OCI Security Professional key terms

A logical container within an OCI tenancy used to organize and isolate resources for access control and cost tracking. Policies and quotas can be scoped to individual compartments, and resources inherit permissions from the compartment hierarchy.

The root compartment created when an OCI account is registered. It contains all compartments, users, and resources, and the tenancy administrator holds broad control over the entire cloud environment.

A set of human-readable statements granting groups or dynamic groups access to resources in specified compartments. Each statement names a verb, a resource type, a compartment scope, and optional conditions.

A single rule inside an IAM policy written as allow group X to verb resource-type in compartment Y. Conditions can narrow when the statement applies, such as restricting by request time or resource tags.

A collection of IAM users that policies reference collectively. Permissions are granted to groups rather than individual users, simplifying administration and supporting least-privilege design across the tenancy.

An individual identity that authenticates to OCI with credentials such as a password, API signing key, or auth token. Users belong to one or more groups that determine their effective permissions.

A group whose membership is defined by matching rules on resource attributes rather than by explicit user assignment. It lets compute instances or functions call OCI APIs without storing long-lived user credentials.

An authentication mechanism allowing a compute instance to obtain short-lived credentials automatically based on its membership in a dynamic group. It removes the need to embed user API keys on the instance.

A credential model where a managed OCI service, such as Functions or Autonomous Database, authenticates to other OCI services using its own identity instead of a user's keys.

Integration of an external identity provider with OCI IAM so users sign in with existing enterprise credentials. SAML federation maps external identity-provider groups to OCI groups for authorization.

An isolation boundary inside OCI IAM that holds its own users, groups, and identity-provider configuration. Domains support separating workforces or customers while sharing one tenancy.

A public-private key pair a user registers so that API requests can be signed and verified. The private key stays with the client and must be protected like a password.

A credential generated for an IAM user to authenticate to certain OCI services and registries, such as Container Registry and Object Storage APIs. Tokens should be rotated and never committed to code.

An optional clause in a policy statement that restricts when the statement applies, for example by request time window, source IP address, or resource tag value. Conditions enable finer-grained least privilege.

A tag key created in a tenancy with a namespace, description, and optional value list, used consistently across resources. Defined tags can drive policy conditions and cost or compliance reporting.

A simple key-value pair attached directly to a resource without a predefined namespace. It is flexible for ad hoc labeling but is not validated and cannot be used in policy conditions.

A software-defined network in OCI with a chosen CIDR range that hosts subnets, gateways, route tables, and security rules. It is the foundational building block for all cloud network security.

A subdivision of a VCN's address space that can be public or private and is tied to an availability domain or regional scope. Instances in a subnet inherit its route table and security lists.

A set of stateless ingress and egress rules applied to every VNIC in a subnet. Because it is stateless, return traffic must be explicitly permitted by matching rules.

A stateful virtual firewall applied to selected VNICs rather than whole subnets. NSGs allow granular, per-workload rules and automatically permit return traffic for allowed connections.

A firewall rule where traffic returning on an established connection is automatically allowed without a separate rule. NSG rules are stateful, while security list rules are not.

A gateway that provides a path between a VCN and the public internet for resources with public IP addresses. It is required for inbound and outbound internet traffic to public subnets.

A gateway allowing instances in private subnets to initiate outbound internet connections without exposing them to inbound traffic. It translates private addresses to a public address.

A gateway that lets private subnets reach supported OCI services, such as Object Storage, without traversing the internet. Traffic stays on the Oracle network, reducing exposure.

A set of rules directing traffic from a subnet to a destination through a gateway or peer. Every subnet uses a route table, and the default table applies unless another is associated.

A component that connects two VCNs in the same region for private traffic. Peering requires matching route rules in both VCNs and is not transitive.

A component that links VCNs across regions through a dynamic routing gateway. It enables private cross-region traffic without public internet exposure.

A virtual router that attaches a VCN to external networks such as on-premises sites over VPN or FastConnect, and to other VCNs through remote peering.

An encrypted IPsec tunnel between an on-premises network and a VCN through a dynamic routing gateway. It secures traffic over the public internet for hybrid connectivity.

A dedicated private network connection between an on-premises data center and OCI, bypassing the public internet. It offers predictable latency and higher bandwidth than VPN tunnels.

A subnet whose instances have no public IP addresses and cannot be reached directly from the internet. Outbound access typically flows through a NAT or service gateway.

A virtual network interface card attached to a compute instance, carrying its private IP addresses and security group memberships. Multiple VNICs can attach an instance to several subnets.

An OCI Key Management service container that holds encryption keys and secrets. Vaults can be virtual, shared, or dedicated, each offering different isolation and certification characteristics.

A key stored in a vault that protects data encryption keys and is never exported in plaintext. It can be rotated, and its lifecycle states control whether protected data remains accessible.

A key used to encrypt bulk data, often itself wrapped by a master encryption key. This envelope approach limits how much data a single key must directly protect.

A scheme where a data key encrypts the data and a master key encrypts the data key. It improves performance and simplifies rotation because only the wrapped key changes.

A numbered instance of a master encryption key created during rotation. New versions encrypt new data while older versions remain available to decrypt existing ciphertext.

The practice of generating a new key version on a schedule or after suspected compromise. Rotation limits the data protected by any single key version without re-encrypting everything.

A sensitive value such as a password, token, or certificate stored in an OCI Vault. Applications retrieve secrets through the service instead of hardcoding credentials in configuration.

An encryption key that the customer creates and controls in OCI Vault rather than one managed by Oracle. It gives control over rotation, lifecycle, and access policy.

A key created and rotated automatically by Oracle for a service when the customer does not supply their own. It reduces operational effort but offers less control over key lifecycle.

Encryption at rest for buckets and objects, available with Oracle-managed keys or customer-managed keys from a vault. Bucket-level defaults apply to objects unless overridden.

Encryption at rest for block storage volumes, applied by default with Oracle-managed keys and optionally with customer-managed keys at volume creation. Keys cannot be changed after creation.

A service that records API activity in a tenancy, capturing who made a request, what resource was affected, when, and from where. Logs support investigations and compliance evidence.

The OCI service for collecting and managing logs from resources, including audit, service, and custom logs. Logs can be searched, archived to Object Storage, or forwarded to other tools.

A log emitted by an OCI service, such as VCN flow logs or load balancer access logs, that is enabled per resource and stored in a log group.

A record of traffic accepted or rejected by security lists and NSGs in a VCN. Flow logs help detect unexpected connectivity and support network forensics.

A logical container in OCI Logging that holds related logs and defines retention and access settings. Logs are enabled into a group and can be searched together.

A service that detects risky configurations and suspicious activity against security recipes and responds with problems and responder actions. It provides continuous posture visibility across a tenancy.

A Cloud Guard feature that enforces a set of maximum-security policies on compartments, preventing creation or modification of resources that violate the recipe. It blocks noncompliant changes rather than only reporting them.

A Cloud Guard rule that automatically acts on detected problems, such as disabling a public bucket or stopping an instance. Responders reduce response time for common misconfigurations.

An OCI service that scans compute instances and container images for known vulnerabilities and reports findings. It helps prioritize patching based on severity and exposure.

A managed service providing time-limited, audited SSH sessions to private compute instances without exposing them to the internet or deploying a jump host.