Planning Identity, Access Management and Governance on OCI
This domain tests policy syntax, dynamic groups and instance principals, and the governance tooling - compartments, tags, budgets and quotas - that keeps a tenancy auditable and bounded.
Structure and policy
- The tenancy root contains compartments nested up to six levels; each resource belongs to exactly one compartment.
- Policy syntax:
Allow <subject> to <verb> <resource-type> in <location> [where <conditions>]. Verbs ladder up: inspect < read < use < manage. - Policies are additive. There is no explicit deny statement, so restrict by granting narrowly rather than trying to subtract.
- Conditions narrow by
request.region,request.user.id,target.compartment.id, or request tags.
Identities
- Groups hold users; dynamic groups hold resources matched by a rule such as
All {instance.compartment.id = 'ocid1.compartment...'}. - Instance principals let code on a compute instance call OCI APIs without storing API keys.
- Identity domains support federation with a SAML 2.0 IdP, SCIM provisioning, and MFA enforcement.
Governance
- Defined tags (validated, namespaced) versus freeform tags; tag defaults enforce consistency at creation.
- Cost-tracking tags drive Cost Analysis; budgets raise alerts; quotas cap service consumption per compartment.
- Cloud Guard and Audit logs give continuous detection and an immutable record of API activity.
Worked example
An app on instances in compartment App must read objects in AppData with no user credentials. Create a dynamic group with the matching rule on instance.compartment.id, then grant Allow dynamic-group app-instances to read object-family in compartment AppData. Reasoning: resource principals avoid embedded keys, and read is enough for GetObject/ListObjects - granting manage would over-privilege.
Traps
Candidates write Deny statements that OCI does not support. Mixing up groups (users) and dynamic groups (resources) is common. A policy written in tenancy applies across all compartments, which is rarely intended. Compartments must be empty before deletion.