Preparing for Delegate Access Control

Allowlisting requirements in customer firewall or gateway (Applicable to ExaDB-C@C only)

To enable Secure Tunnel Service for remote Oracle operator access, configure your firewall or gateway to allow HTTPS (port 443) traffic between the URL listed below and your ExaDB-C@C infrastructure.

• URL format: https://dactlhe.exacc.$LONGREGIONNAME.oci.$TOPLEVELDOMAIN

  Replace $LONGREGIONNAME with the OCI region name, for example, us-ashburn-1

  Replace $TOPLEVELDOMAIN with the OCI region domain, for example, oraclecloud.com

  For example, the URL format for ashbhurn region will be https://dactlhe.exacc.us-ashburn-1.oci.oraclecloud.com

• Outbound port to allow: 443

Network Security Rule to allow SSH to the VM Cluster (Applicable to ExaDB-C@C, ExaDB-D, and ExaDB-XS)

Ensure that SSH (port 22) is permitted in the client subnet of the VM Cluster.

• ExaDB-C@C: Add network security rules to allow SSH access to, and within, the VM Cluster client subnet in your firewall.
• ExaDB-D and ExaDB-XS: Add network security lists, NSG, and ZPR policy (if applicable) to allow SSH access to, and within, the VM Cluster client subnet in your VCN.

If Zero Trust Packet Routing is enabled for your VM Cluster, allow SSH traffic for both ingress and egress using ZPR policy.

Here’s an example of a Zero Trust Packet Routing policy to allow SSH access within the client subnet of a Cloud VM Cluster:

• my-org is the security attribute namespace.
• my-org.database:Prod-VMCluster represents the security attribute key and value for the Cloud VM Cluster.
• my-org.network:vm-cluster-vcn represents the security attribute key and value for the VCN.

in my-org.network:dactl-vcn VCN allow my-org.database:Prod-VMCluster endpoints to connect to my-org.database:Prod-VMCluster endpoints

This policy ensures that communication within the VM Cluster is allowed explicitly, enforcing secure and restricted access in alignment with Zero Trust principles.

Network Security Rule to allow the VM Cluster to connect to other OCI services (Applicable to ExaDB-C@C, ExaDB-D, and ExaDB-XS)

Ensure that the VM Cluster can connect to other OCI services at port 443. Delegate Access Control requires access to OCI Object Storage Service.

• ExaDB-C@C: Add network security rules to allow the Control Plane Servers (CPS) to connect to required OCI services from the Control Plane network in your firewall. In particular, OCI Object Storage service is required by Delegate Access Control.
• ExaDB-D and ExaDB-XS: Add network security rules (security lists or NSGs) and ZPR policies (if applicable) to allow the VM Cluster to access required OCI services from the VM Cluster client subnet through the OCI Service Gateway (All <region> Services in Oracle Services Network).

If Zero Trust Packet Routing is enabled for your VM Cluster, allow osn-services-ip-addresses traffic for both ingress and egress.

in my-org.network:vm-cluster-vcn VCN allow osn-services-ip-addresses to connect to my-org.database:Prod-VMCluster endpoints with protocol='tcp/443'

in my-org.network:vm-cluster-vcn VCN allow my-org.database:Prod-VMCluster endpoints to connect to osn-services-ip-addresses with protocol='tcp/443'

This policy ensures that bidirectional traffic at port 443 between the OCI service and the Cloud VM Cluster is allowed explicitly, enforcing secure and restricted access in alignment with Zero Trust principles.

Network Route Rule to allow the VM Cluster to connect to other OCI services (Applicable to ExaDB-C@C and ExaDB-D, and ExaDB-XS)

• ExaDB-C@C: Add network route rules to allow the Control Plane Servers (CPS) to reach required OCI services from the Control Plane network in your router. In particular, OCI Object Storage service is required by Delegate Access Control.
• ExaDB-D and ExaDB-XS: Add network route rule in the route table of the client subnet of the VM Cluster for the OCI Service Gateway:
  • Target Type: Service Gateway
  • Destination: All <region> Services in Oracle Services Network

IAM Policies for Delegate Access Control Service

• Applicable to Oracle Managed Software Updates for Database Cloud Services

  If you use Delegate Access Control only with Oracle Managed Software Updates for Database Cloud Services, add the IAM policy below and then skip this section and proceed to the preparing-for-delac.html#GUID-1A5FD166-1283-4372-A128-1B2E9FF39129__GUID-CA5657EA-852D-476E-AD31-5CCBA03F425E section. Otherwise, add the IAM policies below for all applicable VM Cluster deployment types in your installation.

  To allow Delegate Access Control to publish messages to the ONS topic specified in the Delegation Control, create the following policy:

  allow any-user TO use ons-topics IN compartment <your compartment> where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }

  <your compartment> is the compartment of the ONS topic specified in the Delegation Controls

  Note
  
  

  You must subscribe to the ONS topic specified in the Delegation Control to receive notifications.

• Applicable to ExaDB-C@C, ExaDB-D, and ExaDB-XS (when service provider other than Oracle Managed Software Updates is used)

  While the VM Cluster is in maintenance, there may be a delay in approving your access request. Selecting the "Auto-approve access requests during the maintenance window" option when creating a Delegation Control allows automatic approval during scheduled maintenance window to speed up the approval process. When Service Provider operators raise an access request, Delegate Access Control needs to check if the VM Cluster is in maintenance mode or not to auto-approve the request.

  To allow Delegate Access Control to fetch information such as the lifecycle state, display name and compartment ID of the VM Cluster, DB Home, and database, create the following policy:

  allow any-user TO inspect database-family IN compartment <your compartment> where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }

  <your compartment> is the compartment of the ExaDB-C@C and ExaDB-D VM Clusters and databases to be governed by Delegate Access Control.

  Occasionally, Delegate Access Control will publish messages to you through OCI Notification Service (ONS) to the ONS topic specified when creating the Delegation Control:

  1. when an access request is waiting for approval
  2. when a duration extension of an access request is waiting for approval
  3. when an operator has responded to request for more information about an access request
  Note
  
  

  You must subscribe to the ONS topic specified in the Delegation Control to receive notifications.

  To allow Delegate Access Control to publish messages to the ONS topic specified in the Delegation Control, create the following policy:

  allow any-user TO use ons-topics IN compartment <your compartment> where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }

  <your compartment> is the compartment of the ONS topic specified in the Delegation Controls.

• Applicable to ExaDB-D and ExaDB-XS (when service provider other than Oracle Managed Software Updates is used)

  Delegate Access Control will access the Virtual Machines in your VM Cluster using SSH through Private Access. When you create the Delegation Control, an SSH key pair is generated and stored in OCI Vault in your tenancy. The SSH public key is then added to the VM Cluster.

  To allow Delegate Access Control to read the private IP addresses of the Virtual Machines in the VM Cluster to create the Private Endpoint, create the following policy:

  allow any-user TO {PRIVATE_IP_READ} IN compartment <your compartment> where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }

  <your compartment> is the compartment of the client subnet of the VM Cluster.

  To allow Delegate Access Control to create the Private Endpoints to the Virtual Machines in the Cloud VM Cluster, create the following policy:

  allow any-user to use virtual-network-family IN compartment <your compartment> where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }

  <your compartment> is the compartment of the client subnet of the VM Cluster.

  To allow Delegate Access Control to read the SSH key in your OCI Vault to access the Virtual Machines in the VM Cluster, create the following policy:

  allow any-user TO read secret-bundles IN compartment <your compartment> where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }

  <your compartment> is the compartment of the OCI Vault specified when creating the Delegation Control.

IAM Policies for Your Users

• Any service other than Oracle Managed Software Updates for Database Cloud Services
  Note
  
  

  To enable Oracle Managed Software Updates for a database in Oracle Database Services or to use Delegate Access Control, users must have the VM_CLUSTER_SUBSCRIBE_DB_SW_UPDATES permission. Delegate Access Control also requires this permission to manage Delegation Subscription and Delegation Control resources associated with Oracle Managed Software Updates.

  allow group <your group> to { VM_CLUSTER_SUBSCRIBE_DB_SW_UPDATES } in compartment <your compartment>

  <your compartment> is the compartment of the VM Clusters.

  If you subscribe to any service other than Oracle Managed Software Updates for Database Cloud Services, add the IAM polices below which will cover the Oracle Managed Software Updates for Database Cloud Services use case also. Otherwise, skip to the next section.

  All Delegate Access Control users should be given the following permissions by being a member of <your group>:

  allow group <your group> to read delegation-management-service-providers in tenancy

  allow group <your group> to read delegation-management-service-provider-actions in tenancy

  allow group <your group> to read delegation-management-work-requests in compartment <your compartment>

  <your compartment> is the compartment of the Delegate Access Control resources.

  The user who will create, update, and delete Delegation Subscriptions needs to have the following permissions by being a member of <your group>:

  allow group <your group> to manage delegation-subscriptions in tenancy

  Delegation Subscriptions are not bound to a specific compartment; instead, they are created and managed in the root compartment.

  The user who will create, update, and delete Delegation Controls needs to have the following permissions by being a member of <your group>:

  • To manage Delegate Access Control resources:

    allow group <your group> to manage delegation-controls in compartment <your compartment>

    <your compartment> is the compartment of the Delegation Controls.

  • To create and store the SSH key pair in OCI Vault to access the Virtual Machines in the ExaDB-D and ExaDB-XS VM Cluster:

    allow group <your group> to manage secret-family in compartment <your compartment>

    <your compartment> is the compartment of the OCI Vault specified in the Delegation Control.

  • To have USE permission for the ExaDB-C@C VM Cluster, ExaDB-D Cloud VM Cluster, and ExaDB-XS VM Cluster:

    allow group <your group> to USE database-family in compartment <your compartment>

    <your compartment> is the compartment of the ExaDB-C@C VM Cluster, ExaDB-D Cloud VM Cluster, or ExaDB-XS VM Cluster.

  • To have READ permission for the ONS topics used in the Delegation Control:

    allow group <your group> to READ ons-topics in compartment <your compartment>

    <your compartment> is the compartment of the ONS topics.

  The user who will approve, reject, revoke, and request more information about Delegated Resource Access Request needs to have the following permissions by being a member of <your group>:

  allow group <your group> to use delegated-resource-access-requests in compartment <your compartment>

  <your compartment> is the compartment of the Delegated Resource Access Requests, which is the same compartment as the associated Delegation Control.

• Oracle Managed Software Updates for Database Cloud Services

  If you subscribe to only Oracle Managed Software Updates for Database Cloud Services, add the IAM polices below. All Delegate Access Control users should be given the following permissions by being a member of <your group>:

  allow group <your group> to read delegation-management-service-providers in tenancy

  allow group <your group> to read delegation-management-service-provider-actions in tenancy

  allow group <your group> to read delegation-management-work-requests in compartment <your compartment>

  <your compartment> is the compartment of the Delegate Access Control resources.

  Delegation Subscriptions for Oracle Managed Software Updates for Database Cloud Services can be created, updated, or deleted only through Oracle Database Services when Oracle Managed Software Updates is enabled during database creation or update. The user only needs to have READ permission on Delegation Subscriptions by being a member of <your group>:

  allow group <your group> to read delegation-subscriptions in tenancy

  Delegation Control for Oracle Managed Software Updates for Database Cloud Services can be created, updated, or deleted only through Oracle Database Services when Oracle Managed Software Updates is enabled during database creation or update. The user only needs to have USE permission on Delegation Control by being a member of <your group> to allow the user to update the ONS Notification Topic ID in the Delegation Controls to receive notifications related to the Delegation Controls:

  allow group <your group> to use delegation-controls in compartment <your compartment>

  <your compartment> is the compartment of the Delegation Controls.

  If users want to receive notifications related to the Delegation Controls, remember to add the policy to allow dlgtmgmtdelegationcontrol resource principal to use ons-topics as shown above.

  The user who will approve, reject, revoke, and request more information about Delegated Resource Access Request needs to have the following permissions by being a member of <your group>:

  allow group <your group> to use delegated-resource-access-requests in compartment <your compartment>

  <your compartment> is the compartment of the Delegated Resource Access Requests, which is the same compartment as the associated Delegation Control.

When service provider other than Oracle Managed Software Updates for Database Cloud Services is subscribed

• Oracle Exadata Database Service on Cloud@Customer (ExaDB-C@C)
  • Customer Setup Checklist
    • Allow network traffic on port 443 between https://dactlhe.exacc.$LONGREGIONNAME.oci.$TOPLEVELDOMAIN and the ExaDB-C@C infrastructure in your firewall or gateway, to enable Secure Tunnel Service for remote Oracle operator access.
    • Add network security rules to allow SSH access to, and within, the VM Cluster client subnet in your firewall.
    • Add network security rules to allow the Control Plane Servers (CPS) to connect to required OCI services from the Control Plane network in your firewall. In particular, OCI Object Storage service is required by Delegate Access Control.
    • Add network route rules to allow the Control Plane Servers (CPS) to reach required OCI services from the Control Plane network in your router. In particular, OCI Object Storage service is required by Delegate Access Control.
    • Add the required IAM policies for Delegate Access Control.
    • Create an OCI Notifications (ONS) topic and subscribe to it. Select this ONS topic when creating the Delegation Control to receive related notifications.
  • Sample IAM Policies

    In this example:

    • ExaDB-C@C VM Clusters and databases are deployed in a child compartment called ExaDB under the Prod compartment.
    • OCI Notifications topics are deployed in a child compartment called Notification under the Prod compartment
    • Exadata Database administrators are in the OCI IAM user group ExaDB_Admin.

    allow any-user TO inspect database-family in compartment Prod:ExaDB where all { request.principal.type='dlgtmgmtdelegationcontrol' }
    allow any-user TO use ons-topics in compartment Prod:Notification where all { request.principal.type='dlgtmgmtdelegationcontrol' }
    
    allow group ExaDB_Admin to read delegation-management-service-providers in tenancy
    allow group ExaDB_Admin to read delegation-management-service-provider-actions in tenancy
    allow group ExaDB_Admin to manage delegation-subscriptions in tenancy
    
    allow group ExaDB_Admin to read delegation-management-work-requests in compartment Prod:ExaDB
    
    allow group ExaDB_Admin to manage delegation-controls in compartment Prod:ExaDB
    allow group ExaDB_Admin to use database-family in compartment Prod:ExaDB
    allow group ExaDB_Admin to use delegated-resource-access-requests in compartment Prod:ExaDB

• Oracle Exadata Database Service on Dedicated Infrastructure (ExaDB-D) and Oracle Exadata Database Service on Exascale Infrastructure (ExaDB-XS)
  • Customer Setup Checklist
    • Add network security rules, NSG, and ZPR policy (if applicable) to allow SSH access to, and within, the VM Cluster client subnet.
    • Add network security rules (security lists or NSGs) and ZPR policies (if applicable) to allow the VM Cluster to access required OCI services from the VM Cluster client subnet through the OCI Service Gateway. Delegate Access Control requires access to OCI Object Storage.
    • Add network route rule in the route table of the client subnet of the VM Cluster for the OCI Service Gateway (All <region> Services in Oracle Services Network).
    • Add the required IAM policies for Delegate Access Control.
    • Create an OCI Notifications (ONS) topic and subscribe to it. Select this ONS topic when creating the Delegation Control to receive related notifications.
    • Create an OCI Vault and Master Encryption Key to store the SSH keys used by Delegate Access Control to access the VM Clusters.
  • Sample IAM Policies

    In this example:

    • VM Clusters and databases are deployed in a child compartment called ExaDB under the Prod compartment.
    • OCI Notifications topics are deployed in a child compartment called Notification under the Prod compartment
    • The VCN and subnets of the VM Clusters are in a child compartment called Network under the Prod compartment
    • The OCI Vault and secrets are in a child compartment called Secret under the Prod compartment
    • Exadata Database administrators are in the OCI IAM user group ExaDB_Admin

    allow any-user TO inspect database-family in compartment Prod:ExaDB where all { request.principal.type='dlgtmgmtdelegationcontrol' }
    allow any-user TO use ons-topics in compartment Prod:Notification where all { request.principal.type='dlgtmgmtdelegationcontrol' }
    allow any-user TO {PRIVATE_IP_READ} IN compartment Prod:Network where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }
    allow any-user to use virtual-network-family IN compartment Prod:Network where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }
    allow any-user TO read secret-bundles IN compartment Prod:Secret where ALL { request.principal.type='dlgtmgmtdelegationcontrol' }
    
    allow group ExaDB_Admin to read delegation-management-service-providers in tenancy
    allow group ExaDB_Admin to read delegation-management-service-provider-actions in tenancy
    allow group ExaDB_Admin to manage delegation-subscriptions in tenancy
    
    allow group ExaDB_Admin to read delegation-management-work-requests in compartment Prod:ExaDB
    
    allow group ExaDB_Admin to manage delegation-controls in compartment Prod:ExaDB
    allow group ExaDB_Admin to use database-family in compartment Prod:ExaDB
    allow group ExaDB_Admin to use delegated-resource-access-requests in compartment Prod:ExaDB
    
    allow group ExaDB_Admin to manage secret-family in compartment Prod:Secret

When only Oracle Managed Software Updates for Database Cloud Services is subscribed

• Oracle Exadata Database Service on Exascale Infrastructure (ExaDB-XS)
  • Customer Setup Checklist
    • Add network security rules, NSG, and ZPR policy (if applicable) to allow SSH access to, and within, the VM Cluster client subnet.
    • Add network security rules (security lists or NSGs) and ZPR policies (if applicable) to allow the VM Cluster to access required OCI services from the VM Cluster client subnet through the OCI Service Gateway. Delegate Access Control requires access to OCI Object Storage.
    • Add network route rule in the route table of the client subnet of the VM Cluster for the OCI Service Gateway (All <region> Services in Oracle Services Network).
    • Add the required IAM policies for Delegate Access Control.
    • Create an OCI Notifications (ONS) topic and add a subscription. Then, update the Delegation Control created by Database Cloud Service for Managed Software Updates to use this ONS topic to receive Delegation Control–related notifications.
  • Sample IAM Policies

    In this example:

    • VM Clusters and databases are deployed in a child compartment called ExaDB under the Prod compartment.
    • OCI Notifications topics are deployed in a child compartment called Notification under the Prod compartment
    • Exadata Database administrators are in the OCI IAM user group ExaDB_Admin
    • To enable Oracle Managed Software Updates for a database in Oracle Database Services or to use Delegate Access Control, users must have the VM_CLUSTER_SUBSCRIBE_DB_SW_UPDATES permission. Delegate Access Control also requires this permission to manage Delegation Subscription and Delegation Control resources associated with Oracle Managed Software Updates.
    • The policy to allow dlgtmgmtdelegationcontrol resource principal to use ons-topics is optional. It is required when users update the ONS Notification Topic ID in the Delegation Controls to receive notifications related to the Delegation Controls.

    allow any-user TO use ons-topics in compartment Prod:Notification where all { request.principal.type='dlgtmgmtdelegationcontrol' } (OPTIONAL)
    
    allow group ExaDB_Admin to { VM_CLUSTER_SUBSCRIBE_DB_SW_UPDATES } in compartment Prod:ExaDB
    
    allow group ExaDB_Admin to read delegation-management-service-providers in tenancy
    allow group ExaDB_Admin to read delegation-management-service-provider-actions in tenancy
    allow group ExaDB_Admin to read delegation-subscriptions in tenancy
    
    allow group ExaDB_Admin to read delegation-management-work-requests in compartment Prod:ExaDB
    
    allow group ExaDB_Admin to use delegation-controls in compartment Prod:ExaDB
    allow group ExaDB_Admin to use delegated-resource-access-requests in compartment Prod:ExaDB