OCI IAM Policy Calculator
Count the IAM policy statements a compartment design implies, check the limits and price the review effort.
About OCI IAM Policy Calculator
The policy surface multiplies out: every compartment needs a statement for each group and each resource family it touches, so a modest design produces hundreds of statements. Because a statement written at a parent compartment is inherited by every compartment beneath it, moving grants up the tree is what actually reduces the count. IAM itself carries no charge, but the review burden is real and it scales with statement count — that is the cost this model prices, and it is the reason a flat compartment design with inherited policies beats a deep one with repeated grants. The six-level nesting limit is also a hard constraint you cannot design around later.
Formula
OCI IAM Policy
statements = compartments × groups per compartment × resource families per group; policy documents = ceil(statements ÷ statements per document).
- 6
- Maximum levels of nested compartments OCI permits below the tenancy
- statement
- One allow rule granting a group verbs on a resource family in a compartment
- resource family
- A grouping such as instance-family or object-family that one statement can cover
Worked example
With the default values below, OCI IAM Policy Calculator returns Policy Statements Required of 144. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Compartments needing policiesaccepts 1–1,000 compartments
- 12 compartments
- Groups granted access per compartmentaccepts 1–100 groups
- 4 groups
- Resource families per groupaccepts 1–50 families
- 3 families
- Deepest compartment nestingaccepts 1–10 levels
- 4 levels
- Statements per policy documentaccepts 1–100 statements
- 50 statements
- Review time per statementaccepts 0.5–60 minutes
- 4 minutes
- Access reviews per yearaccepts 0–12 reviews
- 2 reviews
- Loaded engineer rateaccepts 0–1,000 USD/hour
- 95 USD/hour
Results
- Policy Statements Required
- 144
- Policy Documents Required
- 3
- Statements per Compartment
- 12.0
- Compartment Depth Check
- Within the six-level nesting limit with 2 levels spare
- Review Effort per Year
- 19.2 hours
- Annual Review Cost
- $1,824.00
- Fill of the Last Policy Document
- 88.0%
- Design Verdict
- Manageable policy surface for the compartment count
Step by step
- 1Values used
- 2OCI IAM Policy
- 3Policy Statements Required= 144
- 4Policy Documents Required= 3
- 5Statements per Compartment= 12.0
- 6Compartment Depth Check= Within the six-level nesting limit with 2 levels spare
- 7Review Effort per Year= 19.2 hours
- 8Annual Review Cost= 1,824.00
Assumptions and limits
- The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation or tax into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is OCI IAM Policy calculated?
statements = compartments × groups per compartment × resource families per group; policy documents = ceil(statements ÷ statements per document). The policy surface multiplies out: every compartment needs a statement for each group and each resource family it touches, so a modest design produces hundreds of statements. Because a statement written at a parent compartment is inherited by every compartment beneath it, moving grants up the tree is what actually reduces the count.
Why does OCI IAM Policy matter?
IAM itself carries no charge, but the review burden is real and it scales with statement count — that is the cost this model prices, and it is the reason a flat compartment design with inherited policies beats a deep one with repeated grants. The six-level nesting limit is also a hard constraint you cannot design around later.
What values do I need to enter?
This calculator takes 8 inputs: Compartments needing policies, Groups granted access per compartment, Resource families per group, Deepest compartment nesting, Statements per policy document, Review time per statement, Access reviews per year, Loaded engineer rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.