Security zone policy enforcement in a cloud infrastructure system

A security zone policy enforcement system in a cloud service provider infrastructure, comprising:

• a processor;
• and
• a memory storing instructions that, when executed by the processor, configure the system to:
• receive a request to perform an operation on a resource;
• determine a compartment associated with the resource, the compartment associated with a set of one or more compartment policies;
• determine that the operation on the resource is permitted based on the set of one or more compartment policies;
• responsive to the determination that the operation on the resource is permitted based on the set of one or more compartment policies, determine that the compartment is associated with a security zone, the security zone associated with one or more security zone policies;
• determine whether the operation on the resource is permitted or not based on the set of one or more security zone policies;
• and
• disallowing the operation to be performed on the resource upon determining that the operation on the resource is not permitted based on the set of one or more security zone policies.

A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:

• receiving, by a security zone policy enforcement system providing secure access to resources in a cloud service provider infrastructure, a first request to associate a compartment with a security zone, the compartment associated with a set of one or more compartment policies;
• responsive to the first request, associating, by the security zone policy enforcement system, the compartment with the security zone, the security zone associated with a set of one or more security zone policies;
• and wherein
• as a result of associating the compartment with the security zone, the compartment is associated with the set of one or more security zone policies and the set of one or more compartment policies;
• and wherein
• performing an operation on a resource within the compartment is disallowed if the operation on the resource is not permitted based on at least one of the set of one or more compartment policies or the set of one or more security zone policies.