Permissions Required to Enable Database Management for Oracle Cloud Databases

To enable Database Management for Oracle Cloud Databases, you must have the following permissions:

Database Management Permissions

To enable Database Management for Oracle Cloud Databases, you must belong to a user group in your tenancy with the required permissions on the following Database Management resource-types:

  • dbmgmt-private-endpoints: This resource-type allows a user group to create Database Management private endpoints to communicate with Oracle Cloud Databases.
  • dbmgmt-work-requests: This resource-type allows a user group to monitor the work requests associated with Database Management private endpoints.
  • dbmgmt-family: This aggregate resource-type includes all individual Database Management resource-types and allows a user group to enable Database Management and use all its features.

Here are examples of the policies that grant the DB-MGMT-ADMIN user group the permission to create a Database Management private endpoint and monitor the work requests associated with the private endpoint:

Allow group DB-MGMT-ADMIN to manage dbmgmt-private-endpoints in tenancy
Allow group DB-MGMT-ADMIN to read dbmgmt-work-requests in tenancy

Alternatively, a single policy using the Database Management aggregate resource-type grants the DB-MGMT-ADMIN user group the same permissions detailed in the preceding paragraph:

Allow group DB-MGMT-ADMIN to manage dbmgmt-family in tenancy

For more information on Database Management resource-types and permissions, see Details for Database Management.

Other Oracle Cloud Infrastructure Service Permissions

In addition to Database Management permissions, the following Oracle Cloud Infrastructure service permissions are required to enable Database Management for Oracle Cloud Databases.

  • Bare Metal and Virtual Machine DB systems and Exadata Cloud service permission: To enable Database Management for Oracle Cloud Databases, you must have the required Bare Metal and Virtual Machine DB systems and Exadata Cloud service permissions.

    Here's an example of a policy that grants the DB-MGMT-ADMIN user group the permission to enable Database Management for the Oracle Cloud Databases in the tenancy:

    Allow group DB-MGMT-ADMIN to use database-family in tenancy

    For more information on specific Bare Metal and Virtual Machine DB systems and Exadata Cloud service resource-types and permissions, see Details for Bare Metal and Virtual Machine DB Systems and Details for Exadata Cloud Service Instances.

  • Networking service permissions: To work with the Database Management private endpoint and enable communication between Database Management and the Oracle Cloud Database, you must have the manage permission on the vnics resource-type and the use permission on the subnets resource-type and either the network-security-groups or security-lists resource-type.

    Here are examples of the individual policies that grant the DB-MGMT-ADMIN user group the required permissions:

    Allow group DB-MGMT-ADMIN to manage vnics in tenancy
    Allow group DB-MGMT-ADMIN to use subnets in tenancy
    Allow group DB-MGMT-ADMIN to use network-security-groups in tenancy

    or

    Allow group DB-MGMT-ADMIN to use security-lists in tenancy

    Alternatively, a single policy using the Networking service aggregate resource-type grants the DB-MGMT-ADMIN user group the same permissions detailed in the preceding paragraph:

    Allow group DB-MGMT-ADMIN to manage virtual-network-family in tenancy

    For more information on the Networking service resource-types and permissions, see the Networking section in Details for the Core Services.

  • Vault service permissions: To create new secrets or use existing secrets when specifying the database credentials to enable Database Management for Oracle Cloud Databases, you must have the manage permission on the secret-family aggregate resource-type.

    Here's an example of the policy that grants the DB-MGMT-ADMIN user group the permission to create and use secrets in the tenancy:

    Allow group DB-MGMT-ADMIN to manage secret-family in tenancy

    In addition to the user group policy for the Vault service, the following service policy is required to grant Database Management (dpd) the permission to read database password secrets in a specific vault:

    Allow service dpd to read secret-family in compartment ABC 
    where target.vault.id = 'Vault OCID'

    For more information on the Vault service resource-types and permissions, see Details for the Vault Service.