Oracle Cloud Infrastructure Documentation

OS Management Policy Reference

This topic provides policy reference information for the OS Management service.

Note

For example OS Management policies, see Setting Up Policies for OS Management.

Details for the OS Management Service

This topic covers details for writing policies to control access to OS Management.

About Permissions for Managed Instances

Because a managed instance is a Compute instance that is actively being managed by the OS Management service, all operations that are performed on managed instances require that users have read permission on the underlying Compute instance. A managed instance, moreover, does not have a separate Oracle Cloud ID (OCID). To determine which Compute instances are available to users, calls are made to the Compute service to retrieve the instance information. If you do not have read access to the Compute instance details, then you are not able to manage that Compute instance with the OS Management service.

About Permissions for Software Sources

The default set of software sources is created in the root compartment. To read those software sources, users must be granted read permissions.

The permissions on software sources in the root compartment should be restricted to prevent users from accidentally deleting or removing these packages. These packages are intended to be used as is or as the basis for creating customized software sources, but should not be modified directly.

When creating a software source, it can only be populated with packages from existing software sources that the user has permissions to access. To restrict the packages that can be used, you can create a custom software source in a different compartment (or with a policy granting different permissions). You can then populate the custom software source with only the packages that you want users to be able to use.

Compartment Considerations

You can set up the OS Management service to manage all instances in your tenancy by setting the policies at the root compartment level. Setting policies at the root compartment level is the simplest way to create OS Management service policies but depends on whether you have the required privileges to create the policy. If you do not have required privileges, you should work with the administrator for your tenancy.

Alternatively, you can set up the OS Management service to manage only a subset of your instances by setting the policies at the compartment level. Setting the policies at the compartment level allows the service to manage only a subset of your instances at the level of compartment and its subcompartments.

All the base software sources are in the root compartment. When setting policies, ensure that the permissions for the policy are not too narrow. For example, you would run into authorization errors if you were only granted access to a compartment and you tried installing packages or updates from software sources in the root compartment.

For example: 

 ALLOW dynamic-group <dynamic_group_name> to manage osms-family in compartment <compartment_name>

To ensure that the user has proper access, the user must be granted OSMS_SOFTWARE_SOURCE_READ permissions in the root compartment.

Resources

Aggregate Resource-Type

  • osms-family

Individual Resource Types

  • osms-managed-instances

  • osms-managed-instance-groups

  • osms-software-sources

  • osms-errata

  • osms-scheduled-jobs

  • osms-work-requests

Details for Verb and Resource-Type Combinations

Oracle Cloud Infrastructure offers a standard set of verbs to define permissions across Oracle Cloud Infrastructure resources (Inspect, Read, Use, Manage). These tables list the OS Management service permissions associated with each verb. The level of access is cumulative as you go from Inspect to Read to Use to Manage.

INSPECT

Resource- Type INSPECT Permission

  • osms-managed-instances

  • OSMS_MANAGED_INSTANCE_INSPECT

  • osms-managed-instance-groups

  • OSMS_MANAGED_INSTANCE_GROUP_INSPECT

  • osms-software-sources

  • OSMS_SOFTWARE_SOURCE_INSPECT

  • osms-errata

  • OSMS_ERRATA_INSPECT

  • osms-scheduled-jobs

  • OSMS_SCHEDULED_JOB_INSPECT

  • osms-work-requests

  • OSMS_WORK_REQUEST_INSPECT

READ

Resource- Type READ Permission

  • osms-managed-instances

  • OSMS_MANAGED_INSTANCE_READ

  • osms-managed-instance-groups

  • OSMS_MANAGED_INSTANCE_GROUP_READ

  • osms-software-sources

  • OSMS_SOFTWARE_SOURCE_READ

  • osms-errata

  • OSMS_ERRATA_READ

  • osms-scheduled-jobs

  • OSMS_SCHEDULED_JOB_READ

  • osms-work-requests

  • OSMS_WORK_REQUEST_READ

USE

Resource- Type USE Permission

  • osms-managed-instances

  • OSMS_MANANGED_INSTANCE_ACCESS

  • osms-managed-instance-groups

  • OSMS_MANAGED_INSTANCE_GROUP_INSTALL_UPDATE

  • OSMS_MANAGED_INSTANCE_GROUP_INSTALL_PACKAGE

  • OSMS_MANAGED_INSTANCE_GROUP_REMOVE_PACKAGE

  • OSMS_MANAGED_INSTANCE_GROUP_UPDATE

  • osms-software-sources

  • OSMS_SOFTWARE_SOURCE_UPDATE

  • osms-errata

  • N/A

  • osms-scheduled-jobs

  • OSMS_SCHEDULED_JOB_UPDATE

  • osms-work-requests

  • N/A

MANAGE

Resource- Type MANAGE Permission

  • osms-managed-instances

  • OSMS_MANAGED_INSTANCE_UPDATE

  • OSMS_MANAGED_INSTANCE_INSTALL_UPDATE

  • OSMS_MANAGED_INSTANCE_INSTALL_PACKAGE

  • OSMS_MANAGED_INSTANCE_REMOVE_PACKAGE

  • OSMS_MANAGED_INSTANCE_ADD_SOFTWARE_SOURCE

  • OSMS_MANAGED_INSTANCE_REMOVE_SOFTWARE_SOURCE

  • osms-managed-instance-groups

  • OSMS_MANAGED_INSTANCE_GROUP_ADD_INSTANCE

  • OSMS_MANAGED_INSTANCE_GROUP_REMOVE_INSTANCE

  • OSMS_MANAGED_INSTANCE_GROUP_CREATE

  • OSMS_MANAGED_INSTANCE_GROUP_DELETE

  • OSMS_MANAGED_INSTANCE_GROUP_MOVE

  • OSMS_MANAGED_INSTANCE_GROUP_ADD_SOFTWARE_SOURCE

  • OSMS_MANAGED_INSTANCE_GROUP_REMOVE_SOFTWARE_SOURCE

  • osms-software-sources

  • OSMS_SOFTWARE_SOURCE_CREATE

  • OSMS_SOFTWARE_SOURCE_DELETE

  • OSMS_SOFTWARE_SOURCE_MOVE

  • OSMS_SOFTWARE_SOURCE_ADD_PACKAGES

  • OSMS_SOFTWARE_SOURCE_REMOVE_PACKAGES

  • osms-errata

  • N/A

  • osms-scheduled-jobs

  • OSMS_SCHEDULED_JOB_CREATE

  • OSMS_SCHEDULED_JOB_DELETE

  • OSMS_SCHEDULED_JOB_MOVE

  • osms-work-requests

  • OSMS_WORK_REQUEST_CANCEL

Permissions Required for Each API Operation

The following table lists the API operations in a logical order, grouped by resource type. For information about permissions, see Permissions.

API Operation Permissions Required to Use the Operation
ListManagedInstances OSMS_MANAGED_INSTANCE_INSPECT
GetManagedInstance OSMS_MANAGED_INSTANCE_READ
ListPackagesInstalledOnManagedInstance OSMS_MANAGED_INSTANCE_READ
ListAvailablePackagesForManagedInstance OSMS_MANAGED_INSTANCE_READ
ListAvailableUpdatesForManagedInstance OSMS_MANAGED_INSTANCE_READ
ListAvailableSoftwareSourcesForManagedInstance OSMS_MANAGED_INSTANCE_READ and OSMS_SOFTWARE_SOURCE_INSPECT
InstallPackageOnManagedInstance OSMS_MANAGED_INSTANCE_INSTALL_PACKAGE and OSMS_SOFTWARE_SOURCE_READ
RemovePackageFromManagedInstance OSMS_MANAGED_INSTANCE_REMOVE_PACKAGE
InstallPackageUpdateOnManagedInstance OSMS_MANAGED_INSTANCE_INSTALL_UPDATE and OSMS_SOFTWARE_SOURCE_READ
AttachParentSoftwareSourceToManagedInstance OSMS_MANAGED_INSTANCE_ADD_SOFTWARE_SOURCE and OSMS_SOFTWARE_SOURCE_READ
AttachChildSoftwareSourceToManagedInstance OSMS_MANAGED_INSTANCE_ADD_SOFTWARE_SOURCE and OSMS_SOFTWARE_SOURCE_READ
DetachParentSoftwareSourceFromManagedInstance OSMS_MANAGED_INSTANCE_REMOVE_SOFTWARE_SOURCE
DetachChildSoftwareSourceFromManagedInstance OSMS_MANAGED_INSTANCE_REMOVE_SOFTWARE_SOURCE
ListManagedInstanceGroups OSMS_MANAGED_INSTANCE_GROUP_INSPECT
GetManagedInstanceGroup OSMS_MANAGED_INSTANCE_GROUP_READ
UpdateManagedInstanceGroup OSMS_MANAGED_INSTANCE_GROUP_UPDATE
CreateManagedInstanceGroup OSMS_MANAGED_INSTANCE_GROUP_CREATE
DeleteManagedInstanceGroup OSMS_MANAGED_INSTANCE_GROUP_DELETE
ChangeManagedInstanceGroupComparment OSMS_MANAGED_INSTANCE_GROUP_MOVE
AttachManagedInstanceToManagedInstanceGroup OSMS_MANAGED_INSTANCE_GROUP_ADD_INSTANCE and OSMS_MANAGED_INSTANCE_UPDATE
DetachManagedInstanceFromManagedInstanceGroup OSMS_MANAGED_INSTANCE_GROUP_REMOVE_INSTANCE and OSMS_MANAGED_INSTANCE_UPDATE
ListSoftwareSources OSMS_SOFTWARE_SOURCE_INSPECT
GetSoftwareSource OSMS_SOFTWARE_SOURCE_READ
UpdateSoftwareSource OSMS_SOFTWARE_SOURCE_UPDATE
CreateSoftwareSource OSMS_SOFTWARE_SOURCE_CREATE
DeleteSoftwareSource OSMS_SOFTWARE_SOURCE_DELETE
ChangeSoftwareSourceCompartment OSMS_SOFTWARE_SOURCE_MOVE
AddPackagesToSoftwareSource OSMS_SOFTWARE_SOURCE_ADD_PACKAGES
RemovePackagesFromSoftwareSource OSMS_SOFTWARE_SOURCE_REMOVE_PACKAGES
ListSoftwarePackages OSMS_SOFTWARE_SOURCE_READ
GetSoftwarePackage OSMS_SOFTWARE_SOURCE_READ
SearchSoftwarePackages OSMS_SOFTWARE_SOURCE_READ
ChangeSoftwareSourceComparment OSMS_SOFTWARE_SOURCE_MOVE
ListScheduledJobs OSMS_SCHEDULED_JOB_INSPECT
GetScheduledJob OSMS_SCHEDULED_JOB_READ
UpdateScheduledJob OSMS_SCHEDULED_JOB_UPDATE
CreateScheduledJob

OSMS_SCHEDULED_JOB_CREATE and one or more of the following permissions:

  • OSMS_MANAGED_INSTANCE_GROUP_INSTALL_PACKAGE and OSMS_SOFTWARE_SOURCE_READ

  • OSMS_MANAGED_INSTANCE_GROUP_INSTALL_UPDATE and OSMS_SOFTWARE_SOURCE_READ

  • OSMS_MANAGED_INSTANCE_GROUP_REMOVE_PACKAGE

  • OSMS_MANAGED_INSTANCE_INSTALL_PACKAGE and OSMS_SOFTWARE_SOURCE_READ

  • OSMS_MANAGED_INSTANCE_INSTALL_UPDATE and OSMS_SOFTWARE_SOURCE_READ

  • OSMS_MANAGED_INSTANCE_REMOVE_PACKAGE

DeleteScheduledJob OSMS_SCHEDULED_JOB_DELETE
ChangeScheduledJobCompartment OSMS_SCHEDULED_JOB_MOVE
ListWorkRequests OSMS_WORK_REQUEST_INSPECT
GetWorkRequest OSMS_WORK_REQUEST_READ
CancelWorkRequest OSMS_WORK_REQUEST_CANCEL