Policy Details for Resources
This topic provides the details for writing OCI Identity and Access Management (IAM) policies to control access to Oracle Base Database Cloud@Customer and Oracle Data Infrastructure Cloud@Customer resources.
Only the general variables are supported. For more information, see General Variables for All Requests in Policy Reference.
Resource-Type
A resource-type represents a specific kind of resource that can be accessed or managed through IAM policies. Some resource-types are aggregate resource-types, which group multiple related resource-types under a single policy construct.
Using aggregate resource-types simplifies policy management by allowing you to grant permissions for multiple related resources with a single policy statement instead of creating separate policies for each individual resource-type.
For example, granting access to the datacc-family resource-type is equivalent to granting access to related resource-types such as datacc-infrastructures, datacc-vmcluster-networks, datacc-vminstances, datacc-workrequests, and all resource-types within the family.
Aggregate Resource-Types
datacc-familydatabase-family
Individual Resource-Types
These resource-types can be used individually or as part of aggregate resource-types when defining IAM policies.
The following resources belong to the datacc-family.
datacc-infrastructuresdatacc-vmcluster-networksdatacc-vminstancesdatacc-workrequests
Details for Verb + Resource-Type Combinations
The following tables show the permissions and API operations covered by each verb. The level of access is cumulative as you progress from inspect > read > use > manage.
A plus sign (+) in a table cell indicates incremental access compared to the verb directly preceding it, while no extra indicates that the verb does not provide additional permissions or API operations beyond the previous level.
For example, for the datacc-infrastructures resource-type, the read verb provides no additional permissions or API operations beyond those included with the inspect verb. The use and manage verbs, however, grant additional permissions and include access to additional API operations.
datacc-family
| Verb | Permission |
|---|---|
| INSPECT | DATACC_INFRASTRUCTURE_INSPECTDATACC_VMCLUSTER_NETWORK_INSPECTDATACC_VMINSTANCE_INSPECTDATACC_WR_INSPECT |
| READ | inspect + DATACC_INFRASTRUCTURE_READDATACC_VMCLUSTER_NETWORK_READDATACC_VMINSTANCE_READDATACC_WR_READ |
| USE | read + DATACC_INFRASTRUCTURE_UPDATEDATACC_INFRASTRUCTURE_USEDATACC_VMCLUSTER_NETWORK_UPDATEDATACC_VMCLUSTER_NETWORK_USEDATACC_VMINSTANCE_UPDATE |
| MANAGE | use + DATACC_INFRASTRUCTURE_CREATEDATACC_INFRASTRUCTURE_DELETEDATACC_INFRASTRUCTURE_MOVEDATACC_VMCLUSTER_NETWORK_CREATEDATACC_VMCLUSTER_NETWORK_DELETEDATACC_VMCLUSTER_NETWORK_MOVEDATACC_VMINSTANCE_CREATEDATACC_VMINSTANCE_DELETEDATACC_VMINSTANCE_MOVEDATACC_WR_DELETE |
datacc-infrastructures
| Verb | Permission |
|---|---|
| INSPECT | DATACC_INFRASTRUCTURE_INSPECT |
| READ | inspect + DATACC_INFRASTRUCTURE_READ |
| USE | read + DATACC_INFRASTRUCTURE_UPDATEDATACC_INFRASTRUCTURE_USE |
| MANAGE | use + DATACC_INFRASTRUCTURE_CREATEDATACC_INFRASTRUCTURE_DELETEDATACC_INFRASTRUCTURE_MOVE |
datacc-vmcluster-networks
| Verb | Permission |
|---|---|
| INSPECT | DATACC_VMCLUSTER_NETWORK_INSPECT |
| READ | inspect + DATACC_VMCLUSTER_NETWORK_READ |
| USE | read + DATACC_VMCLUSTER_NETWORK_UPDATEDATACC_VMCLUSTER_NETWORK_USE |
| MANAGE | use + DATACC_VMCLUSTER_NETWORK_CREATEDATACC_VMCLUSTER_NETWORK_DELETEDATACC_VMCLUSTER_NETWORK_MOVE |
datacc-vminstances
| Verb | Permission |
|---|---|
| INSPECT | DATACC_VMINSTANCE_INSPECT |
| READ | inspect + DATACC_VMINSTANCE_READ |
| USE | read + DATACC_VMINSTANCE_UPDATE |
| MANAGE | use + DATACC_VMINSTANCE_CREATEDATACC_VMINSTANCE_DELETEDATACC_VMINSTANCE_MOVE |
datacc-workrequests
| Verb | Permission |
|---|---|
| INSPECT | DATACC_WR_INSPECT |
| READ | inspect + DATACC_WR_READ |
| USE | same as read |
Permissions Required for Each API Operation
The following tables list the API operations in a logical order, grouped by resource type.
datacc-infrastructures
| API operation | Permissions required |
|---|---|
| CreateBaseInfrastructure | DATACC_INFRASTRUCTURE_CREATE |
| GetBaseInfrastructure | DATACC_INFRASTRUCTURE_READ |
| UpdateBaseInfrastructure | DATACC_INFRASTRUCTURE_UPDATE |
| DeleteBaseInfrastructure | DATACC_INFRASTRUCTURE_DELETE |
| ActivateBaseInfrastructure | DATACC_INFRASTRUCTURE_UPDATE |
| ChangeInfrastructureCompartment | DATACC_INFRASTRUCTURE_MOVE |
| DownloadBaseInfrastructureConfigFile | DATACC_INFRASTRUCTURE_READ |
datacc-vmcluster-networks
| API operation | Permissions required |
|---|---|
| CreateBaseVmClusterNetwork | DATACC_VMCLUSTER_NETWORK_CREATE |
| ListBaseVmClusterNetworks | DATACC_VMCLUSTER_NETWORK_INSPECT |
| GetBaseVmClusterNetwork | DATACC_VMCLUSTER_NETWORK_READ |
| UpdateBaseVmClusterNetwork | DATACC_VMCLUSTER_NETWORK_UPDATE |
| ChangeBaseVmClusterNetworkCompartment | DATACC_VMCLUSTER_NETWORK_MOVE |
| DeleteBaseVmClusterNetwork | DATACC_VMCLUSTER_NETWORK_DELETE |
| GenerateRecommendedVmClusterNetwork | DATACC_VMCLUSTER_NETWORK_CREATE |
| ValidateRecommendedVmClusterNetwork | DATACC_VMCLUSTER_NETWORK_UPDATE |
datacc-vminstances
| API operation | Permissions required |
|---|---|
| CreateInstance | DATACC_VMINSTANCE_CREATE & DATACC_INFRASTRUCTURE_USE |
| ListInstances | DATACC_VMINSTANCE_INSPECT |
| GetInstance | DATACC_VMINSTANCE_READ |
| UpdateInstance | DATACC_VMINSTANCE_UPDATE |
| ChangeInstanceCompartment | DATACC_VMINSTANCE_MOVE |
| DeleteInstance | DATACC_VMINSTANCE_DELETE |
| StartInstance | DATACC_VMINSTANCE_UPDATE |
| StopInstance | DATACC_VMINSTANCE_UPDATE |
| RestartInstance | DATACC_VMINSTANCE_UPDATE |
datacc-workrequests
| API operation | Permissions required |
|---|---|
| ListWorkRequests | DATACC_WR_INSPECT |
| GetWorkRequest | DATACC_WR_READ |
| ListWorkRequestErrors | DATACC_WR_INSPECT |
| ListWorkRequestLogs | DATACC_WR_INSPECT |
For more information, see Overview of Policies.