Back to Checks
oraclecloud

Tenancy has at least one active non-root compartment

identity_non_root_compartment_exists
Service: identitySeverity: high
OfficialBuilt-inVerified
Categories:identity-accesstrust-boundaries
Resource Type:Compartment

OCI tenancy includes at least one active non-root compartment. Only compartments below the root level are considered, indicating that resources are organized outside the root scope.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Using only the root compartment removes segmentation and forces broad tenancy-wide access. This endangers confidentiality and integrity through cross-project visibility, mis-scoped policies, and accidental changes with global impact, and can affect availability via bulk deletions or misconfigurations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks identity_non_root_compartment_exists

Recommendation

Create dedicated non-root compartments per workload, environment, or team; avoid placing resources in the root compartment.

Apply granular policies at the compartment level to enforce least privilege and separation of duties. Use a clear hierarchy and tags, and review the design regularly as the tenancy evolves.

Remediation

CLI

oci iam compartment create --compartment-id <tenancy_ocid> --name <compartment_name> --description '<description>'

Terraform

# Creates a non-root compartment under the tenancy to pass the check
resource "oci_identity_compartment" "<example_resource_name>" {
  compartment_id = "<example_resource_id>" # Critical: parent OCID (tenancy) for non-root compartment
  name           = "<example_resource_name>" # Critical: compartment name
  description    = "compartment"             # Critical: required to create
}

Other

1In the OCI Console, go to Identity & Security > Compartments
2Click Create Compartment
3Enter Name: <example_resource_name> and a Description
4Ensure the Parent Compartment is the tenancy (root) or desired non-root parent
5Click Create

Check Code

"""Check if at least one non-root compartment exists in the tenancy."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
    identity_client,
)


class identity_non_root_compartment_exists(Check):
    """Check if at least one non-root compartment exists in the tenancy."""

    def execute(self) -> Check_Report_OCI:
        """Execute the identity_non_root_compartment_exists check."""
        findings = []

        # Get active non-root compartments from search
        active_compartments = identity_client.active_non_root_compartments
        compartment_count = len(active_compartments)

        # Create a single finding for the tenancy
        report = Check_Report_OCI(
            metadata=self.metadata(),
            resource={},
            region=identity_client.provider.identity.region,
            resource_name="Tenancy Compartments",
            resource_id=identity_client.audited_tenancy,
            compartment_id=identity_client.audited_tenancy,
        )

        if compartment_count > 0:
            report.status = "PASS"
            report.status_extended = f"Tenancy has {compartment_count} active non-root compartment(s) created for organizing cloud resources."
        else:
            report.status = "FAIL"
            report.status_extended = "Tenancy has no active non-root compartments created. At least one non-root compartment should be created to organize cloud resources."

        findings.append(report)

        return findings

References