Oracle Cloud Infrastructure Explained: Compartments, Compute, and Autonomous Database
Oracle Cloud Infrastructure explained: tenancies and compartments, OCI IAM policies, regions, availability domains and fault domains, compute shapes and OCPUs, Autonomous Database, Free Tier, pay-as-you-go billing, and limits.
Oracle Cloud Infrastructure (OCI) is Oracle’s second-generation cloud, built to run Oracle Database workloads well and priced to compete with the larger hyperscalers on compute and egress. Its vocabulary is different enough from AWS or Azure that a short orientation saves real time. This guide explains tenancies and compartments, how OCI IAM policies are written, how regions, availability domains, and fault domains fit together, what the core compute, storage, database, and networking services are, and how the Free Tier, pay-as-you-go billing, and service limits behave.
Tenancy and compartments
An OCI account is called a tenancy. The tenancy is the root of everything: it owns all resources, receives the bill, and is tied to a home region chosen at sign-up that cannot be changed afterwards. Other regions can be subscribed to later, and identity resources are replicated from the home region to each subscribed region.
Inside the tenancy, resources are organised into compartments. A compartment is a logical grouping used for access control and cost tracking, not a network or regional boundary. Compartments nest up to six levels deep, and every resource belongs to exactly one compartment, though resources in different compartments can still talk to each other over the network. The root compartment exists by default and should be kept mostly empty; the usual pattern is a compartment per environment or per team, with policies written against those compartments. Resources can be moved between compartments after creation.
- Tenancy
- The account root; owns all resources and the bill, with a fixed home region
- Compartment
- Hierarchical container for access control and cost reporting
- Availability domain
- Isolated data center within a region
- Fault domain
- Hardware grouping inside an availability domain used to spread instances
Identity and access with OCI IAM
OCI IAM is built on identity domains, which hold users, groups, and sign-in settings; a new tenancy has a default domain, and additional domains can be created for customers or partners. Access is granted through policies written in a readable statement language. A policy statement takes the form Allow group Developers to manage instance-family in compartment Dev, with verbs (inspect, read, use, manage) and resource types defined by each service. Because policies reference compartments, the compartment layout directly shapes your permission model.
Workloads authenticate through dynamic groups and instance principals: a rule places compute instances into a dynamic group, and a policy grants that group access to, for example, an Object Storage bucket, without any stored API keys. Human users authenticate with a password and, by default in newer tenancies, multi-factor authentication. API access uses signing keys attached to a user or uses session tokens from the OCI CLI. Audit logs for every API call are retained automatically by the Audit service.
Regions, availability domains, and fault domains
OCI regions are spread across North and South America, Europe, the Middle East, Africa, and Asia Pacific, and Oracle has continued to add smaller regions rapidly. Each region contains one or more availability domains (ADs), which are independent data centers with separate power and networking. Some large regions have three ADs, while many newer regions have a single AD.
Inside every AD are three fault domains: groups of hardware that do not share a rack or power path. Even in a single-AD region you can spread instances across fault domains so that planned maintenance or a hardware failure affects only one of them. Placing a load-balanced application across fault domains, and across ADs where available, is the standard resilience pattern. Resources such as Object Storage and the Virtual Cloud Network are regional; compute instances, block volumes, and subnets can be AD-specific or regional depending on how you create them.
Core services: compute, storage, database, and networking
| Category | Services | Notes |
|---|---|---|
| Compute | Virtual machines, bare metal instances, Container Engine for Kubernetes (OKE), Functions, Container Instances | Standard shapes on AMD, Intel, and Ampere Arm processors; flexible shapes let you choose OCPU count and memory independently; GPU shapes for AI |
| Storage | Block Volume, Object Storage, File Storage, Archive Storage | Block volumes with adjustable performance levels; Standard, Infrequent Access, and Archive object tiers; NFS file systems |
| Databases | Autonomous Database, Base Database Service, Exadata Database Service, MySQL HeatWave, NoSQL Database | Self-tuning Oracle Database for transaction processing or data warehousing; managed Oracle and MySQL; a key-value service |
| Networking | Virtual Cloud Network (VCN), subnets, security lists, network security groups, Internet and NAT gateways, Load Balancer, FastConnect | Regional private networks with public and private subnets, stateful firewall rules, and dedicated connectivity |
| AI and analytics | OCI Generative AI, Data Science, AI Services, Analytics Cloud | Hosted foundation models through an API, notebook environments, prebuilt vision and language services |
| Operations | Monitoring, Logging, Audit, Vault, Budgets, Cost Analysis | Metrics and alarms, log collection, API history, key and secret storage, spend tracking |
Two points trip up newcomers. First, OCI sizes compute in OCPUs, where one OCPU is a physical core with hyperthreading, equal to two vCPUs on x86 shapes; Arm shapes count one OCPU as one core. Second, Autonomous Database is the flagship service and runs as either Autonomous Transaction Processing or Autonomous Data Warehouse, with patching, tuning, and scaling handled by Oracle. The service reference for all of the above is in the Oracle Cloud documentation.
Free Tier, billing, and service limits
Oracle’s Free Tier has two parts. Always Free resources are a fixed set of small services, including limited Arm and AMD compute, two Autonomous Databases, block and object storage allowances, and a load balancer, that remain free for as long as the tenancy exists. On top of that, new tenancies receive a time-limited trial with a promotional credit for paid services. The amounts, eligibility, and duration are set by Oracle and change over time; the current terms are on the Oracle Cloud Free Tier page. A trial tenancy has tight limits, and some shapes and regions are unavailable until it is upgraded.
Upgrading to a Pay As You Go tenancy attaches a payment method, removes trial restrictions, and raises many service limits, while Always Free resources continue at no charge. Usage is then metered and invoiced monthly. Oracle also offers Universal Credits for committed spend, and its pricing is uniform across regions, which simplifies planning. Budgets let you set a monthly threshold on a compartment or the whole tenancy and receive alerts at chosen percentages, and Cost Analysis breaks spend down by service, compartment, and tag.
Service limits are per tenancy, per region, and often per availability domain, expressed as counts of instances, OCPUs per shape family, storage, and networking objects. The Limits, Quotas and Usage page shows current values, and increases are requested from the same page for review by Oracle. Compartment quotas are a separate feature that lets administrators cap what each compartment may consume, which is useful for keeping a test environment from absorbing the tenancy’s full limit.
- Enable MFA for the tenancy administrator and every user, then create groups and policies before inviting a team.
- Create a budget on the root compartment with an alert before you attach a payment method.
- Design the compartment tree early; policies and cost reports both depend on it and reorganising later is tedious.
- Check service limits for the shape family you need in your home region, since Always Free and trial capacity in popular shapes can be constrained.
- Follow the Oracle Cloud acceptable use policy: cryptocurrency mining on trial credit, scanning, and unsolicited email lead to tenancy suspension.
Where to go next
Tenancy listings labelled as trial with promotional credit or as upgraded Pay As You Go are on the Buy Oracle Cloud Accounts product page.
Related reading in the Cloud Library:
- IAM basics: users, roles, and policies across cloud providers
- How cloud credits work: trials, promotional credits, and billing
- Pay-as-you-go vs reserved and committed pricing in the cloud
- Using the cloud for research and academic projects
Browse the full Cloud Library, or read the Oracle Cloud vs IBM Cloud comparison.