OCI Generative AI Hardening

Place all OCI Generative AI resources — endpoints, dedicated clusters, fine-tuning jobs, and models — in a dedicated compartment, never in the root compartment or tenancy-wide scope. Apply IAM policies at the compartment level and never grant manage generative-ai-family in tenancy to application service accounts. The compartment boundary is the OCI blast-radius containment primitive: a compromised identity can only affect resources within the compartments it is granted access to. See oci-iam-07 — compartment hierarchy for the recommended compartment tree structure.

Remediation — OCI CLI

# OCI CLI 3.x — find and audit the GenAI compartment
# Step 1: locate the dedicated GenAI compartment
oci iam compartment list \
  --compartment-id "${ROOT_COMPARTMENT_OCID}" \
  --name genai \
  --output table

# Step 2: audit policies scoped to the compartment (should NOT contain "in tenancy")
oci iam policy list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table

# Step 3: check for overly broad tenancy-level GenAI policies
oci iam policy list \
  --compartment-id "${ROOT_COMPARTMENT_OCID}" \
  --output json | \
  jq '.data[].statements[] | select(contains("generative-ai-family in tenancy"))'

Remediation — Terraform

# Terraform OCI provider ~> 5.0
resource "oci_identity_compartment" "genai" {
  compartment_id = var.root_compartment_ocid
  name           = "genai"
  description    = "Dedicated compartment for OCI Generative AI resources"
}

resource "oci_identity_policy" "genai_inference" {
  name           = "genai-inference-policy"
  description    = "Allow inference-only group to use Generative AI within the genai compartment"
  compartment_id = oci_identity_compartment.genai.id

  statements = [
    "Allow group ${var.inference_group_name} to use generative-ai-family in compartment id ${oci_identity_compartment.genai.id}",
  ]
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-genai-01-compartment-isolation" \
  --display-name "oci-genai-01-compartment-isolation" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-genai-01-compartment-isolation" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Remediation — Pulumi (TypeScript)

import * as pulumi from "@pulumi/pulumi";
import * as oci from "@pulumi/oci";

// Dedicated compartment for Generative AI workloads with strict policy fence.
const cfg = new pulumi.Config();
const parentCompartmentId = cfg.require("parentCompartmentOcid");

const genaiCompartment = new oci.identity.Compartment("genai-isolated", {
  compartmentId: parentCompartmentId,
  name: "genai-prod",
  description: "Isolated compartment for Generative AI inference + agent workloads",
  enableDelete: false,  // soft-delete only — audit trail preservation
});

// Fence: only GenAI workload identities may invoke models in this compartment.
const genaiFencePolicy = new oci.identity.Policy("genai-fence", {
  compartmentId: parentCompartmentId,
  name: "genai-compartment-fence",
  description: "Only GenAI workload SAs may invoke generative-ai service inside genai-prod",
  statements: [
    pulumi.interpolate`Allow dynamic-group GenAIWorkloads to use generative-ai-family in compartment id ${genaiCompartment.id}`,
    pulumi.interpolate`Allow group GenAIOps to read generative-ai-family in compartment id ${genaiCompartment.id}`,
  ],
});

export const genaiCompartmentOcid = genaiCompartment.id;

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'generative-ai'
          and eventName in ('CreateDedicatedAiCluster', 'CreateModel', 'CreateEndpoint')
          | eval compartment_ok = if(data.target.compartment.id in_subset 'AICompartmentInventory', 'YES', 'NO')
          | where compartment_ok = 'NO'
          | stats count by 'User Name', data.target.id, eventName

Configure OCI IAM policies with granular resource-type verbs for Generative AI, creating separate groups and policies for different use cases: an inference-only group using use generative-ai-family; a management group using manage generative-ai-endpoint; and a read-only audit group using read generative-ai-family. The generative-ai-family aggregate resource type includes generative-ai-chat, generative-ai-endpoint, generative-ai-model, and generative-ai-fine-tuning-job — grant the minimum necessary sub-type verbs rather than the aggregate to production application identities.

Remediation — OCI CLI

# OCI CLI 3.x — audit IAM policies for GenAI permissions
# List all policies in the GenAI compartment
oci iam policy list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table

# Map groups to policies
oci iam group list --output table

# Check for overly broad 'manage' grants on inference-only groups
oci iam policy list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output json | \
  jq '.data[].statements[] | select(contains("manage generative-ai-family"))'

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Inference-only group: can call endpoints but cannot create/modify/delete
resource "oci_identity_group" "genai_inference" {
  compartment_id = var.tenancy_ocid
  name           = "genai-inference-users"
  description    = "Group for application identities that call GenAI inference endpoints only"
}

resource "oci_identity_policy" "genai_inference_policy" {
  name           = "genai-inference-policy"
  description    = "Inference-only access to Generative AI endpoints"
  compartment_id = var.genai_compartment_ocid

  statements = [
    # 'use' verb: can call endpoints; cannot create, update, or delete
    "Allow group genai-inference-users to use generative-ai-family in compartment id ${var.genai_compartment_ocid}",
  ]
}

# Management group: for operations teams only — NOT application service accounts
resource "oci_identity_group" "genai_admins" {
  compartment_id = var.tenancy_ocid
  name           = "genai-admins"
  description    = "Group for GenAI platform operators (endpoint creation, fine-tuning)"
}

resource "oci_identity_policy" "genai_admin_policy" {
  name           = "genai-admin-policy"
  description    = "Management access to Generative AI resources for ops team"
  compartment_id = var.genai_compartment_ocid

  statements = [
    "Allow group genai-admins to manage generative-ai-family in compartment id ${var.genai_compartment_ocid}",
  ]
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-genai-02-iam-least-privilege" \
  --display-name "oci-genai-02-iam-least-privilege" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-genai-02-iam-least-privilege" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'identity'
          and eventName in ('CreatePolicy', 'UpdatePolicy')
          | eval stmt = data.request.payload.statements
          | where stmt like '%generative-ai-inference%' and (stmt like '%manage%' or stmt like '%in tenancy%')
          | stats count by 'User Name', data.target.policy.name, 'Compartment Name'

Enable OCI AI Guardrails with all three modules active: Content Moderation (CM) for hate speech, sexual content, violence, and self-harm; Prompt Injection (PI) detection for direct jailbreak and indirect injection attempts; and PII detection and redaction. OCI AI Guardrails is GA for on-demand inference mode. Configure thresholds above the default for production workloads — do not rely solely on OCI's default safety settings.

Remediation — OCI CLI

# OCI CLI 3.x — check current guardrail configuration on GenAI endpoints
oci generative-ai endpoint list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output json | \
  jq '.[].guardRails'

# Inspect a specific endpoint's guardrail config
oci generative-ai endpoint get \
  --endpoint-id "${ENDPOINT_OCID}" \
  --query "data.contentModerationConfig"

Remediation — Terraform

# Terraform OCI provider ~> 5.0
resource "oci_generative_ai_endpoint" "this" {
  compartment_id       = var.genai_compartment_ocid
  dedicated_ai_cluster_id = var.dedicated_cluster_ocid
  model_id             = var.model_ocid
  display_name         = var.endpoint_name

  content_moderation_config {
    # Enable all three guardrail modules
    is_enabled = true
    # Verify exact nested argument names in OCI Terraform provider documentation at authoring time;
    # the provider exposes content_moderation_config at the endpoint level for on-demand mode.
  }
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-genai-03-guardrails-content-moderation" \
  --display-name "oci-genai-03-guardrails-content-moderation" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-genai-03-guardrails-content-moderation" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'generative-ai'
          and eventName in ('UpdateEndpoint', 'CreateEndpoint')
          | eval moderation_off = if(data.request.payload.contentModerationConfig.isEnabled = 'false', 'YES', 'NO')
          | where moderation_off = 'YES'
          | stats count by 'User Name', data.target.endpoint.id, eventName

Configure a private endpoint for OCI Generative AI within your VCN using the Service Gateway, ensuring inference traffic routes through OCI's internal backbone without traversing the public internet. Disable the public endpoint on the OCI Generative AI endpoint resource. The Service Gateway provides connectivity to OCI services — including Generative AI — from your VCN without requiring an Internet Gateway or NAT Gateway, keeping all prompt and completion data on the OCI backbone.

Remediation — OCI CLI

# OCI CLI 3.x — verify Service Gateway and endpoint configuration
# Check for Service Gateway in the VCN
oci network service-gateway list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table

# Verify endpoint type on GenAI endpoints
oci generative-ai endpoint list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output json | \
  jq '.[].endpointType'

# List route table rules to verify GenAI traffic routes through Service Gateway
oci network route-table list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Service Gateway — connect VCN to OCI services (including Generative AI) without internet routing
resource "oci_core_service_gateway" "genai" {
  compartment_id = var.genai_compartment_ocid
  vcn_id         = var.vcn_ocid
  display_name   = "genai-service-gateway"

  services {
    service_id = data.oci_core_services.all.services[0].id  # OCI Services CIDR
  }
}

# Route table rule: send Generative AI service traffic through the Service Gateway
resource "oci_core_route_table" "genai_private" {
  compartment_id = var.genai_compartment_ocid
  vcn_id         = var.vcn_ocid
  display_name   = "genai-private-route-table"

  route_rules {
    destination       = "all-${var.region}-services-in-oracle-services-network"
    destination_type  = "SERVICE_CIDR_BLOCK"
    network_entity_id = oci_core_service_gateway.genai.id
  }
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-genai-04-private-endpoint" \
  --display-name "oci-genai-04-private-endpoint" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-genai-04-private-endpoint" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'generative-ai'
          and eventName in ('CreateEndpoint', 'UpdateEndpoint')
          | eval net_type = data.request.payload.networkConfig.networkType
          | where net_type = 'PUBLIC'
          | stats count by 'User Name', data.target.endpoint.id, eventName

Enable OCI Audit Logs for all OCI Generative AI API calls. OCI Audit captures all API calls to OCI services as structured events, including the caller identity, source IP, action, and resource affected. Route Generative AI audit logs to Object Storage for long-term retention beyond the default 90-day Audit service retention. See OCI Logging for the OCI Audit Logs configuration pattern and Service Connector Hub routing.

Remediation — OCI CLI

# OCI CLI 3.x — query audit events for Generative AI operations
# List recent audit events for GenAI API calls in the compartment
oci audit event list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --start-time "${ISO_DATE}" \
  --stream-specifier AUDIT \
  --output json | \
  jq '.data[] | select(.data.request.action | contains("generative-ai"))'

# Verify audit log retention Object Storage bucket
oci os bucket list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table | grep audit

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Object Storage bucket for long-term audit log archival
resource "oci_objectstorage_bucket" "audit_logs" {
  compartment_id = var.genai_compartment_ocid
  namespace      = data.oci_objectstorage_namespace.this.namespace
  name           = "genai-audit-logs"
  access_type    = "NoPublicAccess"

  retention_rules {
    display_name = "90-day-minimum-retention"
    duration {
      time_unit  = "DAYS"
      time_amount = 90
    }
  }
}

# Service Connector Hub — route OCI Audit events to Object Storage for long-term retention
resource "oci_sch_service_connector" "audit_to_object_storage" {
  compartment_id = var.genai_compartment_ocid
  display_name   = "genai-audit-to-object-storage"
  state          = "ACTIVE"

  source {
    kind = "logging"
    log_sources {
      compartment_id = var.genai_compartment_ocid
      log_group_id   = "_Audit"  # OCI Audit log group
    }
  }

  target {
    kind      = "objectStorage"
    bucket_name = oci_objectstorage_bucket.audit_logs.name
    namespace  = data.oci_objectstorage_namespace.this.namespace
  }
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-genai-06-audit-logging" \
  --display-name "oci-genai-06-audit-logging" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-genai-06-audit-logging" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'logging'
          and eventName in ('DeleteLog', 'UpdateLog')
          | eval is_genai = if(data.target.log.configuration.source.service = 'generative-ai', 'YES', 'NO')
          | where is_genai = 'YES'
          | stats count by 'User Name', data.target.log.displayName, eventName

For regulated workloads requiring tenant-exclusive GPU allocation, deploy OCI Dedicated AI Clusters (oci_generative_ai_dedicated_ai_cluster). Dedicated clusters provide RDMA-isolated GPU allocation in a single-tenant configuration — no other customer's workloads share the underlying hardware. This is an OCI-unique differentiator with no direct equivalent on other providers.

When to require dedicated clusters: healthcare workloads governed by HIPAA (shared-hardware side-channel risk for PHI in inference context), financial workloads under PCI DSS Level 1, government classified workloads, and any workload where shared-hardware speculative execution risk or GPU memory residue is unacceptable under your threat model.

Remediation — OCI CLI

# OCI CLI 3.x — enumerate and inspect dedicated AI clusters
# List all dedicated AI clusters in the GenAI compartment
oci generative-ai dedicated-ai-cluster list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table

# Inspect a specific cluster's isolation configuration
oci generative-ai dedicated-ai-cluster get \
  --dedicated-ai-cluster-id "${CLUSTER_OCID}" \
  --output json | \
  jq '{id: .data.id, type: .data.type, unitCount: .data.unitCount, lifecycleState: .data."lifecycle-state"}'

Remediation — Terraform

# Terraform OCI provider ~> 5.0
resource "oci_generative_ai_dedicated_ai_cluster" "regulated" {
  compartment_id = var.genai_compartment_ocid
  display_name   = "regulated-workload-cluster"
  type           = "HOSTING"  # HOSTING for inference; FINE_TUNING for training jobs
  unit_count     = 1
  unit_shape     = "LARGE_COHERE"  # Verify available shapes in target region

  # dedicated_infrastructure_type ensures single-tenant GPU allocation
  # Verify exact argument name in OCI Terraform provider documentation at authoring time
  # dedicated_infrastructure_type = "DEDICATED"  # consult provider docs for current argument
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-genai-07-dedicated-ai-cluster-isolation" \
  --display-name "oci-genai-07-dedicated-ai-cluster-isolation" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-genai-07-dedicated-ai-cluster-isolation" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'generative-ai'
          and eventName in ('DeleteDedicatedAiCluster', 'UpdateDedicatedAiCluster', 'UpdateEndpoint')
          | eval scaled_down = if(data.request.payload.unitCount < 2, 'YES', 'NO')
          | where eventName = 'DeleteDedicatedAiCluster' or scaled_down = 'YES'
          | stats count by 'User Name', data.target.id, eventName

Apply OCI Security Zones to the GenAI compartment to enforce Zero Trust Packet Routing (ZPR) invariants and prevent insecure configurations. Security Zones enforce policies that cannot be bypassed by IAM changes: (1) all GenAI endpoints must use private endpoints — no public endpoint is allowed; (2) Object Storage buckets used for knowledge bases and fine-tuning data must have public access blocked; (3) all resources must use encryption (Oracle-managed minimum; Vault CMK for regulated workloads). Security Zone recipes provide standing policy enforcement that survives any individual IAM policy change or human error.

Remediation — OCI CLI

# OCI CLI 3.x — check Security Zone assignment and active recipes
# List Security Zones in the GenAI compartment
oci zones security-zone list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table

# Inspect active Security Zone recipes
oci zones security-zone-recipe list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table

# Get the Security Zone assignment for the GenAI compartment
oci zones security-zone get \
  --security-zone-id "${SECURITY_ZONE_OCID}" \
  --output json | \
  jq '{id: .data.id, displayName: .data."display-name", securityZoneRecipeId: .data."security-zone-recipe-id"}'

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# Security Zone recipe defining the ZPR policy invariants
resource "oci_cloud_guard_security_recipe" "genai" {
  compartment_id = var.genai_compartment_ocid
  display_name   = "genai-security-recipe"

  # Reference the built-in OCI Maximum Security Zone recipe or define custom rules:
  # - No public endpoints (enforces oci-genai-04 private endpoint requirement)
  # - Object Storage public access blocked (enforces knowledge base and fine-tuning data protection)
  # - Encryption required on all resources
  source_recipe_id = data.oci_cloud_guard_security_recipes.maximum.security_recipes[0].id
  freeform_tags = {
    "workload" = "genai"
  }
}

# Associate the GenAI compartment with the Security Zone
resource "oci_cloud_guard_security_zone" "genai" {
  compartment_id       = var.genai_compartment_ocid
  display_name         = "genai-security-zone"
  security_zone_recipe_id = oci_cloud_guard_security_recipe.genai.id
  description          = "Security Zone enforcing ZPR invariants on the GenAI compartment"
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-genai-08-security-zone-policy" \
  --display-name "oci-genai-08-security-zone-policy" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-genai-08-security-zone-policy" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' = 'cloud-guard'
          and eventName in ('DeleteSecurityZone', 'UpdateSecurityZone', 'DeleteSecurityRecipeRule')
          | eval ai_zone = if(data.target.securityZone.displayName like '%generative-ai%', 'YES', 'NO')
          | where ai_zone = 'YES'
          | stats count by 'User Name', data.target.securityZone.id, eventName

Configure OCI Vault Customer-Managed Keys (CMK) for fine-tuning training data stored in Object Storage and for custom model weights stored on Dedicated AI Clusters. Vault CMK enables encryption key lifecycle control — rotation, revocation, and HSM-backed key storage — for regulated workloads where Oracle-managed encryption is insufficient for compliance reasons. Use oci_kms_key with AES 256 algorithm; associate with Object Storage buckets used for fine-tuning data.

Remediation — OCI CLI

# OCI CLI 3.x — audit Vault CMK configuration for GenAI fine-tuning storage
# List Vault instances in the compartment
oci kms vault list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --output table

# Verify CMK association on Object Storage buckets used for fine-tuning data
oci os bucket get \
  --bucket-name "${BUCKET_NAME}" \
  --query 'data."kms-key-id"'

# List keys in the Vault
oci kms management key list \
  --compartment-id "${COMPARTMENT_OCID}" \
  --endpoint "${VAULT_MANAGEMENT_ENDPOINT}" \
  --output table

Remediation — Terraform

# Terraform OCI provider ~> 5.0
# OCI Vault for Customer-Managed Key management
resource "oci_kms_vault" "genai" {
  compartment_id = var.genai_compartment_ocid
  display_name   = "genai-vault"
  vault_type     = "DEFAULT"
}

# AES-256 CMK for fine-tuning data encryption
resource "oci_kms_key" "genai_finetuning" {
  compartment_id      = var.genai_compartment_ocid
  display_name        = "genai-finetuning-cmk"
  management_endpoint = oci_kms_vault.genai.management_endpoint

  key_shape {
    algorithm = "AES"
    length    = 32  # 256 bits
  }
}

# Object Storage bucket for fine-tuning training data — CMK-encrypted
resource "oci_objectstorage_bucket" "finetuning_data" {
  compartment_id = var.genai_compartment_ocid
  namespace      = data.oci_objectstorage_namespace.this.namespace
  name           = "genai-finetuning-data"
  access_type    = "NoPublicAccess"

  # Associate Vault CMK — applies to fine-tuning data storage ONLY
  # On-demand inference endpoints use Oracle-managed AES-256 double encryption
  kms_key_id = oci_kms_key.genai_finetuning.id
}

Remediation — OCI Resource Manager

# Submit the Terraform block above to OCI Resource Manager via a configured
# Git source-provider. Variables are entered through the Console UI (schema-driven
# by an optional schema.yaml); state is stored in OCI Object Storage automatically.
# This is an INVOCATION snippet — the .tf body is the existing Terraform block
# on this same control-box (do NOT duplicate HCL here).
oci resource-manager stack create-from-git-provider \
  --compartment-id "$COMPARTMENT_OCID" \
  --config-source-provider-id "$CONFIG_SRC_PROVIDER_OCID" \
  --repository-url "https://example.com/org/hardening-iac" \
  --branch-name "main" \
  --working-directory "modules/oci-genai-05-vault-encryption" \
  --display-name "oci-genai-05-vault-encryption" \
  --terraform-version "1.5.x"

# Plan + apply via the ORM job lifecycle (state stored in OCI automatically).
STACK_OCID=$(oci resource-manager stack list \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "oci-genai-05-vault-encryption" \
  --query 'data[0].id' --raw-output)
PLAN_JOB_OCID=$(oci resource-manager job create-plan-job \
  --stack-id "$STACK_OCID" --query 'data.id' --raw-output)
oci resource-manager job create-apply-job \
  --stack-id "$STACK_OCID" \
  --execution-plan-strategy FROM_PLAN_JOB \
  --execution-plan-job-id "$PLAN_JOB_OCID"

Compliance mapping

'Log Source' = 'OCI Audit Logs'
          and 'Service Name' in ('generative-ai', 'kms')
          and (
            (eventName in ('UpdateModel', 'UpdateDedicatedAiCluster') and data.request.payload.kmsKeyId is null)
            or
            (eventName = 'ScheduleKeyDeletion' and data.target.key.id in_subset 'GenAIBoundKeys')
          )
          | stats count by 'User Name', data.target.id, eventName, 'Service Name'