Process OCI CloudEvents for Instance resources.

The router receives events from the tenancy event handler and creates, updates,
or deletes Instance resources in the CMDB based on OCI CloudEvents.


OCI > Compute > Instance

compartment

OCI > Compute > Instance > Router

Update the defined tags for OCI Compute instance.


OCI > Compute > Instance > Update Defined Tags

Update the freeform tags for OCI Compute instance.


OCI > Compute > Instance > Update Freeform Tags

This control serves as a hierarchical parent for more specific Allowed controls, such as region/compartment-based controls and custom rule-based controls.&#92;n

OCI > Compute > Instance > Allowed

Take an action when an OCI Compute instance is not allowed based on custom rules.&#92;n&#92;nThe `Allowed &gt; Custom` control checks if the instance is allowed based on the `Allowed &gt; Custom &gt; *` policies. If the instance is not allowed, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete if not allowed and resource is new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n

OCI > Compute > Instance > Allowed > Custom > Rules

OCI > Compute > Instance > Allowed > Custom

Take an action when an OCI Compute instance is created in a region that is not allowed.&#92;n&#92;nThe `Allowed &gt; Region` control checks if the instance is created in an allowed region based on the `Allowed &gt; Region &gt; *` policies. If the instance is created in a region that is not in the allowed list, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete if region not allowed and instance is new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;n**Note:** Most OCI resources are compartment-scoped rather than region-scoped. This control applies to regional resources or checks the region metadata for compartment-scoped resources.&#92;n

OCI > Compute > Instance > Allowed > Region > Regions

OCI > Compute > Instance > Allowed > Region

Record and synchronize details for the OCI Compute instance into the CMDB.&#92;n&#92;nThe [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control is responsible for populating and updating all the attributes for that resource type in the Guardrails CMDB.&#92;n&#92;nIf set to Skip then all changes to the CMDB are paused - no new resources will be discovered, no updates will be made and deleted resources will not be removed.&#92;n&#92;nTo cleanup resources and stop tracking changes, set this policy to **&quot;Enforce: Disabled&quot;**.&#92;n

OCI > Compute > Instance > CMDB

Take an action when an OCI Compute instance defined tags is not updated based on the `OCI &gt; Compute &gt; Instance &gt; Defined Tags &gt; * policies`.&#92;n&#92;nIf the resource is not updated with the defined tags defined in `OCI &gt; Compute &gt; Instance &gt; Defined Tags &gt; Template`, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Tags](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

OCI > Compute > Instance > Defined Tags > Template

OCI > Compute > Instance > Defined Tags

Discover all OCI Compute instance resources and add them to the CMDB.&#92;n&#92;nThe [Discovery](https://turbot.com/guardrails/docs/concepts/guardrails/discovery) control is responsible for finding resources of a specific type. It periodically searches for new resources and saves them to the CMDB. Once discovered, resources are then responsible for tracking changes to themselves through the [CMDB](https://turbot.com/guardrails/docs/concepts/guardrails/cmdb) control.&#92;n

OCI > Region

OCI > Compute > Instance > Discovery

Take an action when an OCI Compute instance freeform tags is not updated based on the `OCI &gt; Compute &gt; Instance &gt; Freeform Tags &gt; * policies`.&#92;n&#92;nIf the resource is not updated with the freeform tags defined in `OCI &gt; Compute &gt; Instance &gt; Freeform Tags &gt; Template`, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nSee [Tags](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

OCI > Compute > Instance > Freeform Tags > Template

OCI > Compute > Instance > Freeform Tags

Compute

compute

Enriched image metadata from OCI getImage API

Compartment OCID (null for platform images)

Image display name (e.g., "Oracle-Linux-8.9-2024.01.26-0")

Launch mode (NATIVE, EMULATED, PARAVIRTUALIZED, CUSTOM)

Image listing type (NONE=platform/custom, COMMUNITY=marketplace)

Operating system type (e.g., "Oracle Linux", "CentOS", "CUSTOM")

Operating system version (e.g., "8.9", "CUSTOM")

instance

oci-compute

A list of OCI regions in which OCI Compute resources are allowed for use.&#92;n&#92;nThe expected format is an array of region names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all OCI Compute resources&#39; Allowed &gt; Region &gt; Regions policies.&#92;n

OCI > Compute

OCI > Tenancy

OCI > Compute > Allowed Regions [Default]

A list of OCI regions in which OCI Compute resources are supported for use.&#92;n&#92;nThe expected format is an array of region names. You may use the &#39;*&#39; and&#92;n&#39;?&#39; wildcard characters.&#92;n&#92;nThis policy is the default value for all OCI Compute resources&#39; Regions policies.&#92;n

OCI > Compute > Regions

This policy serves as a hierarchical parent for more specific Allowed policies, such as region/compartment-based policies and custom rule-based policies.&#92;n

Determine the action to take when an OCI Compute instance is not allowed based on custom rules.&#92;n&#92;nThe `Allowed &gt; Custom` control checks if the instance is allowed based on the `Allowed &gt; Custom &gt; *` policies. If the instance is not allowed, the control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete if not allowed and resource is new`, the control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n

Determine whether the OCI Compute instance is allowed to exist based on custom rules.&#92;n&#92;nThis policy will be evaluated by the `Allowed &gt; Custom` control. If an OCI Compute instance is not allowed, it will be subject to the action specified in the `Allowed &gt; Custom` policy.&#92;n&#92;n**Note**: The policy value must be a string with a value of `Allowed`, `Not allowed` or `Skip`, or in the form of YAML objects. The object(s) must contain the key `result` with its value as `Allowed` or `Not allowed`. A custom title and message can also be added using the keys `title` and `message` respectively.&#92;n&#92;n**Examples:**&#92;n&#92;nSimple string values:&#92;n```yaml&#92;n- Allowed&#92;n- Not allowed&#92;n- Skip&#92;n```&#92;n&#92;nObject format with custom message:&#92;n```yaml&#92;n- result: Allowed&#92;n- title: Cost Center Check&#92;n  result: Not allowed&#92;n- title: Environment Tag Check&#92;n  result: Allowed&#92;n  message: Resource has valid environment tag&#92;n```&#92;n&#92;nMultiple rules (array):&#92;n```yaml&#92;n- - title: Cost Center Check&#92;n    result: Allowed&#92;n    message: Resource has valid cost center tag&#92;n  - title: Owner Tag Check&#92;n    result: Not allowed&#92;n    message: Resource missing required owner tag&#92;n```&#92;n

string

Determine the action to take when an OCI Compute instance is created in a region that is not allowed.&#92;n&#92;nThe `Allowed &gt; Region` control checks if the instance is created in an allowed region based on the `Allowed &gt; Region &gt; *` policies. If the instance is created in a region that is not in the allowed list, the control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete if region not allowed and resource is new`, the control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;n**Note:** Most OCI resources are compartment-scoped rather than region-scoped. This control applies to regional resources or checks the region metadata for compartment-scoped resources.&#92;n

A list of OCI regions in which OCI Compute instances are allowed for use.&#92;n&#92;nThe expected format is an array of region names. You may use the &#39;*&#39; and &#39;?&#39; wildcard characters.&#92;n&#92;nThis policy will be evaluated by the `Allowed &gt; Region` control. If an OCI Compute instance is created in a region that is not in the allowed list, it will be subject to the action specified in the `Allowed &gt; Region` policy.&#92;n&#92;n**Common OCI Regions:**&#92;n- us-ashburn-1 (US East - Ashburn)&#92;n- us-phoenix-1 (US West - Phoenix)&#92;n- ca-toronto-1 (Canada - Toronto)&#92;n- uk-london-1 (UK - London)&#92;n- eu-frankfurt-1 (Germany - Frankfurt)&#92;n- ap-tokyo-1 (Japan - Tokyo)&#92;n- ap-sydney-1 (Australia - Sydney)&#92;n&#92;n**Note:** Most OCI resources are compartment-scoped rather than region-scoped.&#92;n

Configure CMDB behavior for OCI instance resources.&#92;n&#92;nRegional resources are discovered per-region under each compartment.&#92;nSet this policy at the Region level to control discovery.&#92;n

Determine the action to take when an OCI Compute instance defined tags are not updated based on the `OCI &gt; Compute &gt; Instance &gt; Defined Tags &gt; *` policies.&#92;n&#92;nThe control ensure OCI Compute instance defined tags include defined tags defined in `OCI &gt; Compute &gt; Instance &gt; Defined Tags &gt; Template`.&#92;n&#92;nDefined tags not defined in Instance Defined Tags Template will not be modified or deleted. Setting a tag value to `undefined` will result in the tag being deleted.&#92;n&#92;nSee [Tags](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

The template is used to generate the keys and values for OCI Compute instance.&#92;n&#92;nDefined tags not defined in Instance Defined Tags Template will not be modified or deleted. Setting a tag value to `undefined` will result in the tag being deleted.&#92;n&#92;nSee [Tags](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

Determine the action to take when an OCI Compute instance freeform tags are not updated based on the `OCI &gt; Compute &gt; Instance &gt; Freeform Tags &gt; *` policies.&#92;n&#92;nThe control ensure OCI Compute instance freeform tags include freeform tags defined in `OCI &gt; Compute &gt; Instance &gt; Freeform Tags &gt; Template`.&#92;n&#92;nFreeform tags not defined in Instance Freeform Tags Template will not be modified or deleted. Setting a tag value to `undefined` will result in the tag being deleted.&#92;n&#92;nSee [Tags](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

The template is used to generate the keys and values for OCI Compute instance.&#92;n&#92;nFreeform tags not defined in Instance Freeform Tags Template will not be modified or deleted. Setting a tag value to `undefined` will result in the tag being deleted.&#92;n&#92;nSee [Tags](https://turbot.com/guardrails/docs/concepts/guardrails/tagging) for more information.&#92;n

OCI Compute provides virtual machine instances in Oracle Cloud Infrastructure. Compute&#92;nenables you to provision and manage compute hosts, known as instances. You can launch&#92;ninstances as needed to meet your compute and application requirements.&#92;n

Oracle Cloud Infrastructure Compute Instance resource. Each Instance represents&#92;na virtual machine running within an OCI compartment.&#92;n

Mod: oci-compute

Recommended Version

Resource Types

Controls

Policies