OCI IAM Policy Calculator
Count the IAM policy statements a compartment design implies, check the limits and price the review effort.
Inputs
One statement per group per resource family, such as instance-family or object-family.
OCI allows six levels of nested compartments below the tenancy.
Policy Statements Required
144
Policy Documents Required
3
Statements per Compartment
12.0
Compartment Depth Check
Within the six-level nesting limit with 2 levels spare
Review Effort per Year
19.2hours
Annual Review Cost
$1,824.00
Fill of the Last Policy Document
88.0%
Design Verdict
Manageable policy surface for the compartment count
Step by step
Values used
Compartments needing policies = 12 compartments; Groups granted access per compartment = 4 groups; Resource families per group = 3 families; Deepest compartment nesting = 4 levels; Statements per policy document = 50 statements; Review time per statement = 4 minutes; Access reviews per year = 2 reviews; Loaded engineer rate = 95 USD/hour
OCI IAM Policy
statements = compartments × groups per compartment × resource families per group; policy documents = ceil(statements ÷ statements per document).
Policy Statements Required
= 144
Policy Documents Required
= 3
Statements per Compartment
= 12.0
Compartment Depth Check
= Within the six-level nesting limit with 2 levels spare
Review Effort per Year
= 19.2 hours
Annual Review Cost
= 1,824.00
How it works
The policy surface multiplies out: every compartment needs a statement for each group and each resource family it touches, so a modest design produces hundreds of statements. Because a statement written at a parent compartment is inherited by every compartment beneath it, moving grants up the tree is what actually reduces the count. IAM itself carries no charge, but the review burden is real and it scales with statement count — that is the cost this model prices, and it is the reason a flat compartment design with inherited policies beats a deep one with repeated grants. The six-level nesting limit is also a hard constraint you cannot design around later.
Formula
OCI IAM Policy
statements = compartments × groups per compartment × resource families per group; policy documents = ceil(statements ÷ statements per document).
- 6
- Maximum levels of nested compartments OCI permits below the tenancy
- statement
- One allow rule granting a group verbs on a resource family in a compartment
- resource family
- A grouping such as instance-family or object-family that one statement can cover
Frequently Asked Questions
How is OCI IAM Policy calculated?
statements = compartments × groups per compartment × resource families per group; policy documents = ceil(statements ÷ statements per document). The policy surface multiplies out: every compartment needs a statement for each group and each resource family it touches, so a modest design produces hundreds of statements. Because a statement written at a parent compartment is inherited by every compartment beneath it, moving grants up the tree is what actually reduces the count.
Why does OCI IAM Policy matter?
IAM itself carries no charge, but the review burden is real and it scales with statement count — that is the cost this model prices, and it is the reason a flat compartment design with inherited policies beats a deep one with repeated grants. The six-level nesting limit is also a hard constraint you cannot design around later.
What values do I need to enter?
This calculator takes 8 inputs: Compartments needing policies, Groups granted access per compartment, Resource families per group, Deepest compartment nesting, Statements per policy document, Review time per statement, Access reviews per year, Loaded engineer rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.