Domain-Default Domain - User - Policy in OCI

 

The Oracle Cloud Infrastructure policy specifies who has access to which resources in OCI. Policies simply allow a group to manage certain types of resources in a specific compartment in certain ways.

Policy basic Syntax:

Allow group <group_name> | <group_ocid> to <verb> <resource-type> in compartment <compartment_name>

Allow group <group_name> | <group_ocid> to <verb> <resource-type> in tenancy

Verbs:

inspect: Resource listing without access to confidential information or user-specified metadata.
read: It includes inspect as well as the ability to get user-specified metadata as well as the resource itself.
use: Includes reading and working with existing resources. Includes updating the resource, except for resource types where “update” has the same effect as “create”. In general, this verb doesn’t include the ability to create or delete.
manage: Includes all permissions associated with the resource.

Resource types:

all-resources: All Oracle Cloud Infrastructure resource-types
compute-management-family: Compute
database-family: Autonomous Database, Bare Metal and Virtual Machine DB Systems
virtual-network-family: Networking

Scenario :-

In Domain we are going to create users and group

Users are created 

Now we need to create IAM policy for Amit and Sankar

Amit is - Linux Admin Guy 

Now Create group - VM-ADMIN

Create Policy

allow group VM-ADMIN to manage instance-family in tenancy

VM-ADMIN-POLICY at ROOT level 

Amit logged in to OCI console

Amit is not able to see anything 

We created a group and wrote a policy but we didn't add you in the group.

It doesn't work until and unless you add into the group.

Admin user :- Task

Adding Amit user into VM-ADMIN group

Now Amit's Task -

Note:- Amit won't be able to create any VM because he doesn't have any Networking access yet.

Administrator is going to Create Instance 

Now Amit is able to see Virtual Machin - VM-1

But Amit is not able to see   Users and Groups because amit is not IAM admin guy

We wrote Instance-Family 

VIMP:- below statement

Instance-Family is very important in order to give Virtual Machin Admin access

So, Amit can see any VM Machines which are created in any Compartment, admin guy at root level

===========2nd Scenario=====================================

 Sankar :- 

We will write a policy only for TEST Compartment and he will be only able to see Bucket

When you are creating Policy , there are only two steps 

Step 1) Create Group

Step 2) Create the policy 

Policy :-

By default Policy = Tenant Admin Policy 

ALLOW GROUP Administrators to manage all-resources IN TENANCY 

all-resources - Means you are having access to all resources in OCI

allow group VM-ADMIN to manage users in tenancy

allow group VM-ADMIN to manage groups in tenancy 

Note: Amit is not able to see the policy because admin didn't give 

Note: Amit is able to see the users because of below statements

allow group VM-ADMIN to manage users in tenancy

allow group VM-ADMIN to manage groups in tenancy 

Creating another Policy for Sankar user:-

allow group STORAGE-ADMIN to manage buckets in compartment test-dev-cmp

Let's create Bucket 

Now Sankar will check .. 

issue

Sankar doesn't have access so need to add policy 

Go to the policy

Before

Now Sankar screen:-

Sankar can start and stop the instance

Admin :- changing the policy statement for Sankar

changed from Manage to Read 

Now after changing the policy, sankar is not able to Stop the instance

allow group STORAGE-ADMIN to inspect instance-family in compartment test-dev-cmp

Sankar screen

Note:- Sankar won't be able to shape of the machine , as we updated policy --> inspect 

Sankar only able to IP address but not the name of VM instance 

Admin-

use - it will be only getting information 

Sankar -

Admin:-

Storage level - STORAGE_ADMIN

Sankar:- is not able to delete the VM