将 OCI 文档理解服务与 Oracle Analytics 集成所需的策略

要将 Oracle Analytics 与将 OCI 文档理解服务集成，应确保具有所需的安全策略。

您在 Oracle Analytics Cloud 与 OCI 租户的连接中指定的 OCI 用户必须对您要使用的 OCI 资源所在的区间具有读取、写入和删除权限。确保该 OCI 用户所属的用户组至少具有以下 OCI 安全策略。从 Oracle Analytics 连接到 OCI 租户时，可以使用 OCI API 密钥或资源主体。

注：

Oracle Cloud ID (OCID) 是 OCI 中使用的资源标识符。

注：

对于资源主体，要将所有分析实例包含在一个区间下，请指定 {request.principal.type='analyticsinstance', request.principal.compartment.id='<compartmentA_ocid>'} 而非 {request.principal.id='<analytics_instance_ocid>'}。

API 密钥策略	资源主体策略
`Allow group <group_name> to use ai-service-document-family in compartment <compartment_name>` `Allow group <group_name> to manage ai-service-document-document-job in compartment <compartment_name>` `Allow group <group_name> to manage ai-service-document-processor-job in compartment <compartment_name>`	`Allow any-user to use ai-service-document-family in tenancy where all {request.principal.id='<analytics_instance_ocid>'}` `Allow any-user to manage ai-service-document-document-job in tenancy where all {request.principal.id='<analytics_instance_ocid>'}` `Allow any-user to manage ai-service-document-processor-job in tenancy where all {request.principal.id='<analytics_instance_ocid>'}`
`Allow group <group_name> to read buckets in compartment <compartment_name>`	`Allow any-user to read buckets in compartment <compartment_name> where all {request.principal.id='<analytics_instance_ocid>'}`
`Allow group <group_name> to manage objects in compartment <compartment_name> where target.bucket.name='<staging_bucket_name>'`	`Allow any-user to manage objects in compartment <compartment_name> where all {request.principal.id='<analytics_instance_ocid>', target.bucket.name='<staging_bucket_name>'}`
`Allow group <group_name> to read objects in compartment <compartment_name> where target.bucket.name='<document_bucket_name>'`	`Allow any-user to read objects in compartment <compartment_name> where all {request.principal.id='<analytics_instance_ocid>', target.bucket.name='<document_bucket_name>'}`
`Allow group <group_name> to read objectstorage-namespaces in tenancy`	`Allow any-user to read objectstorage-namespaces in tenancy where all {request.principal.id='<analytics_instance_ocid>'}`