5 Service Limits, Quotas, Policies, and Events
This section describes Oracle Content Management service limits, quotas, policies, and events.
Service Limits
Oracle Content Management has various default limits. Whenever you create an Oracle Content Management instance, the system ensures that your request is within the bounds of your limit.
If necessary, you can submit a request to increase your limits in the Oracle Cloud Console from the Limits, Quotas, and Usage page. See About Service Limits and Usage.
This table lists the default service limits for Oracle Content Management.
Resource Limit | Limit Short Names | Default Value | Description |
---|---|---|---|
Oracle Content Management Service Max | max-services-count-per-tenant | 100 | Maximum number of Oracle Content Management instances you can create per tenant. |
Service Quotas
You can use quotas to determine how other users allocate Oracle Content Management resources across compartments in Oracle Cloud Infrastructure. Whenever you create an Oracle Content Management instance, the system ensures that your request is within the bounds of the quota for that compartment.
You can manage the service quotas in the Oracle Cloud Console from the compartment detail page. See About Compartment Quotas.
This table lists the service quotas for Oracle Content Management.
Quota Name | Scope | Description |
---|---|---|
oce-instance-count | Regional | Number of Oracle Content Management instances |
Example Quota Statements for Oracle Content Management
- Limit the number of Oracle Content Management instances that users can create in MyCompartment to 10.
Set oce quota oce-instance-count to 10 in compartment MyCompartment
Service Policies
You use authorization policies to control access to resources in your tenancy. For example, you can create a policy that authorizes users to create and manage Oracle Content Management instances.
You create policies using the Oracle Cloud Console. See Managing Policies.
The following information pertains to service policies for Oracle Content Management:
Resource Types for Oracle Content Management
This table lists the resource types for Oracle Content Management.
Resource Type | Description |
---|---|
oce-instance | A single Oracle Content Management instance. |
oce-instances | One or more Oracle Content Management instances. |
oce-workrequest | A single work request for Oracle Content Management.
Each operation you perform on an Oracle Content Management instance, creates a work request. For example, operations such as create, update, terminate, and so on. |
oce-workrequests | One or more work requests for Oracle Content Management. |
Supported Variables
The values of these variables are supplied by Oracle Content Management. In addition, other general variables are supported. See General Variables for All Requests.
This table lists the supported variables for Oracle Content Management.
Variable | Type | Description | Sample Value |
---|---|---|---|
target.compartment.id | entity | The OCID of the primary resource for the request. | target.compartment.id = 'ocid1.compartment.oc1..<unique_ID>' |
request.operation | string | The operation id (for example, 'GetUser') for the request. | request.operation = 'ocid1.compartment.oc1..<unique_ID>' |
target.resource.kind | string | The resource kind name of the primary resource for the request. | target.resource.kind = 'ocid1.contentexperiencecloudservice.oc1..<unique_ID>' |
Details for Verb and Resource-Type Combinations
Oracle Cloud Infrastructure offers a standard set of verbs to define permissions across Oracle Cloud Infrastructure resources (Inspect, Read, Use, Manage). These tables list the Oracle Content Management permissions associated with each verb. The level of access is cumulative as you go from Inspect to Read to Use to Manage.
INSPECT
Resource Type | INSPECT Permissions |
---|---|
|
|
|
|
|
|
READ
Resource Type | READ Permissions |
---|---|
|
|
|
|
|
|
USE
Resource Type | USE Permissions |
---|---|
|
|
|
|
|
|
MANAGE
Resource Type | MANAGE Permissions |
---|---|
|
|
|
|
|
|
Permissions Required for Each API Operation
This table shows the API operations available for Oracle Content Management, grouped by resource type.
REST API Operation | CLI Command Operation | Permission Required to Use the Operation |
---|---|---|
ListOceInstances | oce-instance list | OCE_INSTANCE_INSPECT |
GetOceInstance | oce-instance get | OCE_INSTANCE_READ |
CreateOceInstance | oce-instance create | OCE_INSTANCE_CREATE |
DeleteOceInstance | oce-instance delete | OCE_INSTANCE_DELETE |
UpdateOceInstance | oce-instance update | OCE_INSTANCE_UPDATE |
ChangeOceInstanceCompartment | oce-instance change-compartment | OCE_INSTANCE_UPDATE |
ListWorkRequests | work-request list | OCE_INSTANCE_WORKREQUEST_INSPECT |
GetWorkRequest | work-request get | OCE_INSTANCE_WORKREQUEST_READ |
ListWorkRequestErrors | work-request-error list | OCE_INSTANCE_WORKREQUEST_INSPECT |
ListWorkRequestLogs | work-request-log list | OCE_INSTANCE_WORKREQUEST_INSPECT |
Example Policy Statements to Manage Oracle Content Management Instances
Here are typical policy statements that you might use to authorize access to Oracle Content Management instances.
When you create a policy for your tenancy, you grant users access to all compartments by way of policy inheritance. Alternatively, you can restrict access to individual Oracle Content Management instances or compartments.
Let users in the Administrators group fully manage any Oracle Content Management instance
# Full admin permissions (CRUD)
allow group Administrators to manage oce-instances in tenancy
allow group Administrators to manage oce-workrequests in tenancy
# Full admin permissions (CRUD) using family
allow group Administrators to manage oce-instance-family in tenancy
Let users in the group1 group inspect any Oracle Content Management instance and their associated work requests
# Inspect permissions (list oce instances and work requests) using metaverbs:
allow group group1 to inspect oce-instances in tenancy
allow group group1 to inspect oce-workrequests in tenancy
# Inspect permissions (list oce instances and work requests) using permission names:
allow group group1 to {OCE_INSTANCE_INSPECT} in tenancy
allow group group1 to {OCE_INSTANCE_WORKREQUEST_INSPECT} in tenancy
Let users in the group2 group read details about any Oracle Content Management instance and their associated work requests
# Read permissions (read complete oce instance and work request metadata) using metaverbs:
allow group group2 to read oce-instances in tenancy
allow group group2 to read oce-workrequests in tenancy
# Read permissions (read complete oce instance and work request metadata) using permission names:
allow group group2 to {OCE_INSTANCE_INSPECT, OCE_INSTANCE_READ} in tenancy
allow group group2 to {OCE_INSTANCE_WORKREQUEST_INSPECT, OCE_INSTANCE_WORKREQUEST_READ} in tenancy
Let users in the group3 group read all Oracle Content Management instances and read their associated work requests
# Use permissions (read on oce instance, read on work request) using metaverbs:
allow group group3 to use oce-instances in tenancy
allow group group3 to read oce-workrequests in tenancy
# Use permissions (read on oce instance, read on work request) using permission names:
allow group group3 to {OCE_INSTANCE_INSPECT, OCE_INSTANCE_READ, OCE_INSTANCE_UPDATE} in tenancy
allow group group3 to {OCE_INSTANCE_WORKREQUEST_INSPECT, OCE_INSTANCE_WORKREQUEST_READ} in tenancy
Let users in the group4 group manage any Oracle Content Management instance and their associated work requests
# Manage permissions (use/delete on oce instance, read/cancel on work request) using metaverbs:
allow group group4 to manage oce-instances in tenancy
allow group group4 to manage oce-workrequests in tenancy
# Manage permissions (use/delete on oce instance, read/cancel on work request) using permission names:
allow group group4 to {OCE_INSTANCE_INSPECT, OCE_INSTANCE_READ, OCE_INSTANCE_UPDATE,OCE_INSTANCE_CREATE, OCE_INSTANCE_DELETE} in tenancy
allow group group4 to {OCE_INSTANCE_WORKREQUEST_INSPECT, OCE_INSTANCE_WORKREQUEST_READ} in tenancy
Service Events
Actions that you perform on Oracle Content Management instances emit events. You can use the Oracle Cloud Console to define rules that trigger a specific action when an event occurs. For example, you might define a rule that sends a notification to administrators when someone deletes an instance. See Overview of Events and Get Started with Events.
This table lists the Oracle Content Management events that you can reference.
Event Name | Event Type |
---|---|
GetOceInstance | com.oraclecloud.oce.GetOceInstance |
ListOceInstances | com.oraclecloud.oce.ListOceInstances |
ChangeOceInstanceCompartment (begin) | com.oraclecloud.oce.ChangeOceInstanceCompartment.begin |
ChangeOceInstanceCompartment (end) | com.oraclecloud.oce.ChangeOceInstanceCompartment.end |
CreateOceInstance (begin) | com.oraclecloud.oce.CreateOceInstance.begin |
CreateOceInstance (end) | com.oraclecloud.oce.CreateOceInstance.end |
DeleteOceInstance (begin) | com.oraclecloud.oce.DeleteOceInstance.begin |
DeleteOceInstance (end) | com.oraclecloud.oce.DeleteOceInstance.end |
UpdateOceInstance (begin) | com.oraclecloud.oce.UpdateOceInstance.begin |
UpdateOceInstance (end) | com.oraclecloud.oce.UpdateOceInstance.end |
Example
This example shows information associated with the event CreateOceInstance (begin):
{
"eventType": "com.oraclecloud.oce.CreateOceInstance.begin",
"cloudEventsVersion": "0.1",
"eventTypeVersion": "2.0",
"source": "oce",
"eventId": "<unique_ID>",
"eventTime": "2019-10-10T04:33:06.133Z",
"contentType": "application/json",
"data": {
"eventGroupingId": "ocid1.coreservicesworkrequest.oc1..<unique_ID>",
"eventName": "CreateOceInstance",
"compartmentId": "ocid1.compartment.oc1..<unique_ID>",
"compartmentName": "my_compartment",
"resourceName": "my_oce",
"resourceId": "ocid1.contentexperiencecloudservice.oc1..<unique_ID>",
"availabilityDomain": "<availability_domain>",
"freeformTags": null,
"definedTags": null,
"identity": {
"principalName": "admin",
"principalId": "ocid1.user.oc1..<unique_ID>",
"authType": "natv",
"callerName": null,
"callerId": null,
"tenantId": "ocid1.tenancy.oc1..<unique_ID>",
"ipAddress": "<ip_address>",
"credentials": "ocid1.tenancy.oc1..<unique_ID>/ocid1.user.oc1..<unique_ID>",
"userAgent": null,
"consoleSessionId": null
},
...