/p>\n\n\n\n<p>In technical terms: the Oracle Cloud <strong>Security Guide<\/strong> documents OCI\u2019s <strong>shared responsibility model<\/strong>, <strong>identity and access control patterns<\/strong>, <strong>network security primitives<\/strong>, <strong>data protection mechanisms<\/strong>, <strong>logging\/auditing<\/strong>, and <strong>operational security practices<\/strong>. Teams use it to build a <strong>repeatable security baseline<\/strong> and to align deployments with internal policies and external compliance expectations.<\/p>\n\n\n\n<p>The problem it solves is common: OCI offers many security and governance controls, but without a clear, centralized reference, teams can end up with inconsistent IAM policies, overexposed networks, unmanaged secrets, and incomplete audit trails. <strong>Security Guide<\/strong> reduces that risk by providing a coherent, official reference for secure design and operations in Oracle Cloud.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is Security Guide?<\/h2>\n\n\n\n<p><strong>Official purpose (OCI):<\/strong><br\/>\nOracle Cloud\u2019s <strong>Security Guide<\/strong> is Oracle\u2019s official security documentation for OCI. It explains how to secure OCI environments and how to use OCI security-related services and features correctly. You\u2019ll find it in the OCI documentation set on Oracle\u2019s docs site. Start here and navigate to the Security Guide:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI docs home: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/home.htm  <\/li>\n<li>Security Guide entry point (verify the latest URL structure in docs): https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Security\/Concepts\/security.htm<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Core capabilities (what it provides)<\/h3>\n\n\n\n<p>Because Security Guide is documentation, its \u201ccapabilities\u201d are best understood as the <strong>topics and implementation guidance<\/strong> it covers:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI security model and <strong>shared responsibility<\/strong><\/li>\n<li><strong>IAM<\/strong> concepts and policy patterns (users, groups, dynamic groups, compartments)<\/li>\n<li><strong>Network security<\/strong> basics (VCNs, security lists, NSGs, gateways, routing)<\/li>\n<li><strong>Data protection<\/strong> guidance (encryption, key management, secrets)<\/li>\n<li><strong>Logging, auditing, and monitoring<\/strong> fundamentals<\/li>\n<li>Secure operations practices: least privilege, segmentation, change control, incident response<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Major components (how it\u2019s organized)<\/h3>\n\n\n\n<p>Security Guide typically includes (structure can change; verify in official docs):<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Conceptual sections: security principles, responsibility model<\/li>\n<li>Service-focused guidance: IAM, networking, encryption, auditing, etc.<\/li>\n<li>Best practices and recommended configurations<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Service type<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Type:<\/strong> Documentation \/ reference guide (not a metered cloud resource)<\/li>\n<li><strong>How it\u2019s consumed:<\/strong> Browser-based docs, used by architects, engineers, and auditors<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scope (regional\/global)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The <strong>Security Guide content is global<\/strong> (documentation).<\/li>\n<li>The OCI services it describes may be <strong>regional<\/strong> (for example, Vault is regionally deployed), <strong>tenancy-scoped<\/strong> (IAM), or <strong>resource-scoped<\/strong> (VCNs, instances, buckets).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How it fits into the Oracle Cloud ecosystem<\/h3>\n\n\n\n<p>In the <strong>Security, Identity, and Compliance<\/strong> category, Security Guide is the <strong>authoritative entry point<\/strong> that ties together security-relevant OCI services such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>IAM<\/strong> (Identity and Access Management): https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm  <\/li>\n<li><strong>Vault \/ Key Management \/ Secrets<\/strong>: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/KeyManagement\/home.htm  <\/li>\n<li><strong>Audit<\/strong>: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Audit\/home.htm  <\/li>\n<li><strong>Logging<\/strong>: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Logging\/home.htm  <\/li>\n<li><strong>Cloud Guard<\/strong> (security posture management; verify current feature set and pricing): https:\/\/docs.oracle.com\/en-us\/iaas\/cloud-guard\/home.htm  <\/li>\n<li><strong>Security Zones<\/strong> (policy-based guardrails; verify availability and behavior): https:\/\/docs.oracle.com\/en-us\/iaas\/security-zone\/home.htm  <\/li>\n<\/ul>\n\n\n\n<p>Security Guide helps you understand <strong>when<\/strong> and <strong>how<\/strong> to use these services safely.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use Security Guide?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reduce breach risk<\/strong> by following Oracle-recommended patterns for segmentation, least privilege, and encryption.<\/li>\n<li><strong>Speed up audits<\/strong> with consistent security controls and clearer evidence trails (audit logs, configuration standards).<\/li>\n<li><strong>Lower operational cost of security<\/strong> by reducing rework (fixing open networks, rotating leaked secrets, refactoring IAM).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Reference for OCI-specific security primitives<\/strong> (compartments, policy language, dynamic groups, NSGs vs security lists).<\/li>\n<li>Helps teams avoid \u201clift-and-shift misconfigurations\u201d where cloud-native security controls are misunderstood.<\/li>\n<li>Provides baseline guidance for foundational controls: identity boundaries, network isolation, and key\/secret management.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enables a <strong>repeatable security baseline<\/strong> across environments (dev\/test\/prod).<\/li>\n<li>Improves onboarding: new engineers can follow the same official playbook.<\/li>\n<li>Supports consistent incident response preparation: logging, auditability, and access review become standard.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Helps implement common compliance expectations (least privilege, encryption, audit trails, separation of duties).<\/li>\n<li>Improves governance through compartment strategy and policy guardrails.<\/li>\n<li>Supports documenting security decisions using an official Oracle reference.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<p>Security Guide is not a runtime service, but it helps you scale safely by:\n&#8211; Encouraging <strong>compartment design<\/strong> that scales across teams and cost centers\n&#8211; Promoting <strong>network segmentation<\/strong> that scales with microservices and multi-tier architectures\n&#8211; Promoting <strong>centralized logging<\/strong> patterns that scale with traffic<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose it<\/h3>\n\n\n\n<p>Use Security Guide when you need:\n&#8211; A <strong>trusted baseline<\/strong> for securing OCI resources\n&#8211; A starting point for designing <strong>landing zones<\/strong>, guardrails, and access boundaries\n&#8211; A common reference for platform teams, app teams, and auditors<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it (or should supplement it)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If you need <strong>automated enforcement<\/strong>, Security Guide alone won\u2019t do that; you\u2019ll need services like Cloud Guard\/Security Zones (and\/or Terraform, policy-as-code, CI\/CD controls).<\/li>\n<li>If you need <strong>regulatory mapping<\/strong> to a specific framework (CIS, NIST, ISO), you may need additional framework-specific documentation and tooling. Security Guide can still be a core reference, but not the only one.<\/li>\n<li>If your environment spans multiple clouds, you\u2019ll also want multi-cloud governance standards (e.g., internal security standards plus cloud-specific guidance).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is Security Guide used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Financial services and fintech (access control, auditability, encryption)<\/li>\n<li>Healthcare and life sciences (data protection, logging)<\/li>\n<li>Retail\/e-commerce (web security, segmentation, DDoS\/WAF patterns)<\/li>\n<li>SaaS and technology (least privilege and secure-by-default infrastructure)<\/li>\n<li>Public sector (governance, access separation, monitoring)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud platform teams (landing zones, guardrails)<\/li>\n<li>Security engineering (policies, encryption, logging)<\/li>\n<li>DevOps\/SRE (secure pipelines, operational hardening)<\/li>\n<li>Application teams (secure service-to-service access, secrets management)<\/li>\n<li>Compliance\/audit teams (evidence and control validation)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internet-facing web apps (WAF\/LB patterns, network segmentation)<\/li>\n<li>APIs and microservices (NSGs, private subnets, secrets)<\/li>\n<li>Data platforms (Object Storage, databases, encryption keys)<\/li>\n<li>Batch and analytics (secure instance principals, least privilege policies)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Single tenancy, multi-compartment org design<\/li>\n<li>Hub-and-spoke networking<\/li>\n<li>Multi-region DR (requires careful key\/log replication planning; verify service capabilities)<\/li>\n<li>Hybrid connectivity to on-prem (VPN\/FastConnect with security boundaries)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Real-world deployment contexts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Establishing an OCI \u201clanding zone\u201d for multiple teams<\/li>\n<li>Hardening a new VCN and IAM model for a production environment<\/li>\n<li>Designing audit readiness: logs + access review processes<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Dev\/test:<\/strong> Use Security Guide to define minimal guardrails (least privilege, basic segmentation) so dev environments don\u2019t become risk magnets.<\/li>\n<li><strong>Production:<\/strong> Use it to define standardized controls, formal review points (IAM, network, keys\/secrets, logs), and to support evidence for audits.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic ways teams use Oracle Cloud <strong>Security Guide<\/strong> in practice. Since Security Guide is documentation, each scenario shows <em>how the guide informs what you configure<\/em> in OCI.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1) Building a secure OCI landing zone<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams create ad-hoc compartments, policies, and networks that become unmanageable and risky.<\/li>\n<li><strong>Why Security Guide fits:<\/strong> It provides foundational guidance on identity, compartments, network isolation, encryption, and logging.<\/li>\n<li><strong>Scenario:<\/strong> A platform team standardizes a tenancy structure (root + environment compartments), defines IAM guardrails, and creates secure VCN templates.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">2) Designing least-privilege IAM policies for teams<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Overly broad \u201cmanage all-resources\u201d policies are common and dangerous.<\/li>\n<li><strong>Why it fits:<\/strong> Security Guide explains IAM concepts and best practices like least privilege and separation of duties.<\/li>\n<li><strong>Scenario:<\/strong> Dev team gets permission to manage compute in a compartment, but not keys, networking, or IAM.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">3) Implementing separation of duties (SoD)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> One admin account has too much power; mistakes or compromise become catastrophic.<\/li>\n<li><strong>Why it fits:<\/strong> The guide emphasizes governance and access control patterns.<\/li>\n<li><strong>Scenario:<\/strong> Separate groups for network admins, app deployers, and key admins; restrict cross-role access.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">4) Securing a VCN and subnets for a 3-tier app<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Applications are deployed in public subnets with permissive security lists.<\/li>\n<li><strong>Why it fits:<\/strong> Security Guide describes network security building blocks and secure connectivity patterns.<\/li>\n<li><strong>Scenario:<\/strong> Only the load balancer sits in a public subnet; app and database remain private with tightly-scoped NSGs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">5) Establishing a secrets management approach<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Secrets are stored in source code, CI variables without lifecycle controls, or shared docs.<\/li>\n<li><strong>Why it fits:<\/strong> The guide points to encryption and secret handling best practices.<\/li>\n<li><strong>Scenario:<\/strong> Use OCI Vault Secrets for DB passwords and API keys; restrict secret read access to runtime identities.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6) Audit logging and investigation readiness<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> After an incident, teams can\u2019t answer \u201cwho changed what, when, and from where?\u201d<\/li>\n<li><strong>Why it fits:<\/strong> Security Guide highlights logging\/auditing and accountability.<\/li>\n<li><strong>Scenario:<\/strong> Use OCI Audit and Logging to centralize log access; define retention and review procedures.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7) Standardizing encryption and key ownership<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams don\u2019t know when to use Oracle-managed keys vs customer-managed keys (CMKs).<\/li>\n<li><strong>Why it fits:<\/strong> The guide explains encryption at rest, key management concepts, and where keys fit.<\/li>\n<li><strong>Scenario:<\/strong> Production data uses customer-managed keys in Vault; access to keys is limited to a key admin group.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">8) Enforcing guardrails with Security Zones (where applicable)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Teams accidentally create public buckets or overly permissive network rules.<\/li>\n<li><strong>Why it fits:<\/strong> Security Guide helps you understand guardrails and governance services.<\/li>\n<li><strong>Scenario:<\/strong> A \u201cprod\u201d compartment is configured as a Security Zone to prevent disallowed configurations (verify exact guardrail behavior in docs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9) Improving cloud posture with Cloud Guard (where applicable)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Misconfigurations accumulate across compartments; manual review doesn\u2019t scale.<\/li>\n<li><strong>Why it fits:<\/strong> The guide provides context for posture management and detection.<\/li>\n<li><strong>Scenario:<\/strong> Enable Cloud Guard targets for production compartments and configure detector\/responder recipes (verify pricing and regional availability).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">10) Creating a secure onboarding checklist for new projects<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> Every new project repeats the same security questions and mistakes.<\/li>\n<li><strong>Why it fits:<\/strong> Security Guide is a stable reference for \u201cminimum required controls\u201d.<\/li>\n<li><strong>Scenario:<\/strong> New project checklist: compartments, IAM groups, VCN segmentation, Vault secrets, audit validation, tagging.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Because <strong>Security Guide<\/strong> is documentation, its \u201cfeatures\u201d are best described as the <strong>security topics and implementation guidance<\/strong> it provides for OCI. The value is in accuracy, completeness, and being Oracle-authored.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 1: OCI shared responsibility model guidance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Explains what Oracle secures vs what the customer must secure (identity, data, configuration).<\/li>\n<li><strong>Why it matters:<\/strong> Prevents gaps such as assuming Oracle configures IAM least privilege for you.<\/li>\n<li><strong>Practical benefit:<\/strong> Clear accountability boundaries for audits and internal security reviews.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Shared responsibility details can differ by service; always verify service-specific docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 2: IAM concepts and policy language orientation<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Helps you understand compartments, groups, policies, and (where used) dynamic groups and instance principals.<\/li>\n<li><strong>Why it matters:<\/strong> IAM is the control plane for everything else; mistakes here are systemic.<\/li>\n<li><strong>Practical benefit:<\/strong> Faster creation of least-privilege policies and safer administrative workflows.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> OCI IAM has evolved (including Identity Domains). Tenancy experience varies; verify your tenancy\u2019s IAM model in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 3: Network security fundamentals (VCN, subnets, NSGs\/security lists)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Documents network isolation approaches and traffic control primitives.<\/li>\n<li><strong>Why it matters:<\/strong> Public exposure is one of the most common cloud risks.<\/li>\n<li><strong>Practical benefit:<\/strong> Better subnet design, fewer \u201c0.0.0.0\/0 to everything\u201d rules, safer connectivity.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Implementation details differ per architecture (hub\/spoke, multi-region). Use reference architectures where possible.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 4: Data protection and encryption guidance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Explains encryption considerations and where OCI provides encryption at rest\/in transit options.<\/li>\n<li><strong>Why it matters:<\/strong> Encryption is often a compliance requirement and reduces breach impact.<\/li>\n<li><strong>Practical benefit:<\/strong> Helps teams choose between default encryption vs customer-managed keys (CMKs) and implement key governance.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Key lifecycle, rotation, and availability requirements must be validated per service.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 5: Logging and auditing guidance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Directs teams to Audit and Logging capabilities for traceability and investigations.<\/li>\n<li><strong>Why it matters:<\/strong> If you can\u2019t prove what changed, you can\u2019t reliably troubleshoot or investigate incidents.<\/li>\n<li><strong>Practical benefit:<\/strong> Repeatable operational controls: log access policies, retention planning, review routines.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Log retention, export, and storage costs can vary. Verify default retention and export options in docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 6: Governance practices (compartments, tagging, control boundaries)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Encourages clean compartment design and consistent resource organization.<\/li>\n<li><strong>Why it matters:<\/strong> Governance decisions determine whether security scales across teams.<\/li>\n<li><strong>Practical benefit:<\/strong> Simplifies policy scope, cost tracking, and environment separation.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Refactoring compartment design later can be disruptive; plan early.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Feature 7: Secure operations mindset (hardening, change control, response)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Promotes operational security practices: access reviews, incident preparedness, and secure configuration habits.<\/li>\n<li><strong>Why it matters:<\/strong> Many breaches come from process failures, not missing features.<\/li>\n<li><strong>Practical benefit:<\/strong> Builds a culture of least privilege, verification, and logging-first operations.<\/li>\n<li><strong>Limitations\/caveats:<\/strong> Documentation doesn\u2019t enforce behavior\u2014pair it with automation and governance.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">High-level architecture (what \u201cusing Security Guide\u201d means)<\/h3>\n\n\n\n<p>Security Guide itself doesn\u2019t process requests or store your data. Instead:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>People and processes<\/strong> (architects, security, DevOps) consult the Security Guide.<\/li>\n<li>Teams translate guidance into <strong>OCI configuration<\/strong>: IAM policies, network segmentation, Vault keys\/secrets, logging\/auditing, and (optionally) posture management.<\/li>\n<li>Operations teams validate continuously with <strong>Audit logs<\/strong>, logging pipelines, and periodic reviews.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Request\/data\/control flow (practical)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane actions<\/strong> (creating a VCN, updating a policy, creating a secret) are performed via OCI Console\/CLI\/API.<\/li>\n<li>These actions are recorded in <strong>Audit<\/strong>.<\/li>\n<li>Workloads (compute, containers, functions, etc.) access secrets\/keys via <strong>runtime identity<\/strong> (where applicable) and service endpoints inside a region.<\/li>\n<li>Network exposure is controlled via <strong>VCN routing + security lists\/NSGs<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Integrations with related services (documented by Security Guide)<\/h3>\n\n\n\n<p>Security Guide commonly references or aligns with:\n&#8211; <strong>IAM<\/strong> for authorization\n&#8211; <strong>Vault<\/strong> for key\/secret management\n&#8211; <strong>Audit + Logging<\/strong> for observability and accountability\n&#8211; <strong>Cloud Guard \/ Security Zones<\/strong> for posture\/guardrails (verify applicability to your tenancy\/region)\n&#8211; <strong>Networking<\/strong> components for segmentation and private access<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dependency services<\/h3>\n\n\n\n<p>Security Guide itself has no dependencies; it is documentation. The <em>implementations<\/em> it describes depend on:\n&#8211; IAM, compartments, identity domains\n&#8211; VCN and related network services\n&#8211; Vault and key management (for CMKs\/secrets)\n&#8211; Logging\/Audit services<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Access to OCI APIs uses IAM identities (users, groups, federation) or workload identities (dynamic groups\/instance principals where applicable).<\/li>\n<li>Authorization is enforced by <strong>policy statements<\/strong> in OCI IAM.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security Guide typically promotes private networking patterns where possible:<\/li>\n<li>Private subnets for workloads<\/li>\n<li>Minimal inbound access (prefer bastions or zero-trust access patterns; verify OCI\u2019s current recommended approach)<\/li>\n<li>Tight NSG rules for service-to-service communication<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure <strong>Audit<\/strong> access is restricted and monitored.<\/li>\n<li>Centralize logs where practical.<\/li>\n<li>Use tagging and compartments to simplify governance.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Simple architecture diagram (conceptual)<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  A[Architects \/ DevOps \/ Security Engineers] --&gt; B[Oracle Cloud Security Guide (Docs)]\n  B --&gt; C[IAM: Compartments, Groups, Policies]\n  B --&gt; D[Network: VCN, Subnets, NSGs\/Sec Lists]\n  B --&gt; E[Data Protection: Vault Keys &amp; Secrets]\n  B --&gt; F[Observability: Audit + Logging]\n  C --&gt; G[OCI Resources: Compute, DB, Storage]\n  D --&gt; G\n  E --&gt; G\n  F --&gt; H[Investigation \/ Compliance Evidence]\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Production-style architecture diagram (example)<\/h4>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Tenancy[OCI Tenancy]\n    subgraph Root[Root Compartment]\n      IAM[IAM Policies + Identity Domains]\n      AUD[Audit (Control Plane Events)]\n      LOG[Logging \/ Log Groups]\n      CG[Cloud Guard \/ Security Zones (optional; verify)]\n    end\n\n    subgraph Net[Networking Compartment]\n      VCN[Hub VCN]\n      DRG[DRG \/ Connectivity (optional)]\n      WAF[Web Application Firewall (optional)]\n    end\n\n    subgraph Prod[Prod App Compartment]\n      LB[Load Balancer - Public Subnet]\n      APP[App Tier - Private Subnet]\n      DB[Database - Private Subnet]\n      NSG[NSGs (least privilege)]\n      VAULT[Vault: CMKs + Secrets]\n      OS[Object Storage Bucket (private)]\n    end\n  end\n\n  Users[Internet Users] --&gt; WAF --&gt; LB\n  LB --&gt; APP\n  APP --&gt; DB\n  APP --&gt; OS\n  APP --&gt; VAULT\n\n  IAM -.authz.-&gt; LB\n  IAM -.authz.-&gt; APP\n  IAM -.authz.-&gt; VAULT\n\n  AUD --&gt; LOG\n  LOG --&gt; SIEM[External SIEM \/ SOC Tool (optional)]\n  CG --&gt; SecOps[Security Ops Review &amp; Response]\n<\/code><\/pre>\n\n\n\n<p>Notes:\n&#8211; WAF\/Cloud Guard\/Security Zones\/SIEM are optional and depend on requirements and availability.\n&#8211; Validate each component\u2019s availability and pricing in your region.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Because Security Guide is documentation, the prerequisites apply to the <strong>hands-on implementation<\/strong> you\u2019ll perform in OCI.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Tenancy\/account requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>An <strong>Oracle Cloud (OCI) tenancy<\/strong> with permission to create IAM and basic resources.<\/li>\n<li>Access to the OCI Console.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<p>For the lab, you typically need one of:\n&#8211; Membership in the <strong>Administrators<\/strong> group in the tenancy, <strong>or<\/strong>\n&#8211; Equivalent permissions to manage:\n  &#8211; Compartments\n  &#8211; Users\/groups\/policies (or identity domain administration, depending on tenancy setup)\n  &#8211; VCN resources\n  &#8211; Vault (keys\/secrets)\n  &#8211; Audit event viewing<\/p>\n\n\n\n<p>If your organization separates duties, coordinate with:\n&#8211; IAM administrators (for users\/policies)\n&#8211; Network administrators (for VCN)\n&#8211; Key administrators (for Vault)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security Guide itself: no billing.<\/li>\n<li>The lab can be run low-cost, but some resources (Vault, Logging storage\/archival, optional compute) may generate charges depending on your tenancy and region. Always review the OCI cost estimator and your tenancy\u2019s rate card.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tools (recommended)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI CLI<\/strong> (for verification and repeatability):<br\/>\n  https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/li>\n<li>A terminal and a text editor.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security Guide docs: global.<\/li>\n<li>Services used in the lab (Vault, Logging, etc.) are regional\u2014confirm they are available in your chosen region in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IAM objects (users\/groups\/policies), VCN limits, Vault limits, etc. vary by tenancy.<\/li>\n<li>If you hit a limit, request a quota increase through OCI support (process varies by account type).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>IAM (always present)<\/li>\n<li>Networking (VCN)<\/li>\n<li>Vault (if you do the secrets portion)<\/li>\n<li>Audit (for verification)<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What Security Guide costs<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Security Guide (documentation): $0<\/strong><\/li>\n<li>There is no metering, no SKU, and nothing to \u201cdeploy.\u201d<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What you <em>implement<\/em> based on Security Guide may cost<\/h3>\n\n\n\n<p>Most teams use Security Guide to configure other OCI services. Those services can have usage-based pricing. Common cost areas:<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Pricing dimensions to watch<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Vault \/ Key Management \/ Secrets<\/strong><\/li>\n<li>Pricing often depends on the number of vaults, keys, secret versions, and cryptographic operations (exact dimensions vary\u2014verify on the pricing page).<\/li>\n<li><strong>Logging<\/strong><\/li>\n<li>Potential costs for log ingestion, retention, storage, and export destinations.<\/li>\n<li><strong>Object Storage<\/strong><\/li>\n<li>Storage consumed, requests, and retrieval (depending on tier).<\/li>\n<li><strong>Compute \/ Load Balancer \/ WAF<\/strong><\/li>\n<li>If you deploy workloads as part of security validation, those resources can dominate cost.<\/li>\n<li><strong>Networking<\/strong><\/li>\n<li>Data egress to the internet, inter-region transfer, and some connectivity components can have charges.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Free tier considerations<\/h4>\n\n\n\n<p>Oracle has an OCI Free Tier\/Always Free offering, but eligibility and included services vary and can change.\n&#8211; Verify current Free Tier details: https:\/\/www.oracle.com\/cloud\/free\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Cost drivers (direct + indirect)<\/h3>\n\n\n\n<p><strong>Direct:<\/strong>\n&#8211; Vault usage (keys, secrets, operations)\n&#8211; Log volume and retention\n&#8211; Compute\/LB\/WAF resources if deployed<\/p>\n\n\n\n<p><strong>Indirect\/hidden:<\/strong>\n&#8211; <strong>Data egress<\/strong> (especially exporting logs to external SIEMs)\n&#8211; Storage growth from retained logs, snapshots, backups\n&#8211; Operational overhead if you choose self-managed tools instead of managed services<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centralizing logs across regions or exporting outside OCI can create measurable egress charges.<\/li>\n<li>Prefer in-region aggregation where possible and only export what\u2019s required.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How to optimize cost (without weakening security)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with <strong>least-privilege IAM and network segmentation<\/strong>\u2014these are high impact, low cost.<\/li>\n<li>Use logging intentionally:<\/li>\n<li>Keep high-value logs longer; reduce retention for noisy logs where acceptable.<\/li>\n<li>Export logs selectively (security-relevant categories).<\/li>\n<li>Use Vault strategically:<\/li>\n<li>Use CMKs for regulated datasets; use default encryption where appropriate.<\/li>\n<li>Avoid unnecessary secret version churn.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Example low-cost starter estimate (qualitative)<\/h3>\n\n\n\n<p>A minimal security baseline can often be achieved with:\n&#8211; Compartments + IAM policies + Audit verification\n&#8211; A small VCN configuration\nThis may cost <strong>near $0<\/strong>, excluding any optional compute\/testing resources.<br\/>\nIf you add Vault and extended logging retention\/export, costs can increase. <strong>Use the cost estimator<\/strong> to model your environment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example production cost considerations<\/h3>\n\n\n\n<p>In production, costs depend on:\n&#8211; Number of compartments\/projects\n&#8211; Number of apps and environments\n&#8211; Log volume (apps + infrastructure + audit exports)\n&#8211; Vault usage patterns (keys\/secrets\/ops)\n&#8211; Security services enabled (e.g., WAF, posture management)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Official pricing resources<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Oracle Cloud pricing overview: https:\/\/www.oracle.com\/cloud\/pricing\/<\/li>\n<li>OCI cost estimator: https:\/\/www.oracle.com\/cloud\/costestimator.html  <\/li>\n<li>OCI price list (if applicable in your procurement model): https:\/\/www.oracle.com\/cloud\/price-list\/<br\/>\nAlways validate pricing for your region and contract.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab is designed to be <strong>beginner-friendly<\/strong>, <strong>low-risk<\/strong>, and <strong>practical<\/strong>. You will use the <strong>Security Guide<\/strong> as your reference mindset and implement a small security baseline in OCI: compartment isolation, least-privilege administration, Vault secret storage, and audit verification.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<p>Create a secure \u201cproject compartment\u201d with:\n&#8211; A dedicated compartment boundary\n&#8211; A least-privilege admin group for that compartment\n&#8211; A basic VCN with safe defaults\n&#8211; A Vault and a secret (for credential hygiene)\n&#8211; Verification using Audit events<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will:\n1. Create a compartment for the lab.\n2. Create a group and user for scoped administration (or map to your identity domain).\n3. Create an IAM policy granting scoped permissions in only that compartment.\n4. Configure MFA for the lab user (recommended).\n5. Create a VCN with private subnet-first thinking.\n6. Create a Vault, a key, and a secret.\n7. Validate actions by querying Audit events.\n8. Clean up resources to avoid ongoing costs.<\/p>\n\n\n\n<blockquote>\n<p>Notes on IAM experience: OCI tenancies can use <strong>IAM with Identity Domains<\/strong> (common in newer tenancies) or legacy\/classic patterns. Follow your organization\u2019s standard and <strong>verify in official docs<\/strong> if the screens differ.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Choose a region and set up OCI CLI (optional but recommended)<\/h3>\n\n\n\n<p><strong>Console action<\/strong>\n&#8211; Log in to the OCI Console and confirm your <strong>region<\/strong> in the top navigation.<\/p>\n\n\n\n<p><strong>CLI action<\/strong>\nInstall and configure the OCI CLI:\n&#8211; Install guide: https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/p>\n\n\n\n<p>Then configure:<\/p>\n\n\n\n<pre><code class=\"language-bash\">oci setup config\n<\/code><\/pre>\n\n\n\n<p>You\u2019ll provide:\n&#8211; Tenancy OCID\n&#8211; User OCID\n&#8211; Region (e.g., <code>us-ashburn-1<\/code>)\n&#8211; Generate API keys (store your private key securely)<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You can run:<\/p>\n\n\n\n<pre><code class=\"language-bash\">oci iam region list --all\n<\/code><\/pre>\n\n\n\n<p>\u2026and get a JSON response.<\/p>\n\n\n\n<p><strong>Verification<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">oci os ns get\n<\/code><\/pre>\n\n\n\n<p>This should return your Object Storage namespace.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a compartment for the lab<\/h3>\n\n\n\n<p>Compartment design is a core OCI governance control emphasized in Security Guide concepts.<\/p>\n\n\n\n<p><strong>Console action<\/strong>\n1. Go to <strong>Identity &amp; Security<\/strong> \u2192 <strong>Compartments<\/strong>\n2. Click <strong>Create Compartment<\/strong>\n3. Name: <code>security-guide-lab<\/code>\n4. Description: <code>Security Guide baseline lab<\/code>\n5. Parent compartment: choose a parent appropriate for labs (often root, but follow org policy)<\/p>\n\n\n\n<p><strong>CLI action (alternative)<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">oci iam compartment create \\\n  --compartment-id &lt;ROOT_COMPARTMENT_OCID&gt; \\\n  --name security-guide-lab \\\n  --description \"Security Guide baseline lab\" \\\n  --wait-for-state ACTIVE\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; A compartment exists and is in <strong>ACTIVE<\/strong> state.<\/p>\n\n\n\n<p><strong>Verification<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">oci iam compartment list --compartment-id &lt;ROOT_COMPARTMENT_OCID&gt; --all \\\n  --query \"data[?name=='security-guide-lab'] | [0].{name:name, id:id, lifecycle:lifecycle-state}\"\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Create a scoped admin group and user (or identity domain equivalent)<\/h3>\n\n\n\n<p>Security Guide principles strongly encourage <strong>separation of duties<\/strong> and avoiding daily work from tenancy-wide admin identities.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Option A (common pattern): OCI IAM user\/group (if applicable in your tenancy)<\/h4>\n\n\n\n<p><strong>Console action<\/strong>\n1. Go to <strong>Identity &amp; Security<\/strong> \u2192 <strong>Users<\/strong> \u2192 <strong>Create User<\/strong>\n   &#8211; Name: <code>sglab-user<\/code>\n2. Go to <strong>Groups<\/strong> \u2192 <strong>Create Group<\/strong>\n   &#8211; Name: <code>SecurityGuideLabAdmins<\/code>\n3. Add <code>sglab-user<\/code> to <code>SecurityGuideLabAdmins<\/code><\/p>\n\n\n\n<p><strong>CLI action (alternative)<\/strong><\/p>\n\n\n\n<pre><code class=\"language-bash\">oci iam group create --name SecurityGuideLabAdmins --description \"Scoped admins for Security Guide lab\"\noci iam user create --name sglab-user --description \"User for Security Guide lab\"\noci iam group add-user --group-id &lt;GROUP_OCID&gt; --user-id &lt;USER_OCID&gt;\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Option B: Identity Domains (if your tenancy uses them)<\/h4>\n\n\n\n<p>If your tenancy uses <strong>Identity Domains<\/strong>, user\/group management may be done inside the domain (often a \u201cDefault\u201d domain). The UI and APIs differ from classic IAM user management.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Identity Domains documentation entry point (verify current docs path):<br\/>\n  https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/li>\n<\/ul>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You have a user identity and a group to attach policies to.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Confirm group membership in the Console.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Create a least-privilege policy scoped to the compartment<\/h3>\n\n\n\n<p>Instead of giving the lab user tenancy admin, create a policy that only grants admin rights <strong>inside the lab compartment<\/strong>.<\/p>\n\n\n\n<p><strong>Console action<\/strong>\n1. Go to <strong>Identity &amp; Security<\/strong> \u2192 <strong>Policies<\/strong>\n2. Ensure you are creating the policy in the correct parent compartment (often <strong>root<\/strong>; OCI policies are frequently managed at higher scope\u2014follow org standards).\n3. Click <strong>Create Policy<\/strong>\n4. Name: <code>security-guide-lab-admin-policy<\/code>\n5. Policy statements (example):<\/p>\n\n\n\n<pre><code class=\"language-text\">Allow group SecurityGuideLabAdmins to manage all-resources in compartment security-guide-lab\n<\/code><\/pre>\n\n\n\n<blockquote>\n<p>This is intentionally broad <em>within the lab compartment<\/em> for learning. For production, you usually split duties (network admins, app deployers, key admins) and avoid <code>manage all-resources<\/code> wherever possible.<\/p>\n<\/blockquote>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Members of <code>SecurityGuideLabAdmins<\/code> can create\/manage resources in <code>security-guide-lab<\/code> but not elsewhere.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Sign in as <code>sglab-user<\/code> (or use federation\/identity domain login as configured).\n&#8211; Try to view resources in other compartments: you should have limited\/no access depending on defaults.<\/p>\n\n\n\n<p><strong>Common propagation note<\/strong>\n&#8211; IAM policy changes can take a short time to propagate. If you get authorization errors immediately, wait a few minutes and retry.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Enable MFA for the lab user (recommended)<\/h3>\n\n\n\n<p>MFA is a foundational control frequently required for compliance.<\/p>\n\n\n\n<p><strong>Console action (Identity Domains)<\/strong>\n&#8211; Go to <strong>Identity &amp; Security<\/strong> \u2192 <strong>Domains<\/strong>\n&#8211; Select your domain (e.g., \u201cDefault\u201d)\n&#8211; Find <strong>Security<\/strong> \/ <strong>MFA<\/strong> settings\n&#8211; Enforce MFA for the user or relevant group (options vary; <strong>verify in official docs<\/strong>)<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; User enrollment or enforcement of MFA for interactive console login.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Log out and log back in as the user; confirm MFA challenge occurs as configured.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Create a VCN with safe defaults (private-first)<\/h3>\n\n\n\n<p>Networking misconfiguration is a common root cause of exposure. This step creates a basic VCN to demonstrate controlled connectivity.<\/p>\n\n\n\n<p><strong>Console action<\/strong>\n1. Go to <strong>Networking<\/strong> \u2192 <strong>Virtual Cloud Networks<\/strong>\n2. Select compartment: <code>security-guide-lab<\/code>\n3. Click <strong>Create VCN<\/strong>\n4. Choose <strong>VCN with Internet Connectivity<\/strong> <em>only if you truly need public access for testing<\/em>.\n   &#8211; For a stricter posture, choose a workflow that creates private subnets and add only required gateways later.\n5. Name: <code>sglab-vcn<\/code>\n6. Review subnet types and security rules:\n   &#8211; Prefer <strong>private subnets<\/strong> for workloads.\n   &#8211; Avoid broad inbound rules like <code>0.0.0.0\/0<\/code> to SSH\/RDP.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; A VCN exists with subnets and route tables appropriate to your selection.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\n&#8211; Confirm subnet(s) and check default security list rules.\n&#8211; Tighten any overly permissive inbound rules if the wizard created them.<\/p>\n\n\n\n<p><strong>Practical hardening (quick win)<\/strong>\nIf you created a public subnet:\n&#8211; Remove inbound SSH\/RDP from <code>0.0.0.0\/0<\/code> unless you have a strong reason.\n&#8211; Prefer a controlled access pattern (bastion\/zero-trust access). OCI has a Bastion service\u2014verify current best practices in official docs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Create a Vault, a key, and a secret<\/h3>\n\n\n\n<p>Secrets handling is a major theme in secure cloud operations.<\/p>\n\n\n\n<p><strong>Console action<\/strong>\n1. Go to <strong>Identity &amp; Security<\/strong> \u2192 <strong>Vault<\/strong>\n2. Ensure compartment: <code>security-guide-lab<\/code>\n3. Click <strong>Create Vault<\/strong>\n   &#8211; Name: <code>sglab-vault<\/code>\n4. After the vault is ACTIVE, create a <strong>Master Encryption Key<\/strong> (MEK):\n   &#8211; Name: <code>sglab-key<\/code>\n5. Create a <strong>Secret<\/strong>:\n   &#8211; Name: <code>sglab-db-password<\/code> (example)\n   &#8211; Secret content: use a random value (do not use real production passwords)<\/p>\n\n\n\n<blockquote>\n<p>Vault and secrets pricing varies. Verify pricing and consider cleanup to avoid recurring cost.<\/p>\n<\/blockquote>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Vault created\n&#8211; Key created\n&#8211; Secret stored and access controlled by IAM policies<\/p>\n\n\n\n<p><strong>Verification (CLI example)<\/strong>\nList vaults in the compartment:<\/p>\n\n\n\n<pre><code class=\"language-bash\">oci kms vault list --compartment-id &lt;SECURITY_GUIDE_LAB_COMPARTMENT_OCID&gt;\n<\/code><\/pre>\n\n\n\n<p>List secrets in the compartment:<\/p>\n\n\n\n<pre><code class=\"language-bash\">oci vault secret list --compartment-id &lt;SECURITY_GUIDE_LAB_COMPARTMENT_OCID&gt;\n<\/code><\/pre>\n\n\n\n<p>If CLI commands differ due to CLI version\/service naming, <strong>verify in official Vault CLI docs<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Verify accountability with Audit events<\/h3>\n\n\n\n<p>Audit verification is how you prove \u201cthis control is operating\u201d and how you investigate changes.<\/p>\n\n\n\n<p><strong>CLI action<\/strong>\nQuery Audit events for your tenancy over a short time window (example shows the idea; adjust timestamps):<\/p>\n\n\n\n<pre><code class=\"language-bash\">oci audit event list \\\n  --compartment-id &lt;TENANCY_OCID&gt; \\\n  --start-time \"2026-04-17T00:00:00Z\" \\\n  --end-time \"2026-04-17T23:59:59Z\"\n<\/code><\/pre>\n\n\n\n<p>To narrow results, filter client-side (example uses <code>jq<\/code>):<\/p>\n\n\n\n<pre><code class=\"language-bash\">oci audit event list \\\n  --compartment-id &lt;TENANCY_OCID&gt; \\\n  --start-time \"2026-04-17T00:00:00Z\" \\\n  --end-time \"2026-04-17T23:59:59Z\" \\\n| jq '.data[] | {time:.eventTime, user:.principalName, name:.eventName, resource:.resourceName}'\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You can see events corresponding to compartment creation, policy updates, VCN creation, and Vault actions.<\/p>\n\n\n\n<p><strong>Verification (Console)<\/strong>\n&#8211; Go to <strong>Identity &amp; Security<\/strong> \u2192 <strong>Audit<\/strong>\n&#8211; Filter by compartment, time, or event type.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>You should be able to confirm all of the following:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Compartment isolation<\/strong>\n   &#8211; Resources created in <code>security-guide-lab<\/code> are logically separated from other projects.<\/li>\n<li><strong>Scoped administration<\/strong>\n   &#8211; <code>sglab-user<\/code> (or your lab identity) can manage resources in <code>security-guide-lab<\/code>.\n   &#8211; The same user does <strong>not<\/strong> have broad tenancy-wide admin unless explicitly granted.<\/li>\n<li><strong>Network posture awareness<\/strong>\n   &#8211; VCN exists and you reviewed inbound rules to avoid accidental exposure.<\/li>\n<li><strong>Secret storage<\/strong>\n   &#8211; A secret exists in Vault and is not stored in code or plain text docs.<\/li>\n<li><strong>Auditability<\/strong>\n   &#8211; Audit events exist for the actions you performed.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Error: <code>NotAuthorizedOrNotFound<\/code><\/h4>\n\n\n\n<p>Common causes:\n&#8211; Policy is attached to the wrong group or wrong compartment scope.\n&#8211; You created the policy in a compartment that doesn\u2019t apply where you expect (policy scoping can be confusing at first).\n&#8211; IAM propagation delay.<\/p>\n\n\n\n<p>Fixes:\n&#8211; Re-check policy statement spelling (group name, compartment name).\n&#8211; Wait a few minutes and retry.\n&#8211; Confirm the user is in the correct group.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Error: \u201cI can\u2019t find Users\/Groups where expected\u201d<\/h4>\n\n\n\n<p>Cause:\n&#8211; Your tenancy may be using <strong>Identity Domains<\/strong> where user\/group management is domain-based.<\/p>\n\n\n\n<p>Fix:\n&#8211; Use the <strong>Domains<\/strong> section for identities, or follow your org\u2019s federation approach.\n&#8211; Verify identity model in official docs.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Error: Vault\/key\/secret operations fail<\/h4>\n\n\n\n<p>Common causes:\n&#8211; Missing permissions for Vault (<code>vaults<\/code>, <code>keys<\/code>, <code>secret-family<\/code> permissions).\n&#8211; Region mismatch (trying to access a vault in a different region).\n&#8211; Resource still provisioning.<\/p>\n\n\n\n<p>Fix:\n&#8211; Confirm you are in the same region as the vault.\n&#8211; Ensure IAM policies include required Vault permissions (verify exact policy statements in Vault docs).\n&#8211; Wait for ACTIVE lifecycle states.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Error: Audit events not showing<\/h4>\n\n\n\n<p>Common causes:\n&#8211; Wrong time window (UTC vs local time).\n&#8211; Searching in the wrong compartment context.\n&#8211; Insufficient permission to view audit events.<\/p>\n\n\n\n<p>Fix:\n&#8211; Expand the time range.\n&#8211; Confirm you\u2019re using the tenancy OCID for some queries.\n&#8211; Verify Audit access permissions in docs.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing cost and reduce clutter, remove lab resources. Perform cleanup in this order:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Delete secrets<\/strong> (if created)<br\/>\n   &#8211; In Vault: delete the secret (and any secret versions, depending on UI\/workflow).<\/li>\n<li><strong>Schedule deletion for keys and vault (if required)<\/strong><br\/>\n   &#8211; Some Vault resources use scheduled deletion and cannot be instantly removed. Follow the Vault docs for correct lifecycle steps.<\/li>\n<li><strong>Delete VCN resources<\/strong>\n   &#8211; Delete instances (if any), load balancers, NAT gateways, etc.\n   &#8211; Then delete subnets and the VCN.<\/li>\n<li><strong>Remove IAM policy<\/strong>\n   &#8211; Delete <code>security-guide-lab-admin-policy<\/code><\/li>\n<li><strong>Remove IAM user\/group<\/strong>\n   &#8211; Remove user from group\n   &#8211; Delete user and group (or remove identity domain objects if used)<\/li>\n<li><strong>Delete compartment<\/strong>\n   &#8211; Compartments must be empty before deletion.<\/li>\n<\/ol>\n\n\n\n<blockquote>\n<p>If the Console prevents deletion due to dependencies, inspect the compartment for remaining resources and remove them.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Design around <strong>compartments as security boundaries<\/strong>, not just cost buckets.<\/li>\n<li>Use a <strong>multi-compartment strategy<\/strong> (e.g., <code>network<\/code>, <code>security<\/code>, <code>shared<\/code>, <code>dev<\/code>, <code>prod<\/code>) rather than mixing everything in one place.<\/li>\n<li>Prefer <strong>private subnets<\/strong> for compute and databases; expose only what must be public (typically a load balancer\/WAF).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enforce <strong>least privilege<\/strong>:<\/li>\n<li>Start with minimal <code>read<\/code>\/<code>use<\/code> and expand only when required.<\/li>\n<li>Use <strong>separation of duties<\/strong>:<\/li>\n<li>Different groups for IAM admin, network admin, app deployer, key admin, audit reader.<\/li>\n<li>Protect break-glass accounts:<\/li>\n<li>Strong MFA<\/li>\n<li>Minimal use<\/li>\n<li>Monitored and documented<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices (security-driven)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Don\u2019t export or retain all logs indefinitely\u2014retain what you need for risk and compliance.<\/li>\n<li>Use Vault strategically; avoid creating redundant keys and secret versions.<\/li>\n<li>Review egress costs for SIEM exports and cross-region log aggregation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Network security should not require overly complex routing if a simpler segmentation meets the need.<\/li>\n<li>Keep security controls close to the workload (NSGs, private endpoints) rather than relying solely on perimeter rules.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Treat key management and secrets as <strong>critical dependencies<\/strong>:<\/li>\n<li>Plan for key rotation and access continuity.<\/li>\n<li>Document vault\/key ownership and recovery processes.<\/li>\n<li>Ensure logs and audit evidence are accessible during incidents.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Establish a periodic cadence:<\/li>\n<li>IAM access reviews<\/li>\n<li>Policy linting\/peer review<\/li>\n<li>Network rule review<\/li>\n<li>Key\/secret rotation review<\/li>\n<li>Use Infrastructure as Code (IaC) where possible (e.g., Terraform) to make security repeatable and reviewable.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use consistent naming:<\/li>\n<li><code>env-app-component<\/code> patterns (e.g., <code>prod-payments-vcn<\/code>)<\/li>\n<li>Apply tags for:<\/li>\n<li>Owner, cost center, data classification, environment<\/li>\n<li>Keep a simple but enforced tagging baseline to reduce unmanaged sprawl.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI access is controlled through IAM policies.<\/li>\n<li>Prefer group-based permissions; avoid granting permissions directly to individual users.<\/li>\n<li>Where supported for workloads, consider <strong>workload identities<\/strong> (dynamic groups\/instance principals) so you avoid long-lived user API keys for automation. Validate the correct approach in current IAM docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Understand where OCI provides encryption by default and where you need CMKs.<\/li>\n<li>For high-sensitivity data:<\/li>\n<li>Use <strong>Vault<\/strong> for customer-managed keys and secrets<\/li>\n<li>Restrict key admin privileges tightly<\/li>\n<li>Document key ownership and rotation processes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Default stance: <strong>deny by default<\/strong>, allow explicitly.<\/li>\n<li>Avoid inbound access from <code>0.0.0.0\/0<\/code> unless there is a clear business reason and compensating controls (WAF, strong auth, patching, monitoring).<\/li>\n<li>Use NSGs to restrict east-west traffic between tiers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Do not store secrets in:<\/li>\n<li>Source control<\/li>\n<li>Plaintext config files<\/li>\n<li>Shared chat tools or tickets<\/li>\n<li>Use Vault Secrets (or equivalent) and restrict read access.<\/li>\n<li>Prefer short-lived credentials and rotation where possible.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ensure Audit is accessible to security\/ops but protected from tampering.<\/li>\n<li>Use log retention aligned with compliance needs.<\/li>\n<li>Monitor high-risk activities:<\/li>\n<li>Policy changes<\/li>\n<li>Key\/secret changes<\/li>\n<li>Network security rule changes<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Security Guide is a strong baseline reference but not a compliance certification by itself.<\/li>\n<li>Map your controls to your required framework (CIS\/NIST\/ISO\/SOC2\/etc.) using Security Guide as OCI-specific implementation guidance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Using tenancy-wide admin for daily operations<\/li>\n<li>Overly permissive ingress rules<\/li>\n<li>No MFA for privileged users<\/li>\n<li>Secrets in code or CI variables without lifecycle control<\/li>\n<li>No review of audit logs or no centralized logging strategy<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a \u201csecure-by-default\u201d template:<\/li>\n<li>Compartment structure<\/li>\n<li>IAM groups + policies<\/li>\n<li>Standard VCN patterns<\/li>\n<li>Vault secrets pattern<\/li>\n<li>Audit verification checklist<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Because Security Guide is documentation, most limitations relate to how teams interpret and apply it.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Not an enforcement tool:<\/strong> Security Guide doesn\u2019t automatically detect or fix misconfigurations.<\/li>\n<li><strong>Docs can lag features:<\/strong> OCI evolves; always cross-check service-specific docs and release notes.<\/li>\n<li><strong>Tenancy differences:<\/strong> IAM experience can differ (Identity Domains vs older patterns). Screens and workflows may not match older tutorials.<\/li>\n<li><strong>Policy language learning curve:<\/strong> OCI policy syntax is powerful but easy to mis-scope if you\u2019re new.<\/li>\n<li><strong>Propagation delays:<\/strong> IAM changes may take short time to apply.<\/li>\n<li><strong>Regional behavior:<\/strong> Some services (Vault, Logging) are regional\u2014plan for multi-region carefully.<\/li>\n<li><strong>Cost surprises:<\/strong> Long log retention, exporting logs to external systems, and Vault operations can add cost.<\/li>\n<li><strong>Deletion lifecycle:<\/strong> Vault keys\/vaults may require scheduled deletion; cleanup may not be immediate.<\/li>\n<li><strong>Shared responsibility misunderstanding:<\/strong> Teams may assume Oracle configures security controls; customers must configure IAM\/network\/logging properly.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>Security Guide is best compared to other cloud providers\u2019 official security guidance and to industry benchmarks.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>Oracle Cloud Security Guide (OCI)<\/strong><\/td>\n<td>OCI customers needing official security guidance<\/td>\n<td>OCI-specific, aligned to Oracle services and terminology; good baseline reference<\/td>\n<td>Not an enforcement tool; must be paired with automation and governance<\/td>\n<td>You operate workloads in OCI and need authoritative guidance<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Cloud Guard (service)<\/strong><\/td>\n<td>Detecting misconfigurations and risky activity (verify features\/pricing)<\/td>\n<td>Posture visibility and detection\/responder patterns<\/td>\n<td>Requires enablement and operational ownership; may have costs depending on use<\/td>\n<td>You need scalable detection beyond manual review<\/td>\n<\/tr>\n<tr>\n<td><strong>OCI Security Zones (service)<\/strong><\/td>\n<td>Preventing disallowed configurations via guardrails (verify behavior)<\/td>\n<td>Guardrail approach to reduce accidental exposure<\/td>\n<td>Can restrict flexibility; requires planning<\/td>\n<td>You want enforced preventative controls for sensitive compartments<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Well-Architected Framework \u2013 Security Pillar<\/strong><\/td>\n<td>AWS environments<\/td>\n<td>Strong guidance and review questions<\/td>\n<td>AWS-specific; not OCI<\/td>\n<td>You\u2019re primarily on AWS<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Security Benchmark<\/strong><\/td>\n<td>Azure environments<\/td>\n<td>Control mappings and recommended configurations<\/td>\n<td>Azure-specific; not OCI<\/td>\n<td>You\u2019re primarily on Azure<\/td>\n<\/tr>\n<tr>\n<td><strong>Google Cloud security foundations \/ best practices<\/strong><\/td>\n<td>GCP environments<\/td>\n<td>Clear prescriptive guidance<\/td>\n<td>GCP-specific; not OCI<\/td>\n<td>You\u2019re primarily on GCP<\/td>\n<\/tr>\n<tr>\n<td><strong>CIS Benchmarks \/ CIS Controls<\/strong><\/td>\n<td>Cross-cloud baseline controls<\/td>\n<td>Vendor-neutral control framework<\/td>\n<td>Not OCI-implementation-specific; requires translation<\/td>\n<td>You need an industry baseline across multiple platforms<\/td>\n<\/tr>\n<tr>\n<td><strong>Internal security standards + IaC policy-as-code<\/strong><\/td>\n<td>Enterprises needing consistent enforcement<\/td>\n<td>Enforceable, auditable, standardized<\/td>\n<td>Requires engineering effort and maintenance<\/td>\n<td>You need repeatable guardrails at scale<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: regulated workload with compartment guardrails and key governance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A financial services company must deploy customer-facing APIs on OCI while meeting audit requirements for least privilege, encryption, and change traceability.<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>Tenancy with compartments: <code>security<\/code>, <code>network<\/code>, <code>prod<\/code>, <code>nonprod<\/code><\/li>\n<li>IAM groups: <code>NetworkAdmins<\/code>, <code>AppDeployers<\/code>, <code>KeyAdmins<\/code>, <code>AuditReaders<\/code><\/li>\n<li>VCN hub\/spoke; private subnets for app\/data<\/li>\n<li>Vault with customer-managed keys for sensitive data<\/li>\n<li>Audit + Logging centralized; exports to SIEM (with careful egress planning)<\/li>\n<li>Optional guardrails via Security Zones for <code>prod<\/code> (verify fit)<\/li>\n<li><strong>Why Security Guide was chosen:<\/strong><\/li>\n<li>Provides Oracle-authored guidance aligned to OCI services and terminology.<\/li>\n<li>Acts as a baseline reference for audits and internal architecture reviews.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Reduced over-privileged access<\/li>\n<li>Clear audit evidence for changes and key usage<\/li>\n<li>Consistent network segmentation and reduced public exposure risk<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: secure defaults without heavy tooling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Problem:<\/strong> A startup wants to deploy an app on OCI quickly but avoid common security mistakes (public SSH, shared admin accounts, secrets in code).<\/li>\n<li><strong>Proposed architecture:<\/strong><\/li>\n<li>One compartment per environment (<code>dev<\/code>, <code>prod<\/code>)<\/li>\n<li>Least-privilege group policies per environment<\/li>\n<li>Private subnet for app; only LB public<\/li>\n<li>Vault for app secrets<\/li>\n<li>Audit review checklist after each release<\/li>\n<li><strong>Why Security Guide was chosen:<\/strong><\/li>\n<li>Fast, free, official reference; reduces reliance on guesswork.<\/li>\n<li><strong>Expected outcomes:<\/strong><\/li>\n<li>Faster onboarding and fewer security regressions<\/li>\n<li>Better investor\/customer confidence with basic security hygiene in place<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is Oracle Cloud Security Guide a service I must enable?<\/strong><br\/>\nNo. Security Guide is documentation. You use it to configure actual OCI services (IAM, Vault, networking, logging) securely.<\/p>\n\n\n\n<p>2) <strong>Does Security Guide scan my tenancy for problems?<\/strong><br\/>\nNo. For detection\/scanning, look at services like Cloud Guard (verify current capabilities and pricing).<\/p>\n\n\n\n<p>3) <strong>Where do I start if I\u2019m new to OCI security?<\/strong><br\/>\nStart with Security Guide concepts, then learn IAM (compartments and policies), then VCN security basics, then Vault and Audit\/Logging.<\/p>\n\n\n\n<p>4) <strong>Is Security Guide specific to OCI or all Oracle Cloud products?<\/strong><br\/>\nThe Security Guide referenced here is for <strong>Oracle Cloud Infrastructure (OCI)<\/strong>. Oracle also has security documentation for SaaS applications, but don\u2019t assume they are the same.<\/p>\n\n\n\n<p>5) <strong>Do I need customer-managed keys (CMKs) for everything?<\/strong><br\/>\nNot always. Many services encrypt by default. Use CMKs when you have regulatory requirements, need stronger key control, or require separation of duties. Verify per-service encryption support.<\/p>\n\n\n\n<p>6) <strong>What\u2019s the biggest IAM mistake beginners make in OCI?<\/strong><br\/>\nGranting overly broad privileges (like tenancy-wide admin) for convenience and never reducing them later.<\/p>\n\n\n\n<p>7) <strong>How should I structure compartments?<\/strong><br\/>\nA common approach is environment + shared compartments (e.g., <code>network<\/code>, <code>security<\/code>, <code>dev<\/code>, <code>prod<\/code>). The right structure depends on org and audit needs.<\/p>\n\n\n\n<p>8) <strong>What\u2019s the difference between security lists and NSGs?<\/strong><br\/>\nBoth control traffic. NSGs are commonly used for more granular, workload-oriented security grouping. Exact behavior and best practice can vary\u2014verify in networking docs.<\/p>\n\n\n\n<p>9) <strong>Is Audit always enabled?<\/strong><br\/>\nOCI Audit is generally available for tracking control plane events. Verify defaults, retention, and access controls in the Audit documentation for your tenancy.<\/p>\n\n\n\n<p>10) <strong>How do I prove to auditors that controls are working?<\/strong><br\/>\nUse a combination of: IAM policy reviews, network rule reviews, Vault configuration evidence, and Audit\/Logging evidence of changes and access.<\/p>\n\n\n\n<p>11) <strong>Should I export logs to an external SIEM?<\/strong><br\/>\nIf you have a SOC or compliance requirement, yes\u2014but plan for cost and data governance. Not all environments need external SIEM for every log.<\/p>\n\n\n\n<p>12) <strong>Can I use Security Guide for multi-cloud architectures?<\/strong><br\/>\nYes as OCI-specific guidance, but you\u2019ll also need equivalent guidance for other clouds and a common internal control framework.<\/p>\n\n\n\n<p>13) <strong>How do I implement \u201cleast privilege\u201d without slowing teams down?<\/strong><br\/>\nStart with role-based groups, use compartment scoping, and iterate policies based on real needs. Review permissions regularly.<\/p>\n\n\n\n<p>14) <strong>Does Security Guide replace security training?<\/strong><br\/>\nNo. It complements training by providing OCI-specific reference material and official implementation guidance.<\/p>\n\n\n\n<p>15) <strong>Where can I find the most current Security Guide content?<\/strong><br\/>\nUse the OCI documentation site and navigate to Security Guide from the latest docs index. Bookmark the official entry point and verify URLs as Oracle updates doc structure.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn Security Guide<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Security Guide<\/td>\n<td>Primary official reference for OCI security concepts and practices. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Security\/Concepts\/security.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI IAM Documentation<\/td>\n<td>Core for identities, compartments, and policies. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Vault \/ Key Management<\/td>\n<td>Keys and secrets guidance and APIs. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/KeyManagement\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Audit<\/td>\n<td>Control plane audit events for accountability. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Audit\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Logging<\/td>\n<td>Centralized logging concepts and configuration. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Logging\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Cloud Guard<\/td>\n<td>Posture management and detection (verify pricing\/availability). https:\/\/docs.oracle.com\/en-us\/iaas\/cloud-guard\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>OCI Security Zones<\/td>\n<td>Guardrails for compartments (verify current behavior). https:\/\/docs.oracle.com\/en-us\/iaas\/security-zone\/home.htm<\/td>\n<\/tr>\n<tr>\n<td>Pricing<\/td>\n<td>Oracle Cloud Pricing<\/td>\n<td>Understand service pricing models and regional variation. https:\/\/www.oracle.com\/cloud\/pricing\/<\/td>\n<\/tr>\n<tr>\n<td>Pricing tool<\/td>\n<td>OCI Cost Estimator<\/td>\n<td>Estimate monthly costs for planned architecture. https:\/\/www.oracle.com\/cloud\/costestimator.html<\/td>\n<\/tr>\n<tr>\n<td>Free tier<\/td>\n<td>Oracle Cloud Free Tier<\/td>\n<td>Learn what you can run at low\/no cost (verify current terms). https:\/\/www.oracle.com\/cloud\/free\/<\/td>\n<\/tr>\n<tr>\n<td>Architecture guidance<\/td>\n<td>Oracle Architecture Center<\/td>\n<td>Reference architectures and patterns (search security\/landing zone). https:\/\/docs.oracle.com\/en\/solutions\/<\/td>\n<\/tr>\n<tr>\n<td>CLI documentation<\/td>\n<td>OCI CLI Installation and Setup<\/td>\n<td>Enables repeatable security verification and automation. https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/API\/SDKDocs\/cliinstall.htm<\/td>\n<\/tr>\n<tr>\n<td>Community (use carefully)<\/td>\n<td>OCI GitHub organization<\/td>\n<td>Samples and tooling; validate against official docs. https:\/\/github.com\/oracle\/oci-cli and https:\/\/github.com\/oracle\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Institute<\/th>\n<th>Suitable Audience<\/th>\n<th>Likely Learning Focus<\/th>\n<th>Mode<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps engineers, SREs, platform teams<\/td>\n<td>Cloud\/DevOps practices; may include OCI security fundamentals depending on curriculum<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>ScmGalaxy.com<\/td>\n<td>Beginners to intermediate engineers<\/td>\n<td>DevOps\/SCM foundations; may support cloud governance learning paths<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.scmgalaxy.com\/<\/td>\n<\/tr>\n<tr>\n<td>CLoudOpsNow.in<\/td>\n<td>Cloud operations teams<\/td>\n<td>Cloud operations, monitoring, governance topics<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.cloudopsnow.in\/<\/td>\n<\/tr>\n<tr>\n<td>SreSchool.com<\/td>\n<td>SREs, operations engineers<\/td>\n<td>Reliability + operational controls, incident readiness, observability<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.sreschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>AiOpsSchool.com<\/td>\n<td>Ops engineers exploring AIOps<\/td>\n<td>Monitoring\/automation concepts; may complement logging\/audit workflows<\/td>\n<td>Check website<\/td>\n<td>https:\/\/www.aiopsschool.com\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p>Notes:\n&#8211; For official Oracle certifications, consult Oracle\u2019s certification catalog and OCI-specific tracks (verify the current list and exam codes): https:\/\/education.oracle.com\/<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Platform\/Site<\/th>\n<th>Likely Specialization<\/th>\n<th>Suitable Audience<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>RajeshKumar.xyz<\/td>\n<td>DevOps\/cloud coaching and engineering guidance (verify current offerings)<\/td>\n<td>Engineers wanting mentorship-style learning<\/td>\n<td>https:\/\/rajeshkumar.xyz\/<\/td>\n<\/tr>\n<tr>\n<td>devopstrainer.in<\/td>\n<td>DevOps training content and coaching (verify OCI coverage)<\/td>\n<td>Beginners to intermediate DevOps learners<\/td>\n<td>https:\/\/www.devopstrainer.in\/<\/td>\n<\/tr>\n<tr>\n<td>devopsfreelancer.com<\/td>\n<td>Freelance DevOps support\/training resources (verify scope)<\/td>\n<td>Teams needing practical implementation help<\/td>\n<td>https:\/\/www.devopsfreelancer.com\/<\/td>\n<\/tr>\n<tr>\n<td>devopssupport.in<\/td>\n<td>DevOps support and training resources (verify scope)<\/td>\n<td>Ops\/DevOps teams needing hands-on assistance<\/td>\n<td>https:\/\/www.devopssupport.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Company Name<\/th>\n<th>Likely Service Area<\/th>\n<th>Where They May Help<\/th>\n<th>Consulting Use Case Examples<\/th>\n<th>Website URL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cotocus.com<\/td>\n<td>Cloud\/DevOps consulting (verify OCI focus)<\/td>\n<td>Cloud architecture, automation, governance<\/td>\n<td>Compartment\/IAM redesign, Terraform baselines, logging strategy<\/td>\n<td>https:\/\/www.cotocus.com\/<\/td>\n<\/tr>\n<tr>\n<td>DevOpsSchool.com<\/td>\n<td>DevOps consulting and training (verify service catalog)<\/td>\n<td>DevOps processes, platform engineering, enablement<\/td>\n<td>Secure CI\/CD guidance, operational readiness reviews<\/td>\n<td>https:\/\/www.devopsschool.com\/<\/td>\n<\/tr>\n<tr>\n<td>DEVOPSCONSULTING.IN<\/td>\n<td>DevOps consulting (verify offerings)<\/td>\n<td>Delivery pipelines, cloud ops, reliability practices<\/td>\n<td>Baseline hardening checklist implementation, monitoring\/logging setup<\/td>\n<td>https:\/\/www.devopsconsulting.in\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before Security Guide (recommended foundations)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI basics: regions, compartments, core services<\/li>\n<li>Networking fundamentals: CIDR, routing, firewall concepts<\/li>\n<li>Identity fundamentals: RBAC, least privilege, MFA, federation<\/li>\n<li>Basic cryptography concepts: encryption at rest\/in transit, key rotation, secrets<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after Security Guide (to operationalize it)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>OCI IAM advanced patterns (dynamic groups\/instance principals where applicable)<\/li>\n<li>Vault advanced topics (rotation strategies, access boundaries)<\/li>\n<li>Logging pipelines and SIEM integrations<\/li>\n<li>Cloud Guard and Security Zones (if used in your environment)<\/li>\n<li>Infrastructure as Code (Terraform) for repeatable secure deployments<\/li>\n<li>Threat modeling and incident response playbooks for cloud workloads<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Security Engineer<\/li>\n<li>Cloud Platform Engineer<\/li>\n<li>DevOps Engineer \/ SRE<\/li>\n<li>Solutions Architect<\/li>\n<li>Governance, Risk, and Compliance (GRC) analyst (for evidence mapping)<\/li>\n<li>Cloud Operations Engineer<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (if available)<\/h3>\n\n\n\n<p>Oracle\u2019s certification catalog changes over time. Check the official Oracle Education site for:\n&#8211; OCI Architect certifications\n&#8211; OCI security-focused certifications (if listed; verify current availability and exam codes)<\/p>\n\n\n\n<p>Start here:\n&#8211; https:\/\/education.oracle.com\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Build a two-environment compartment model (<code>dev<\/code> and <code>prod<\/code>) with distinct IAM groups and policies.<\/li>\n<li>Create a private VCN architecture and document inbound\/outbound rules as if for an audit.<\/li>\n<li>Implement Vault secrets for an app and restrict access to runtime identities only.<\/li>\n<li>Create an audit review script using OCI CLI that flags policy changes in the last 24 hours.<\/li>\n<li>Create a \u201csecure baseline\u201d Terraform module (compartment + VCN + minimal policies) and run peer reviews on changes.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>OCI (Oracle Cloud Infrastructure):<\/strong> Oracle\u2019s IaaS cloud platform providing compute, storage, networking, and security services.<\/li>\n<li><strong>Security Guide:<\/strong> Oracle\u2019s official OCI security documentation guide; a reference, not a deployable service.<\/li>\n<li><strong>Tenancy:<\/strong> Your top-level OCI account boundary.<\/li>\n<li><strong>Compartment:<\/strong> A logical isolation boundary used for organizing and controlling access to resources.<\/li>\n<li><strong>IAM (Identity and Access Management):<\/strong> The OCI system for identities, groups, policies, and authorization.<\/li>\n<li><strong>Policy (OCI):<\/strong> A set of statements defining who can do what, where (scope), and on which resources.<\/li>\n<li><strong>Least privilege:<\/strong> Granting only the minimal permissions required to perform a task.<\/li>\n<li><strong>Separation of duties (SoD):<\/strong> Splitting privileged responsibilities across roles\/groups to reduce fraud and error risk.<\/li>\n<li><strong>VCN (Virtual Cloud Network):<\/strong> Your private network in OCI.<\/li>\n<li><strong>Subnet:<\/strong> A segment of a VCN where resources are placed (public or private depending on routing).<\/li>\n<li><strong>NSG (Network Security Group):<\/strong> Security rules applied to a set of VNICs\/resources to control traffic.<\/li>\n<li><strong>Security list:<\/strong> Subnet-level virtual firewall rules in OCI.<\/li>\n<li><strong>Vault:<\/strong> OCI service for key management and secrets storage.<\/li>\n<li><strong>CMK (Customer-Managed Key):<\/strong> A key you control (lifecycle and access) used for encryption.<\/li>\n<li><strong>Secret:<\/strong> Sensitive value stored securely (password, API key) and accessed via controlled permissions.<\/li>\n<li><strong>Audit:<\/strong> OCI service that records control plane API events for accountability.<\/li>\n<li><strong>Logging:<\/strong> OCI service for collecting and managing logs (service logs, custom logs, etc.).<\/li>\n<li><strong>Cloud Guard:<\/strong> OCI service for security posture monitoring and detection (verify current features\/pricing).<\/li>\n<li><strong>Security Zones:<\/strong> OCI guardrails to prevent certain insecure configurations (verify current behavior).<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>Oracle Cloud\u2019s <strong>Security Guide<\/strong> is the <strong>official OCI security reference<\/strong> in the <strong>Security, Identity, and Compliance<\/strong> category. It isn\u2019t a metered service\u2014you don\u2019t deploy it\u2014but it matters because it helps teams design and operate OCI environments with consistent <strong>least privilege<\/strong>, <strong>network segmentation<\/strong>, <strong>encryption and secrets hygiene<\/strong>, and <strong>auditability<\/strong>.<\/p>\n\n\n\n<p>Cost-wise, the guide itself is free, but the OCI services you implement (Vault, logging pipelines, WAF, posture management, and any workloads you deploy) can drive cost\u2014especially log volume\/retention, Vault usage, and data egress.<\/p>\n\n\n\n<p>Use Security Guide when you want an authoritative baseline and a common language for architects, engineers, and auditors. Pair it with automation (IaC), governance processes (reviews, access recertification), and\u2014where needed\u2014detective\/preventative services (Cloud Guard, Security Zones) to operationalize secure-by-default OCI.<\/p>\n\n\n\n<p>Next step: read the Security Guide, then implement a small baseline like the lab in this tutorial, and expand it into a repeatable landing zone pattern for your organization.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security, Identity, and Compliance<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[62,39],"tags":[],"class_list":["post-971","post","type-post","status-publish","format-standard","hentry","category-oracle-cloud","category-security-identity-and-compliance"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=971"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/971\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}