OCI Production Landing Zone
IAM, VCN and a Vault key on the shared vault - not the private one at ~$294/mo.
The Oracle Cloud sibling of the landing-zone pattern. Foundation (always on): an IAM foundation, a VCN with a single NAT gateway and three network security groups, a Vault + KMS key (pinned to the shared DEFAULT vault - never the ~$294/mo virtual-private one), and logs + artifacts object-storage buckets. Flip enable_edge for a public DNS zone, enable_compute for a flexible load balancer + an OKE cluster, and enable_data for an Autonomous Database. OCI has no managed CDN/WAF/cache/monitoring module, so those tiers are honestly thinner - documented, not faked. tofu validate is clean with everything off and everything on.
How it composes
Foundation (always on): the IAM foundation sets identity; the VCN carries app/LB/data network security groups behind a single NAT gateway; the Vault + KMS key (DEFAULT vault, non-overridable) encrypts object storage. enable_edge adds a public DNS zone; enable_compute adds an internet-facing flexible load balancer + an OKE cluster; enable_data adds an Autonomous Database on the smallest ECPU band, privately reachable.
Composed root - tofu validate clean
This stack ships a single OpenTofu/Terraform root module that wires its modules together, statically validated with tofu validate. Set your domain and CIDRs in terraform.tfvars, then tofu init && tofu apply. This stack has not been live-tested, as a root or module by module.A full apply is your account's step.
Modules in this stack
- 1OCI IAM Foundation (compartments + policies)static-validatedTenancy landing-zone core: compartment hierarchy, groups, dynamic groups, policy statements and tag namespaces from a single map.
- 2OCI VCN (hub-ready network foundation)static-validatedProduction VCN with public/private subnets, internet/NAT/service gateways, route tables, NSGs and IPv6 - the module every OCI tenancy starts with.
- 3Vault, Keys & Secretsstatic-validatedKMS vault with HSM/software master keys, key rotation and secret lifecycle management for app credentials.
- 4Object Storage Bucketstatic-validatedBucket with versioning, lifecycle/auto-tiering, retention rules, replication and pre-authenticated request support.
- 5DNS Zone & Traffic Steeringstatic-validatedPublic/private DNS zones with record sets, failover/geo steering policies and health-check probes.
- 6Flexible Load Balancer (L7)static-validatedHTTPS load balancer with backend sets, health checks, TLS certificates, rule sets and WAF-ready listeners.
- 7OKE Managed Kubernetes Clusterstatic-validatedEnhanced OKE cluster with managed + virtual node pools, private API endpoint, NSGs, addons and OIDC - flagship OCI workload platform.
- 8Autonomous Database (Serverless)static-validatedATP/ADW/JSON/APEX autonomous database with private endpoint, mTLS wallet output, ACLs, auto-scaling and backup config.