Oracle Cloud Infrastructure Documentation

Managing Recipes in Security Zones

When you create a security zone you assign a recipe to it. A recipe is a collection of security zone policies.

You can perform the following security zone management tasks:

When you perform certain resource operations in a security zone, such as creating a compute instance  or a subnet , Oracle Cloud Infrastructure automatically validates the policies within the recipe that's assigned to the security zone.

Each tenancy has a predefined recipe named Maximum Security Recipe, which includes several curated security zone policies. Oracle manages this recipe, and you can’t change it.

You can create a custom recipe, or clone an existing one. Within a custom recipe, you can enable and disable security zone policies so that a security zone meets specific security requirements.

Note

Use caution when disabling policies in the recipe. Disabled policies can reduce the security posture for resources in the security zone.

Security zone policies are organized by type. Each type aligns with one of the following cloud security principles:

  • Restrict resource movement
  • Restrict resource association
  • Deny public access
  • Require encryption
  • Ensure data durability
  • Ensure data security
  • Use only configurations approved by Oracle

Each policy affects specific cloud resource types like Compute, Object Storage, or Database.

Required IAM Policy

To use Oracle Cloud Infrastructure, you must be granted the required type of access in an IAM policy written by an administrator, whether you're using the Console or the REST API with an SDK, CLI, or other tool.

If you try to perform an action and get a message that you don’t have permission or are unauthorized, confirm with your administrator the type of access you were granted and which compartment  you are supposed to work in.

For example, the following IAM policy  allows users in the group SecurityAdmins to create, update, and delete all security zones and recipes in the entire tenancy.

Allow group SecurityAdmins to manage security-zone in tenancy
Allow group SecurityAdmins to manage security-recipe in tenancy

See Cloud Guard Policies.