A Compartment where the Wrong Resource Cannot Be Created
The opposite of every other guardrail here: a security zone does not detect or report, it REFUSES - the API call fails. There is no dry-run mode. So the risk inverts too: applied to a compartment that already holds non-compliant resources, the team that owns them discovers they can no longer change them.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan clean (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-13 · how we verify
Use it from the registry
terraform · opentofumodule "security_zone" {
source = "www.iac-bazaar.com/iac-bazaar/oci-security-zone/oci"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
oci-security-zone
An OCI security zone: a compartment where a non-compliant resource cannot be
created at all. Works with Terraform and OpenTofu (>= 1.6), oci provider
>= 8.0, < 9.0.
This one actually refuses, and that is the point. Most cloud guardrails detect, report, and leave the offending resource running. A security zone is different: create a public bucket in a compartment governed by a recipe that forbids it and the API call fails. There is no dry-run mode, no "enforcement: disabled" flag, and nothing to leave half-set.
So the danger here is the mirror image of the usual one. Everywhere else the risk is a control that quietly does nothing. Here the risk is a control that loudly does something - applied to a compartment that already contains non-compliant resources, whose team is about to discover they can no longer change them. Existing resources are not deleted or altered; they simply cannot be updated into a still-violating state, and new ones cannot be created. Move an empty compartment into a zone, not a busy one. A precondition asks you to confirm you checked, because this is the rare case where the failure is immediate and visible rather than silent.
An empty recipe is a zone that forbids nothing. security_policies is
required but may be an empty list, which produces a compartment that reads as a
security zone everywhere it is listed and refuses nothing at all.
is_inheritance_after_delete_enabled decides what happens underneath. Sub
compartments inherit the zone; with inheritance-after-delete off, deleting this
zone un-protects every compartment beneath it in the same operation, with
nothing at the point of deletion to say so.
inherited_by_compartments is an output because the blast radius of a zone is
that list, not the single compartment it was applied to.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage