Home / OCI

OCICheat sheetBeginner

OCI IAM policy cheat sheet

Policy syntax, the four verbs, resource families, dynamic groups, conditions and service policies, plus how to debug NotAuthorizedOrNotFound.

Deepak Bhardwaj3 min read

Applies toOCI IAM with Identity Domains

Syntax

Allow <subject> to <verb> <resource-type> in <location> [where <conditions>]
  • subject: group <name>, dynamic-group <name>, any-user, or service <name>. With identity domains other than Default, write group '<domain>'/'<group>'.
  • location: tenancy, compartment <name> or compartment <parent>:<child>, or compartment id <ocid>.
  • A policy applies to the compartment it's attached to and all child compartments.

The four verbs

Verb Can do Typical use
inspect List resources, without confidential details Auditors
read inspect + get details Read-only operators
use read + work with existing resources (start/stop, attach) Operators
manage Everything, including create and delete Admins

Resource families

Family Covers
all-resources Everything
instance-family Instances, console connections, images
volume-family Block and boot volumes, backups
virtual-network-family VCNs, subnets, gateways, NSGs, route tables
object-family Buckets and objects
database-family Base DB systems and databases
autonomous-database-family Autonomous databases
cluster-family OKE clusters and node pools

Copy-paste policies

# Network team owns networking in the Network compartment
Allow group NetworkAdmins to manage virtual-network-family in compartment Network

# App team runs compute in its compartment, but must use the shared network
Allow group AppOps to manage instance-family in compartment Apps
Allow group AppOps to use volume-family in compartment Apps
Allow group AppOps to use virtual-network-family in compartment Network

# Read-only auditors across the tenancy
Allow group Auditors to inspect all-resources in tenancy
Allow group Auditors to read audit-events in tenancy

# Users can manage their own API keys and auth tokens
Allow any-user to manage api-keys in tenancy where request.user.id = target.user.id

Dynamic groups (instance principals)

A matching rule decides which instances belong to the group:

ALL {instance.compartment.id = 'ocid1.compartment.oc1..aaaa'}
ANY {instance.id = 'ocid1.instance.oc1...', tag.App.Role.value = 'backup'}

Allow dynamic-group BackupVMs to manage objects in compartment Backups where target.bucket.name = 'db-backups'

On the instance: oci os object list -bn db-backups --auth instance_principal.

Conditions

where target.bucket.name = 'logs'
where request.permission = 'BUCKET_READ'
where request.region = 'ap-mumbai-1'
where any {request.operation = 'LaunchInstance', request.operation = 'TerminateInstance'}
where target.resource.tag.Env.Stage.value = 'dev'

Service policies people forget

# Object Storage lifecycle policies and replication
Allow service objectstorage-ap-mumbai-1 to manage object-family in compartment Apps

# OKE and Cloud Guard need their own statements; see the service docs for the exact text

Debugging "NotAuthorizedOrNotFound"

OCI returns 404 NotAuthorizedOrNotFound for both "doesn't exist" and "not allowed", so it doesn't tell you which. Check in this order:

  1. Is the OCID correct, and is it in the region your CLI profile points to?
  2. Which groups is the user in, and in which identity domain? oci iam user list-groups --user-id <ocid>
  3. Is the policy attached at or above the target compartment?
  4. Does the verb cover the operation? Attaching a volume needs use on the instance and on the volume.
  5. Policy changes can take up to a few minutes to apply. Retry before you rewrite anything.

Tip

Keep policies in Terraform and review them as code. Read a statement aloud as an English sentence: if it sounds broader than you intended, it is.

Related fixes