Permissions Required for Each API Operation

CLUSTER_NETWORK_CREATE and INSTANCE_POOL_CREATE

CLUSTER_NETWORK_DELETE and INSTANCE_POOL_DELETE

CROSS_CONNECT_UPDATE

CROSS_CONNECT_CREATE if not creating cross-connect in a cross-connect group.

If creating the cross-connect in a cross-connect group, also need CROSS_CONNECT_CREATE and CROSS_CONNECT_ATTACH

CROSS_CONNECT_DELETE if cross-connect is not in a cross-connect group.

If the cross-connect is in a cross-connect group, also need CROSS_CONNECT_DELETE and CROSS_CONNECT_DETACH

DRG_ATTACHMENT_UPDATE

ROUTE_TABLE_ATTACH is necessary to associate a route table with the DRG attachment during the update.

DRG_ATTACH and VCN_ATTACH

ROUTE_TABLE_ATTACH is necessary to associate a route table with the DRG attachment during creation.

INSTANCE_IMAGE_CREATE and INSTANCE_CREATE_IMAGE

The first permission is related to the instance-image; the second is related to the instance.

INSTANCE_CREATE and INSTANCE_IMAGE_READ and VNIC_CREATE and VNIC_ATTACH and SUBNET_ATTACH

If putting the instance in a network security group during instance creation, also need NETWORK_SECURITY_GROUP_UPDATE_MEMBERS and VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP

If creating an instance in a compute cluster, also need COMPUTE_CLUSTER_LAUNCH_INSTANCE

INSTANCE_READ

If listing instances in a compute cluster, also need COMPUTE_CLUSTER_READ

INSTANCE_DELETE and VNIC_DELETE and SUBNET_DETACH

If volumes are attached, also need VOLUME_ATTACHMENT_DELETE and VOLUME_WRITE and INSTANCE_DETACH_VOLUME

INSTANCE_CONFIGURATION_CREATE (if using the CreateInstanceConfigurationDetails subtype)

INSTANCE_READ and VNIC_READ and VNIC_ATTACHMENT_READ and VOLUME_INSPECT and VOLUME_ATTACHMENT_INSPECT (if using the CreateInstanceConfigurationFromInstanceDetails subtype)

INSTANCE_POOL_DELETE and INSTANCE_DELETE and VNIC_DELETE and SUBNET_DETACH and VOLUME_ATTACHMENT_DELETE and VOLUME_WRITE

Required to create IPSec over FastConnect: DRG_ROUTE_TABLE_ATTACH, DRG_ROUTE_TABLE_CREATE DRG_ROUTE_TABLE_UPDATE, DRG_ROUTE_DISTRIBUTION_CREATE, DRG_ROUTE_DISTRIBUTION_UPDATE, DRG_ROUTE_DISTRIBUTION_ASSIGN, DRG_ROUTE_DISTRIBUTION_STATEMENT_UPDATE

Required to create IPSec over FastConnect: DRG_ROUTE_TABLE_DELETE DRG_ROUTE_TABLE_UPDATE, DRG_ROUTE_DISTRIBUTION_DELETE, DRG_ROUTE_DISTRIBUTION_UPDATE, DRG_ROUTE_DISTRIBUTION_STATEMENT_UPDATE

IPV6_READ and SUBNET_READ (if listing by subnet) and VNIC_READ (if listing by VNIC)

IPV6_UPDATE and

VNIC_UNASSIGN and VNIC_ASSIGN (if moving IPv6 to a different VNIC)

LOCAL_PEERING_GATEWAY_UPDATE

ROUTE_TABLE_ATTACH is necessary to associate a route table with the LPG during the update.

LOCAL_PEERING_GATEWAY_CREATE and VCN_ATTACH

ROUTE_TABLE_ATTACH is necessary to associate a route table with the LPG during creation.

LOCAL_PEERING_GATEWAY_CONNECT_FROM and

LOCAL_PEERING_GATEWAY_CONNECT_TO

NETWORK_SECURITY_GROUP_CREATE and VCN_ATTACH

NETWORK_SECURITY_GROUP_UPDATE_SECURITY_RULES and

NETWORK_SECURITY_GROUP_INSPECT if writing a rule that specifies a network security group as the source (for ingress rules) or destination (for egress rules)

NETWORK_SECURITY_GROUP_UPDATE_SECURITY_RULES and

NETWORK_SECURITY_GROUP_INSPECT if writing a rule that specifies a network security group as the source (for ingress rules) or destination (for egress rules)

PRIVATE_IP_CREATE and PRIVATE_IP_ASSIGN and VNIC_ASSIGN and SUBNET_ATTACH

REMOTE_PEERING_CONNECTION_CONNECT_FROM and

REMOTE_PEERING_CONNECTION_CONNECT_TO

For ephemeral public IPs: PRIVATE_IP_READ

For reserved public IPs: PUBLIC_IP_READ

For ephemeral public IPs: PRIVATE_IP_READ

For reserved public IPs: PUBLIC_IP_READ

For ephemeral public IPs: PRIVATE_IP_READ

For reserved public IPs: PUBLIC_IP_READ

For ephemeral public IPs: PRIVATE_IP_READ

For reserved public IPs: PUBLIC_IP_READ

For ephemeral public IPs: PRIVATE_IP_UPDATE

For reserved public IPs: PUBLIC_IP_UPDATE and PRIVATE_IP_ASSIGN_PUBLIC_IP and PUBLIC_IP_ASSIGN_PRIVATE_IP and PRIVATE_IP_UNASSIGN_PUBLIC_IP and PUBLIC_IP_UNASSIGN_PRIVATE_IP

For ephemeral public IPs: PRIVATE_IP_ASSIGN_PUBLIC_IP

For reserved public IPs: PUBLIC_IP_CREATE and PUBLIC_IP_ASSIGN_PRIVATE_IP and PRIVATE_IP_ASSIGN_PUBLIC_IP

For ephemeral public IPs: PRIVATE_IP_UNASSIGN_PUBLIC_IP

For reserved public IPs: PUBLIC_IP_DELETE and PUBLIC_IP_UNASSIGN_PRIVATE_IP and PRIVATE_IP_UNASSIGN_PUBLIC_IP

PUBLIC_IP_MOVE

Note: This operation applies only to reserved public IPs.

ROUTE_TABLE_UPDATE and

INTERNET_GATEWAY_ATTACH (if creating a route rule that uses an internet gateway as a target) and

INTERNET_GATEWAY_DETACH (if deleting a route rule that uses an internet gateway as a target) and

DRG_ATTACH (if creating a route rule that uses a DRG as a target) and

DRG_DETACH (if deleting a route rule that uses a DRG as a target) and

PRIVATE_IP_ROUTE_TABLE_ATTACH (if creating a route rule that uses a private IP as a target) and

PRIVATE_IP_ROUTE_TABLE_DETACH (if deleting a route rule that uses a private IP as a target) and

LOCAL_PEERING_GATEWAY_ATTACH (if creating a route rule that uses an LPG as a target) and

LOCAL_PEERING_GATEWAY_DETACH (if deleting a route rule that uses an LPG as a target) and

NAT_GATEWAY_ATTACH (if creating a route rule that uses a NAT gateway as a target) and

NAT_GATEWAY_DETACH (if deleting a route rule that uses a NAT gateway as a target) and

SERVICE_GATEWAY_ATTACH (if creating a route rule that uses a service gateway as a target) and

SERVICE_GATEWAY_DETACH (if deleting a route rule that uses a service gateway as a target)

ROUTE_TABLE_CREATE and VCN_ATTACH and

INTERNET_GATEWAY_ATTACH (if creating a route rule that uses an internet gateway as a target) and

DRG_ATTACH (if creating a route rule that uses a DRG as a target) and

PRIVATE_IP_ROUTE_TABLE_ATTACH (if creating a route rule that uses a private IP as a target) and

LOCAL_PEERING_GATEWAY_ATTACH (if creating a route rule that uses an LPG as a target) and

NAT_GATEWAY_ATTACH (if creating a route rule that uses a NAT gateway as a target) and

SERVICE_GATEWAY_ATTACH (if creating a route rule that uses a service gateway as a target)

ROUTE_TABLE_DELETE and VCN_DETACH and

INTERNET_GATEWAY_DETACH (if deleting a route rule that uses an internet gateway as a target) and

DRG_DETACH (if deleting a route rule that uses a DRG as a target) and

PRIVATE_IP_ROUTE_TABLE_DETACH (if deleting a route rule that uses a private IP as a target) and

LOCAL_PEERING_GATEWAY_DETACH (if deleting a route rule that uses an LPG as a target) and

NAT_GATEWAY_DETACH (if deleting a route rule that uses a NAT gateway as a target) and

SERVICE_GATEWAY_DETACH (if deleting a route rule that uses a service gateway as a target)

SERVICE_GATEWAY_UPDATE

ROUTE_TABLE_ATTACH is necessary to associate a route table with the service gateway during the update.

SERVICE_GATEWAY_CREATE and VCN_READ and VCN_ATTACH

ROUTE_TABLE_ATTACH is necessary to associate a route table with the service gateway during creation.

SUBNET_UPDATE

If changing which route table is associated with the subnet, also need ROUTE_TABLE_ATTACH and ROUTE_TABLE_DETACH

If changing which security lists are associated with the subnet, also need SECURITY_LIST_ATTACH and SECURITY_LIST_DETACH

If changing which set of DHCP options are associated with the subnet, also need DHCP_ATTACH and DHCP_DETACH

VIRTUAL_CIRCUIT_UPDATE and DRG_ATTACH and DRG_DETACH

If updating which cross-connect or cross-connect group the virtual circuit is using, also need CROSS_CONNECT_DETACH and CROSS_CONNECT_ATTACH

VIRTUAL_CIRCUIT_CREATE and DRG_ATTACH

If creating the virtual circuit with a mapping to a specific cross-connect or cross-connect group, also need CROSS_CONNECT_ATTACH

VIRTUAL_CIRCUIT_DELETE and DRG_DETACH

If deleting a virtual circuit that's currently using a cross-connect or cross-connect group, also need CROSS_CONNECT_DETACH

VLAN_CREATE and VCN_ATTACH and ROUTE_TABLE_ATTACH and SECURITY_LIST_ATTACH and VLAN_ASSOCIATE_NETWORK_SECURITY_GROUP

VLAN_DELETE and VCN_DETACH and ROUTE_TABLE_DETACH and SECURITY_LIST_DETACH and VLAN_DISASSOCIATE_NETWORK_SECURITY_GROUP

INSTANCE_ATTACH_SECONDARY_VNIC and VNIC_ATTACH and VNIC_CREATE and SUBNET_ATTACH

If putting the secondary VNIC in a network security group during VNIC creation, also need NETWORK_SECURITY_GROUP_UPDATE_MEMBERS and VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP

VNIC_UPDATE

If adding or removing the VNIC from a network security group, also need NETWORK_SECURITY_GROUP_UPDATE_MEMBERS and VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP

VTAP_UPDATE and CAPTURE_FILTER_ATTACH (new) and NLB_VTAP_TARGET_ATTACH (when NLB as target) and VNIC_ATTACH (both new source and target) or SUBNET_ATTACH (when subnet as source) or LB_VTAP_ENABLE (when load balancer as source) or DB_SYSTEM_VTAP_ENABLE (when DB system as source) or EXADATA_VM_CLUSTER_VTAP_ENABLE (when Exadata cluster as source) or ADW_VTAP_ENABLE (when ADW as source) and NLB_VTAP_TARGET_DETACH (when NLB as target) and CAPTURE_FILTER_DETACH (old) and VNIC_DETACH (both old source and target) or SUBNET_DETACH (when subnet as source) or LB_VTAP_DISABLE (when load balancer as source) or DB_SYSTEM_VTAP_DISABLE (when DB system as source) or EXADATA_VM_CLUSTER_VTAP_DISABLE (when Exadata cluster as source) or ADW_VTAP_DISABLE (when ADW as source)

VOLUME_ATTACHMENT_INSPECT and INSTANCE_INSPECT

Note: To also get the CHAP secret for the volume, then VOLUME_ATTACHMENT_READ is required instead of VOLUME_ATTACHMENT_INSPECT

VOLUME_GROUP_CREATE, VOLUME_INSPECT if creating the volume group from a list of volumes.

VOLUME_GROUP_CREATE, VOLUME_GROUP_INSPECT, VOLUME_CREATE, VOLUME_WRITE if cloning a volume group.

VOLUME_GROUP_CREATE, VOLUME_GROUP_BACKUP_INSPECT, VOLUME_BACKUP_READ/BOOT_VOLUME_BACKUP_READ, VOLUME_CREATE, VOLUME_WRITE if restoring from a volume group backup.

VOLUME_GROUP_BACKUP_CREATE, VOLUME_GROUP_INSPECT, VOLUME_WRITE, VOLUME_BACKUP_CREATE/BOOT_VOLUME_BACKUP_CREATE

DEDICATED_VM_HOST_LAUNCH_INSTANCE in dedicated virtual machine host compartment

INSTANCE_CREATE in compartment for the instance launched on the dedicated virtual machine host

WORKREQUEST_INSPECT

Work requests inherit the permissions of the operation that spawns the work request. Generally, <RESOURCE>_CREATE permissions for the associated resource are required.

Work requests inherit the permissions of the operation that spawns the work request. Generally, <RESOURCE>_CREATE permissions for the associated resource are required.