I85PREP
⌘ K
OCI Migration Architect Pro study materials
OCI Migration Architect Pro study resources

OCI Migration Architect Pro: Landing Zone, Identity, and Governance Design for Migration

OCI Migration Architect Pro · Work through your exam, one topic at a time.

All guide sections

Landing Zone, Identity, and Governance Design for Migration

What this domain tests

Landing zone design: tenancy and compartment hierarchy, identity domains and federation, IAM policy structure, network topology, and guardrails such as Cloud Guard, Security Zones, budgets, and quotas. The exam checks that the target tenancy can absorb migrated workloads without redesign later.

Core rules and concepts

  • Compartments are the unit of isolation and policy scope. Design the hierarchy (workload > environment > tier) before creating resources, because policies inherit downward.
  • IAM grants access to groups at a compartment; use dynamic groups with instance principals for workloads that call OCI APIs.
  • Federation: OCI IAM identity domains support SAML 2.0 and OIDC with an external IdP. Map IdP groups to OCI groups and keep one break-glass local administrator.
  • A baseline from the Landing Zone service or the CIS OCI Foundations Benchmark gives logging, Cloud Guard, VCN layout, and budgets in a repeatable form.
  • Network landing zone: hub-and-spoke VCNs per environment, DRG for transit, Service Gateway for Object Storage, no public IPs on database tiers.
  • Governance: defined tags for cost allocation, budgets with alerts, quota policies to cap spend, Security Zones to deny public buckets.

Worked example

Requirement: three environments, 40 app teams, and a rule that production buckets can never be public. Design: tenancy root; a shared Platform compartment for network and security; one compartment per team under Prod and NonProd; policy Allow group AppTeamA to manage instance-family in compartment Prod-AppTeamA; a Security Zone recipe on Prod compartments denying public buckets; a defined tag CostCenter enforced by tag default; a budget with 80% and 100% alerts. Each item maps to one governance requirement, so nothing is added "for later".

Traps that cost marks

  • Dropping everything in the root compartment, which makes least privilege impossible.
  • Using security lists for micro-segmentation when NSGs are the correct tool.
  • Federation with no break-glass path when the IdP is unavailable.
  • Designing tags after migration, so cost reports cannot attribute spend to the teams that caused it.
  • Granting manage all-resources in tenancy because policy writing felt slow.