Oracle Cloud Infrastructure Documentation

BYOR Policies

Learn about the policies required to use Bring Your Own Reservations (BYOR).

Your administrator must configure the required IAM policies before Data Science workloads can use customer-managed reservations.

Policy Requirements

Policy Category Required
Endorse Statements Yes
Capacity Reservation Permissions Yes
Compute Management Service Permissions Yes
Service-Managed Networking Permissions Required when using service-managed networking
Custom Networking Permissions Required when using custom networking
AQUA Dynamic Group Permissions Optional

Endorse Statements

Use the following endorse statements:

Define tenancy DataScienceTenancy as DATA_SCIENCE_TENANCY
Define tenancy DataScienceManagedEgressTenancy as DATA_SCIENCE_MANAGED_EGRESS_TENANCY
Note

Oracle provides the tenancy details and up-to-date policies during onboarding.

Endorse any-user to { INSTANCE_CONFIGURATION_CREATE, INSTANCE_CONFIGURATION_DELETE, INSTANCE_CONFIGURATION_INSPECT, INSTANCE_CONFIGURATION_LAUNCH, INSTANCE_CONFIGURATION_MOVE, INSTANCE_CONFIGURATION_READ, INSTANCE_CONFIGURATION_UPDATE, INSTANCE_POOL_CREATE, INSTANCE_POOL_DELETE, INSTANCE_POOL_INSTANCE_ATTACH, INSTANCE_POOL_INSTANCE_DETACH, INSTANCE_POOL_INSPECT, INSTANCE_POOL_INSTANCE_TERMINATION_PROCEED, INSTANCE_POOL_MOVE, INSTANCE_POOL_POWER_ACTIONS, INSTANCE_POOL_READ, INSTANCE_POOL_UPDATE, INSTANCE_CREATE, INSTANCE_DELETE, INSTANCE_INSPECT, INSTANCE_MOVE, INSTANCE_READ, INSTANCE_UPDATE, INSTANCE_IMAGE_READ, INSTANCE_IMAGE_INSPECT, INSTANCE_ATTACH_VOLUME, INSTANCE_DETACH_VOLUME, INSTANCE_DELETE_VOLUME } in tenancy DataScienceTenancy where ALL { request.principal.type in ('datasciencemodeldeploymentvrp','datasciencejobrunvrp', 'datasciencenotebooksessionvrp'), target.resource.tag.datascience.vrp-id = request.principal.id }

Endorse any-user to { VOLUME_CREATE, VOLUME_DELETE, VOLUME_INSPECT, VOLUME_MOVE, VOLUME_UPDATE, VOLUME_WRITE, VOLUME_ATTACHMENT_CREATE, VOLUME_ATTACHMENT_DELETE, VOLUME_ATTACHMENT_INSPECT, VOLUME_ATTACHMENT_READ, VOLUME_ATTACHMENT_UPDATE } in tenancy DataScienceTenancy where ALL { request.principal.type in ('datasciencemodeldeploymentvrp', 'datasciencejobrunvrp', 'datasciencenotebooksessionvrp'),  target.resource.tag.datascience.vrp-id = request.principal.id  }

# primary subnet 
Endorse any-user to { SUBNET_READ, SUBNET_ATTACH, SUBNET_DETACH } in tenancy DataScienceTenancy where ALL { request.principal.type in ('datasciencemodeldeploymentvrp', 'datasciencejobrunvrp', 'datasciencenotebooksessionvrp'), target.resource.tag.dataplane.vrp-access = request.principal.type }

# primary VNIC
Endorse any-user to { VNIC_ATTACH, VNIC_CREATE, VNIC_DELETE, VNIC_DETACH, VNIC_READ, VNIC_ATTACHMENT_READ, INSTANCE_ATTACH_SECONDARY_VNIC, INSTANCE_DETACH_SECONDARY_VNIC } in tenancy DataScienceTenancy where ALL { request.principal.type in ('datasciencemodeldeploymentvrp', 'datasciencejobrunvrp', 'datasciencenotebooksessionvrp'),  target.resource.tag.datascience.vrp-id = request.principal.id  }

# service managed secondary VNIC Subnet (all workloads of a given type share the same egress subnet)
Endorse any-user to { SUBNET_READ, SUBNET_ATTACH, SUBNET_DETACH } in tenancy DataScienceManagedEgressTenancy where all {request.principal.type in ('datasciencemodeldeploymentvrp', 'datasciencejobrunvrp', 'datasciencenotebooksessionvrp'),  target.resource.tag.dataplane.vrp-access = resource.principal.type } 

# service managed secondary VNIC
Endorse any-user to { VNIC_ATTACH, VNIC_CREATE, VNIC_DELETE, VNIC_DETACH, VNIC_READ, VNIC_ATTACHMENT_READ, INSTANCE_ATTACH_SECONDARY_VNIC, INSTANCE_DETACH_SECONDARY_VNIC } in tenancy DataScienceManagedEgressTenancy where ALL { request.principal.type in ('datasciencemodeldeploymentvrp', 'datasciencejobrunvrp', 'datasciencenotebooksessionvrp'), target.resource.tag.datascience.vrp-id = request.principal.id }

Allow Statements

For Custom networking, use the given allow statements. If the workload uses a subnet in your VCN then add the following policies:

# secondary VNIC
Allow any-user to { VNIC_ATTACH, VNIC_CREATE, VNIC_DELETE, VNIC_DETACH, VNIC_READ, VNIC_ATTACHMENT_READ, INSTANCE_ATTACH_SECONDARY_VNIC, INSTANCE_DETACH_SECONDARY_VNIC } in tenancy where ALL {request.principal.type in ('datasciencemodeldeploymentvrp', 'datasciencejobrunvrp', 'datasciencenotebooksessionvrp'), target.resource.tag.datascience.vrp-id = request.principal.id}

# secondary VNIC subnet
Allow any-user to { SUBNET_READ, SUBNET_ATTACH, SUBNET_DETACH } in tenancy where ALL {request.principal.type in ('datasciencemodeldeploymentvrp', 'datasciencejobrunvrp', 'datasciencenotebooksessionvrp'), request.principal.subnet.id = target.resource.subnet.id}
# Capacity Reservation
Allow any-user to { CAPACITY_RESERVATION_INSPECT, CAPACITY_RESERVATION_LAUNCH_INSTANCE, CAPACITY_RESERVATION_READ } in tenancy where ALL { request.principal.type in ('datasciencemodeldeploymentvrp', 'datasciencejobrunvrp', 'datasciencenotebooksessionvrp') }
Allow service compute_management to {CAPACITY_RESERVATION_LAUNCH_INSTANCE} in compartment <compartment> 
Allow service datascience to {CAPACITY_RESERVATION_READ} in compartment <compartment>
Allow group <group_name> to use compute-capacity-reservations in compartment <compartment>

# AQUA
Allow dynamic-group <DataScienceAquaDynamicGroup> to use compute-capacity-reservations in compartment <compartment>

Policy Explanation

  • Endorse statements allow Data Science resource principals to create and manage service infrastructure.
  • Capacity reservation permissions allow Data Science workloads to consume the specified reservation.
  • Service-managed networking permissions are required when using the default networking option.
  • Custom networking permissions are required when using customer-managed networking.
  • Compute Management service permissions are required for Model Deployments that use instance pools.
  • AQUA dynamic group permissions enable reservation selection when creating model deployments through AI Quick Actions.

For more information, see Managing Policies.