I85PREP
⌘ K
OCI Security Professional study materials
OCI Security Professional study resources

OCI Security Professional: Security fundamentals and OCI Identity and Access Management

OCI Security Professional · Work through your exam, one topic at a time.

All guide sections

Security fundamentals and OCI Identity and Access Management

This domain tests how OCI isolates tenants, compartments, and principals, and how IAM policies turn those boundaries into least-privilege access. Expect questions on policy syntax, dynamic groups, federation, MFA, and the difference between authentication and authorization.

Core rules

  • Every request is made by a principal: a user, an instance principal, a resource principal, or a service principal. A dynamic group is not a principal by itself; it matches instances or resources so they can assume instance or resource principals.
  • Compartments form a hierarchy. Policies attached to a compartment apply to that compartment and its child compartments; policies attached to the tenancy root apply broadly.
  • OCI IAM is allow-only. There is no explicit deny statement. Access is the union of applicable allow policies, so broad manage grants can silently override a carefully scoped read grant.
  • Verb aggregates build on one another: inspect (list), read (inspect plus get), use (read plus update), manage (all operations, including create and delete).
  • Federation uses an identity provider; MFA and password policies belong to identity domains. API keys, auth tokens, and customer secret keys are credentials, not authorization.

Worked example

A function in the Prod compartment must read objects in the reports bucket, but the team must not delete them. Create a dynamic group FnPrincipals with a matching rule such as resource.compartment.id = 'ocid1.compartment...' and resource.type = 'fnfunc'. Then write: Allow dynamic group FnPrincipals to read objects in compartment Prod where target.bucket.name = 'reports'. Reasoning: the dynamic group supplies the principal; the policy supplies the permitted verb and resource scope; read avoids delete. Do not use manage objects, which includes deletion.

Traps

Using a regular group for a function; attaching a policy to the wrong compartment; assuming a policy in a child compartment grants access to the parent; treating inspect as enough to read content; and forgetting that tenancy administrators can bypass compartment boundaries.