Oracle Cloud Infrastructure Documentation

Cloud Guard Changes when a Security Zone is Deleted

When you delete a security zone, the Cloud Guard configuration is also changed. The specific changes in Cloud Guard depend on the existing targets and security zones in the compartment hierarchy.

This page explains five scenarios for how Cloud Guard configuration can change when a security zone is deleted.

No Dependencies

In the simplest case, the existing security zone target for this zone's parent compartment is replaced with a standard Cloud Guard target.

The new target includes the default Oracle-managed configuration and activity detector recipes, and doesn't detect security zone policy violations. No changes are made to any of the existing Cloud Guard detector recipes.

The following diagram illustrates the Cloud Guard configuration after the security zone for the parent compartment is deleted:


The parent compartment has two subcompartments. None of the compartments are in a security zone. The parent compartment is associated with a standard target in Cloud Guard. The target is associated with the default detector recipes.

Parent Compartment Is in a Different Zone

The primary compartment for the deleted security zone has a parent compartment that's in a different zone. Deleting this security zone results in the compartment becoming part of the parent compartment's zone.

The security zone target for the child compartment is deleted in Cloud Guard. No changes are made to the parent compartment's security zone target, or to any of the existing Cloud Guard detector recipes.

The following diagram illustrates the Cloud Guard configuration after the security zone for the child compartment is deleted:


The parent compartment has two child compartments, and all of them are in the same security zone. The parent compartment is associated with a security zone target in Cloud Guard. The target is associated with detector recipes.

Parent Compartment Has a Standard Cloud Guard Target

The primary compartment for the deleted security zone has a parent compartment that's associated with a standard target in Cloud Guard. Deleting this security zone results in the compartment becoming part of the parent compartment's Cloud Guard target.

The existing security zone target for this zone's primary compartment is deleted in Cloud Guard. This compartment (and any child compartments previously in this zone) inherits the existing Cloud Guard target for the parent compartment. This standard target doesn't detect security zone policy violations. No changes are made to any of the existing Cloud Guard targets and detector recipes.

The following diagram illustrates the Cloud Guard configuration after the security zone for the child compartment is deleted:


The highlighted compartment has a parent compartment and a child compartment. None of the compartments is in a security zone. The parent compartment is associated with a standard target in Cloud Guard. The target is associated with detector recipes.

Child Compartment Is in a Different Zone

The compartment for the deleted security zone has one or more child compartments that are in different zones. Deleting this security zone has no effect on the other security zones.

The existing security zone target for this zone's parent compartment is replaced with a standard Cloud Guard target. The new target has the same detector recipes as the deleted security zone target, and doesn't detect security zone policy violations. The child compartments that are in different Security Zones are unaffected. No changes are made to any of the existing Cloud Guard detector recipes.

The following diagram illustrates the Cloud Guard configuration after the security zone for the parent compartment is deleted:


The parent compartment isn't in a security zone, and it has a child compartment that's in a security zone. The parent compartment is associated with a standard Cloud Guard target. The standard target is associated with the same detector recipes that it had previously. The child compartment is associated with a security zone target in Cloud Guard. The security zone target is associated with different detector recipes.

Child Compartment Has a Standard Cloud Guard Target

The compartment for the deleted security zone has one or more child compartments that are not in a security zone and are associated with standard Cloud Guard targets. Deleting this security zone has no effect on the child compartments.

The existing security zone target for this zone's parent compartment is replaced with a standard Cloud Guard target. The new target has the same detector recipes as the deleted security zone target, and doesn't detect security zone policy violations. The child compartments that were removed from the security zone and have separate Cloud Guard targets are unaffected. No changes are made to any of the existing Cloud Guard detector recipes.

The following diagram illustrates the Cloud Guard configuration after the security zone for the parent compartment is deleted:


Neither the parent compartment or its child compartment is in a security zone. The parent compartment is associated with a standard Cloud Guard target. The standard target is associated with the same detector recipes that it had previously. The child compartment is associated with a different Cloud Guard target and different detector recipes.