Back to Checks
oraclecloud

No resources exist in the root compartment

identity_no_resources_in_root_compartment
Service: identitySeverity: high
OfficialBuilt-inVerified
Categories:trust-boundariesidentity-access
Resource Type:Compartment

OCI root compartment is evaluated for the presence of user resources. The finding highlights any assets created at the tenancy root and provides a count per resource_type.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Resources in the root compartment inherit broad tenancy-level policies, weakening least privilege. Compromise or error can enable wide unauthorized access, lateral movement, and destructive changes, degrading confidentiality and integrity, while complicating audits and quota governance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks identity_no_resources_in_root_compartment

Recommendation

Reserve the root compartment for governance only.

  • Create workload-specific child compartments
  • Scope IAM to them per least privilege and separation of duties
  • Enforce boundaries with quotas and tags
  • Update automation to avoid root placement
  • Regularly audit and relocate stray resources

Remediation

Terraform

# Place resources in a non-root compartment to avoid creating them in the root
resource "oci_core_vcn" "<example_resource_name>" {
  compartment_id = "<example_compartment_id>" # CRITICAL: ensure this is a non-root compartment OCID to pass the check
  cidr_block     = "10.0.0.0/16"
  display_name   = "<example_resource_name>"
}

Other

1In the OCI Console, go to Governance & Administration > Tenancy Explorer
2Set Compartment to the root compartment and enable "Show resources in subcompartments" off
3Note each resource listed in the root compartment
4For each resource: navigate to its service page (e.g., Compute > Instances), select the resource, click Actions (three dots) > Move resource
5Choose a non-root compartment and confirm
6If a resource type cannot be moved, delete it and recreate it in a non-root compartment
7Repeat until Tenancy Explorer shows 0 resources in the root compartment

Check Code

"""Check if no resources are created in the root compartment."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
    identity_client,
)


class identity_no_resources_in_root_compartment(Check):
    """Check if no resources are created in the root compartment."""

    def execute(self) -> Check_Report_OCI:
        """Execute the identity_no_resources_in_root_compartment check."""
        findings = []

        # Get the root compartment ID (tenancy OCID)
        root_compartment_id = identity_client.audited_tenancy

        # Get resources found in root compartment via search
        resources_in_root = identity_client.root_compartment_resources
        resource_count = len(resources_in_root)

        # Create finding
        report = Check_Report_OCI(
            metadata=self.metadata(),
            resource={},
            region=identity_client.provider.identity.region,
            resource_name="Root Compartment Resources",
            resource_id=root_compartment_id,
            compartment_id=root_compartment_id,
        )

        if resource_count == 0:
            report.status = "PASS"
            report.status_extended = "No resources found in the root compartment."
        else:
            report.status = "FAIL"
            # Get resource type summary
            resource_types = {}
            for resource in resources_in_root:
                resource_type = resource.resource_type
                resource_types[resource_type] = resource_types.get(resource_type, 0) + 1

            resource_summary = ", ".join(
                [f"{count} {rtype}(s)" for rtype, count in resource_types.items()]
            )
            report.status_extended = f"Found {resource_count} resource(s) in root compartment: {resource_summary}."

        findings.append(report)

        return findings

References