Device Data FHIR Service Policies and Permissions

Policy Overview

Permissions are managed through OCI IAM policies. If you are new to policies, see How IAM Policies Work, Getting Started with Policies, and Policy Reference.

OCI IAM policies can authorize users to manage DDFS control-plane resources and can authorize a DDFS instance resource principal to access a required OCI resource, such as a Vault secret. They do not authorize protected FHIR data-plane requests. Protected FHIR resource and operation requests require OCI Identity Domains OAuth access tokens with DDFS OAuth scopes.

User Policies

These policies define who can access DDFS resources and what actions they can perform. You must have the appropriate permissions in a policy to create, update, or manage DDFS resources whether you use the Console, REST API, SDK, CLI, or another interface.

The policy must explicitly grant access to the DDFS resources you intend to work with. If you encounter an unauthorized or permission denied message, contact your administrator to verify your permissions and the compartments available to you.

By default, only members of the Administrators group have full access to DDFS resources. Other users need custom policies that grant the required rights for their roles.

Example Policy Statements

Example policy statements for DDFS resource types and permissions:

Allows a group to manage all DDFS instances and work requests in a specific compartment.

allow group <group-name> to manage ddfs-instance-family in compartment <compartment-name>

Allows a group to manage DDFS instances in a specific compartment.

allow group <group-name> to manage ddfs-instance in compartment <compartment-name>

Allows a group to manage DDFS work requests in a specific compartment.

allow group <group-name> to manage ddfs-work-request in compartment <compartment-name>

Allows a group to list DDFS instances in a specific compartment.

allow group <group-name> to inspect ddfs-instance in compartment <compartment-name>

Allows a group to update DDFS instances in a specific compartment.

allow group <group-name> to use ddfs-instance in compartment <compartment-name>

Allows a group to list and get DDFS instances in a specific compartment.

allow group <group-name> to read ddfs-instance in compartment <compartment-name>

Allows a group to create a DDFS instance in a specific compartment.

allow group <group-name> to {DDFS_INSTANCE_CREATE} in compartment <compartment-name>

Allows a group to create, update, move, and delete DDFS instances in a specific compartment.

allow group <group-name> to {DDFS_INSTANCE_CREATE,DDFS_INSTANCE_UPDATE,DDFS_INSTANCE_MOVE,DDFS_INSTANCE_DELETE} in compartment <compartment-name>

Allows a group to move DDFS instances from a source compartment to a destination compartment in the same tenancy. DDFS checks DDFS_INSTANCE_MOVE in both compartments.

allow group <group-name> to {DDFS_INSTANCE_MOVE} in compartment <source-compartment-name>
allow group <group-name> to {DDFS_INSTANCE_MOVE} in compartment <destination-compartment-name>

These statements grant only the listed instance permissions. They do not grant inspect or read permissions, and they do not grant access to work requests. Grant those permissions separately when users must list or get instances or monitor operations.

Grant DDFS Access to a Subscription Authorization Secret

This customer-managed OCI IAM policy grants one DDFS instance resource principal permission to read one OCI Vault secret for REST-hook notification authorization. It does not grant a user or client application permission to create or manage FHIR Subscription resources.

Scope the policy statement to the compartment that contains the secret. This compartment can differ from the compartment that contains the DDFS instance. Use a separate statement for each secret that the instance must read.

Allow any-user to {SECRET_BUNDLE_READ} in compartment <secret-compartment>
where all {request.principal.id = '<ddfs-instance-ocid>', request.principal.type = 'ddfsinstance', target.secret.id = '<secret-ocid>'}

The any-user subject is restricted by the where all conditions to the specified DDFS instance principal and secret.

For the extension definition and example, see FHIR R6 Subscription OCI Vault Secret Extension. For the complete notification sequence, see FHIR R6 Subscription Workflow.

Resource Types

DDFS provides both aggregate and individual resource types for writing policies.

Aggregate resource types let you create fewer, broader policies. For example, instead of writing separate policies to allow a group to manage DDFS instances and work requests, you can write a single policy that grants access to the aggregate resource type ddfs-instance-family.

Aggregate Resource Types

• ddfs-instance-family: Includes the permissions for ddfs-instance and ddfs-work-request.

Individual Resource Types

Use the individual resource-type policies to allow users to work with specific DDFS resources.

• ddfs-instance
• ddfs-work-request

Supported Variables

To add conditions to your policies, use OCI general variables.

DDFS supports the General Variables for All Requests for use with resources.

DDFS doesn't define service-specific variables.

Details for Verb + Resource-Type Combinations

OCI policy syntax follows this pattern:

allow <subject> to <verb> <resource-type> in <location> [where <conditions>]

The following sections describe the permissions and API operations covered by each verb for DDFS. The level of access is cumulative as you go from inspect to read to use to manage.

ddfs-instance-family

Let the specified group manage all DDFS instance and work request resources in the specified compartment.

allow group <group-name> to manage ddfs-instance-family in compartment <compartment-name>

This aggregate resource type includes the following member resource types:

• ddfs-instance
• ddfs-work-request

The permissions granted by ddfs-instance-family are cumulative across those member resource types.

ddfs-instance

Let the specified group manage all DDFS instance resources in the specified compartment.

allow group <group-name> to manage ddfs-instance in compartment <compartment-name>

ddfs-work-request

Let the specified group manage all DDFS work request resources in the specified compartment.

allow group <group-name> to manage ddfs-work-request in compartment <compartment-name>

Permissions Required for Each Control Plane API Operation

The following table lists the Device Data FHIR Service control plane API operations in alphabetical order.

For more information about OCI permissions, see Permissions.