Applies toOCI IAM with identity domains
1. Identity domains and federation
- The Default domain holds administrators; consider a separate domain for application users/customers.
- Federate with your IdP (Entra ID, Okta) via SAML/OIDC, with SCIM group provisioning.
- MFA enforced through a sign-on policy for all console users (at least for administrators).
2. Groups and policies by role
| Group | Example policy statements |
|---|---|
| NetworkAdmins | Allow group NetworkAdmins to manage virtual-network-family in compartment cmp-network |
| SecurityAdmins | Allow group SecurityAdmins to manage vaults in compartment cmp-security |
| AppAdmins-Payments | Allow group AppAdmins-Payments to manage instance-family in compartment cmp-landingzone:cmp-appdev:cmp-payments-prod |
| DBAdmins | Allow group DBAdmins to manage database-family in compartment cmp-database |
| Auditors | Allow group Auditors to inspect all-resources in tenancy |
Allow group Auditors to read audit-events in tenancy |
Use the verbs carefully: inspect < read < use < manage. Most operators need use, not manage.
Cross-compartment needs are common: app admins usually need use virtual-network-family (to attach VNICs) and read on the network compartment.
3. Conditions
Allow group AppAdmins-Payments to manage instance-family in compartment cmp-payments-prod
where request.permission != 'INSTANCE_DELETE'
Allow group NetworkAdmins to manage virtual-network-family in tenancy
where target.resource.tag.Ops.Owner = 'network'
4. Workload identities
- Dynamic groups + policies for instances and functions (instance principals / resource principals). No API keys on servers.
- OKE workloads use workload identity with policies on the service account.
Any {instance.compartment.id = 'ocid1.compartment.oc1..aaaa-payments-prod'}
Allow dynamic-group dg-payments-instances to read secret-family in compartment cmp-security
5. Administrators and break-glass
- Tenancy administrators: a small group, MFA with strong factors, used only for tenancy-level tasks.
- Break-glass user (local to the Default domain, not federated) for IdP outages; credentials in a safe; alert on its sign-in via Audit + Events.
- API keys: inventory, owner, rotation; remove keys from users who left.
oci iam user api-key list --user-id <user-ocid> --output table
6. Review
- Quarterly review of group membership and policies (policy statements accumulate quickly).
- Cloud Guard detectors for IAM changes (policy changes, new admin users).
DR note
IAM in OCI is tenancy-wide and replicated to all subscribed regions, so users, groups and policies work in the DR region automatically. Identity domains replicate to regions you choose; check that your domain is replicated to the DR region.