What is Security Zone in OCI:

Security Zones in OCI are a governance feature that lets you attach a strict set of security policies to a compartment — any resource created inside automatically must comply, or OCI blocks the action outright.

In other word OCI Security Zone is a compartment with strict security rules.

Usage — what people actually use it for:

1. Enforcing production-grade security automatically instead of relying on manual code review
2. Preventing accidental internet exposure — blocks public subnets, public IPs, internet gateways by default
3. Mandating encryption — forces CMK/Vault encryption on Block Volume, Object Storage, boot volumes
4. Compliance-driven workloads — banking, healthcare, government where security policy must be enforced, not just documented

Requirements:

Limitations:

1. One-way restrictive — you cannot loosen rules per-resource; the whole compartment follows the recipe
2. Not retroactive — resources already violating the policy must be fixed/moved before the zone activates
3. Limited service coverage — not every OCI service is Security-Zone-enabled; some newer services aren't covered yet
4. No partial exceptions — you can't whitelist one non-compliant resource inside an otherwise-compliant zone
5. Compartment-level only — can't apply Security Zone rules to individual resources outside a compartment structure

Steps to create a Security Zone in OCI:

Setting up a Security Zone is a 5-step flow — define what's disallowed (recipe), pick a clean compartment, attach the recipe, let OCI validate, and once active, every future resource creation attempt is checked against those rules automatically — no manual review needed.

1. • Create a Security Zone Recipe (or use an Oracle-maximum-security default recipe) — defines which policies will be enforced
2. • Choose/create the target compartment — must be dedicated, ideally empty
3. • Attach the recipe to the compartment — this activates the Security Zone
4. • OCI validates compliance — checks for any existing non-compliant resources
5. • Zone becomes active — all future resource creation is now policy-enforced

Default nature:

• Resources in a security zone must not be accessible from the public internet by default.
• A compartment and all its subcompartments belong to the same security zone by default — though you can assign a different security zone to a subcompartment if needed.
• Every tenancy has a predefined Maximum Security Recipe — Oracle-managed, curated, and cannot be modified by customers.
• Security Zone rules are enforced regardless of IAM role — even a tenancy admin cannot override a Security Zone policy violation through elevated permissions.
• Cloud Guard must be enabled first — you cannot create Security Zones without Cloud Guard turned on, since Cloud Guard helps detect violations in resources that existed before the zone was created.