OCI security posture management across every compartment
Oracle Cloud security posture management lives or dies on the compartment tree: a policy statement written three levels up decides who can touch a bucket at the bottom. Onam walks every compartment, evaluates IAM policy statements against that tree, and re-checks Compute, OKE, Object Storage, Autonomous Database, VCN and Vault configuration on every scan — mapped to the CIS Oracle Cloud Infrastructure Benchmark.
One platform on OCI
Connect OCI once. Onam Security is covered in detail below; the rest of the platform works from the same discovery.
Every OCI resource Onam discovers lands in one inventory, with provider, region, account, state and last-seen time, through the same read-only access. Every discovery run is recorded with its trigger and status. The per-account architecture view draws AWS accounts today, not OCI.
Posture, identity, attack paths, workloads and compliance for OCI. The detail is on the rest of this page.
Onam FinOps works on reconciled billing data: billed and effective cost, ownership, forecast, budgets, anomalies and savings. It holds read-only billing access and changes nothing in your accounts. Ask us which OCI billing data applies to your accounts.
Onam DRM works from the same inventory: it proposes applications from your tags, reads backup, snapshot and replication from cloud configuration, and predicts RTO and RPO against your targets. It plans and records — it does not run a failover or a DR test. Ask us about DRM coverage for OCI.
Onam AIOps
Early accessAI agents investigate your Onam Security inventory and findings and propose changes a person approves. Executing a change in a customer cloud is on the roadmap, with AWS first; nothing is executed in OCI today.
Services we monitor on OCI
Every service below is scanned continuously — no agents, no network changes, read-only.
Plus: Functions, API Gateway, Streaming, Data Safe, Bastion, Web Application Firewall, and more.
Compliance frameworks
Onam maps every OCI finding to the frameworks your auditors care about.
Connect in 3 steps
From consent to your first findings, with no agents to install for posture scanning.
Create a read-only OCI user & group
Provision an Onam user in the root tenancy, add it to a dedicated group, and attach a policy that grants inspect and read on all-resources across the tenancy.
Generate an API signing key
Upload the public key to the Onam user. The private key is stored in AWS Secrets Manager, encrypted with AWS KMS.
Findings from the first scan
Onam walks every compartment recursively — including nested and dynamic groups — and returns findings mapped to CIS OCI.
OCI in the Onam Security console.
A recreation of the Onam console with sample data: connect, inventory and posture in one view.
What makes Onam different on OCI
Full compartment-tree traversal
Onam parses every parent, child, and cross-tenancy policy statement in Oracle's policy language and evaluates them against the compartment tree — including matching conditions and where clauses.
Autonomous Database posture
Data Safe risk levels, private-endpoint enforcement, wallet rotation, and access-control list drift — audited continuously alongside your Autonomous DB workloads.
VCN + Security List analysis
VCN topology, security lists, network security groups, and route tables are combined into one exposure graph so overly-permissive rules are surfaced with the resources they actually reach.
Questions we get a lot
OCI security — related reading
How the engines behind OCI coverage work, and what the categories actually mean.
Autonomous DB and DB Systems posture, plus CIS Oracle Database benchmarks.
Cloud security posture management explained — what it catches, and what it cannot.
Why a list of findings is not a priority, and how chains reach crown jewels.
Attack paths and choke points computed across your whole estate.
Effective permissions after role chains, SCPs and permission boundaries.
CIS, NIST, ISO 27001, PCI-DSS and more, scored continuously.
Snapshot-based workload scanning that runs inside your own account.
See Onam on your OCI environment
Connect once with read-only access. Every Onam product you use works from the same discovery, so your accounts are connected once.