OCI Architect Professional: Identity and Access Management

Identity and Access Management

This domain tests least-privilege design across a tenancy: compartments, groups, policies, dynamic groups, and federation. Expect policy-evaluation questions and distinctions among user, instance, and resource principals.

Core rules

• The tenancy is the root compartment. Every resource belongs to one compartment. A policy attached to a compartment applies to that compartment and its descendants; it never applies upward to a parent or sideways to a sibling.
• Verbs are cumulative: inspect < read < use < manage. inspect lists resources; read adds metadata; use adds operational actions; manage adds create/update/delete and permission management.
• Syntax: allow group|dynamic-group|any-user to <verb> <resource-type> in compartment <name> where <conditions>. Conditions can constrain request.principal, target.compartment, tags, and operation.
• Dynamic groups match resources by rule using OCIDs, compartment, and tags. Instance principals obtain short-lived certificates from IMDS; no user API key is stored on the VM.
• Federation maps IdP group claims to OCI groups through mapping rules. Authentication succeeds at the IdP, but authorization still needs an OCI policy.

Worked example

An app VM in compartment App must read objects in compartment Data. Create dynamic group app-dg with rule instance.compartment.id = 'ocid1.compartment.oc1..app'. In Data, write allow dynamic-group app-dg to read objects in compartment Data. The app uses InstancePrincipalsAuthenticationDetailsProvider. Because the policy is in Data, it also covers child compartments of Data; it does not cover a bucket in App. If the instance moves compartments, the rule stops matching and access fails.

Traps

• Using manage all-resources in tenancy when read objects suffices.
• Assuming federation alone grants access; it only authenticates and maps groups.
• Placing a policy in a child compartment and expecting it to authorize a parent resource.
• Forgetting that read buckets is not read objects; object reads need the object resource type.
• Writing a dynamic-group rule by user name; dynamic groups match resource attributes, not people.