oci-landing-zone

name	oci-landing-zone
description	Assess, design, deploy, upgrade, and validate OCI landing zones and greenfield tenancy guardrails using Cloud Adoption Framework and Well-Architected guidance. Orchestrates IAM, security, networking, observability, cost, Terraform, and Resource Manager while preserving one IaC owner and the existing Solution Blueprint. Ordinary project lifecycle remains with oci-project.

OCI Landing Zone

Turn organizational, governance, security, networking, and operating-model requirements into a reviewable Solution Blueprint and a single-owner landing zone lifecycle. This skill orchestrates owning domains; it does not duplicate their service operations.

Routing

Intent	Owner
Landing zone, Cloud Adoption Framework, greenfield tenancy, enterprise guardrails, existing-estate landing-zone assessment	This skill
One workload/project bootstrap, health, deploy, teardown	oci-project
Generic customer solution design without landing-zone scope	Stage 0 Solution Blueprint workflow
IAM/security/network/cost service operation	Owning domain skill
HCL/module review and local execution	oci-terraform-authoring
Resource Manager stack/job execution	oci-resource-manager

Landing-zone intent takes precedence over generic project or networking terms. After the blueprint and ownership decision, each service action returns to its owning domain.

Read landing-zone.md for assessment, blueprint, ownership, deployment, upgrade, validation, and rollback contracts.

Common multi-step flows

Task	Sequence
Greenfield design	stakeholder/compliance intake → Cloud Adoption Framework and Well-Architected requirements → tenancy/identity/network/security/operations/cost decisions → Solution Blueprint → owner and rollout plan
Existing-estate assessment	named-context preflight → read-only inventory by domain → compare desired blueprint to observed state → classify adoption/import/drift risks → phased remediation backlog
Deploy	approved blueprint → source/module provenance review → oci-terraform-authoring validate/plan/show → choose local Terraform or Resource Manager → reviewed-plan apply → domain verification
Upgrade	pin and review source changes → read current state/drift → migration and moved/import design → staged plan → canary compartment → exact-plan rollout → posture validation
Validate	IAM separation → network segmentation → security services → logging/monitoring → budgets/tags → break-glass and recovery → evidence pack

Safety boundaries

• Assessment and blueprint authoring are read-only/offline. No preflight is needed for a hypothetical design; a live existing-estate inventory uses a named context and preflight when tenancy scope is ambiguous.
• Terraform is the single owner of durable landing-zone resources. Choose local Terraform or Resource Manager for a state/resource set, never both.
• Never apply unreviewed module updates or plan bytes. Module provenance, version constraints, lock metadata, state/backend, authentication context, realm support, and migration notes are part of review.
• A landing zone may need tenancy-wide permissions during bootstrap. Minimize duration, separate bootstrap from steady-state operators, and verify removal.
• Compliance blueprints are starting points, not automatic certification.

Verification and rollback

Validate the blueprint acceptance matrix across all owning domains, record gaps and exceptions, inspect drift, and confirm steady-state administration. Rollback uses the exact reviewed Terraform plan and migration strategy; destructive teardown requires dependency inventory and exact approval. Never mix manual CLI rollback with Terraform ownership without immediate HCL reconciliation.

Expected output

Report scope and assumptions, selected landing-zone family or custom blueprint, current-state evidence, decision/ownership matrix, phased plan, reviewed sources, validation evidence, exceptions, rollback, and domain handoffs.

Official documentation

Technology implementation · OCI Core Landing Zone · Well-Architected landing zones. Full index in oracle-docs.md.

Open Knowledge Format grounding — every Oracle documentation link is registered and liveness-checked in the pack's central index.