Required policies

Following are the required set of policies for the Database Migration service. The tenancy administrator can easily provision these policies by using the templates available in the Policy Builder.

Note: This policy lets you perform all the actions for the Database Migration service such as creating connections, manage connections, and so on, depending on your usage.

Note: Oracle recommends using the first group of policies To let users manage connections, assessments, migrations, jobs, and networks as it has the required policies to go end to end.

To let users manage connections, assessments, migrations, jobs, and networks:

Allow group {group name} to manage odms-connection in  {location}
Allow group {group name} to manage odms-assessment in {location}
Allow group {group name} to manage odms-migration in {location}
Allow group {group name} to manage odms-job in {location}
Allow group {group name} to manage goldengate-connections in {location}
Allow group {group name} to manage virtual-network-family in {location}
Allow group  {group name} to manage tag-namespaces in {location}
Allow group {group name}  to manage vaults in {location}
Allow group {group name}  to manage keys in {location}
Allow group {group name} to manage secret-family in {location}
Allow group {group name} to manage object-family in {location}

To complete an end-to-end migration, the tenancy administrator needs to provision certain policies, where you need to create, update, and use the resources (change the level or permission depending on your use case):

Allow group {group name} to manage virtual-network-family in compartment {compartment name}
Allow group {group name} to manage vaults in compartment {compartment name}
Allow group {group name} to manage keys in compartment {compartment name}
Allow group {group name} to manage secret-family in compartment {compartment name}
Allow group {group name} to manage object-family in compartment {compartment name}
Allow group {group name} to manage odms-connection in compartment {compartment name}
Allow group {group name} to manage odms-migration in compartment {compartment name}
Allow group {group name} to manage odms-job in compartment {compartment name}

For scenarios where Manage virtual-network-family cannot be assigned, it can be substituted by:

Allow group {group name}  to inspect vcns in compartment {compartment name}
Allow group {group name}  to use subnets in compartment {compartment name}
Allow group {group name}  to manage vnic in compartment {compartment name}

Depending on whether or not you intend to use the following services, you will need to add policies to enable access to these services as well:

Oracle Autonomous AI Databases for your target databases:

Allow group {group name} to manage autonomous-database-family in compartment {compartment name} →Aggregate resource type

Base database for your source or target:

Allow group {group name} to manage database-family in compartment {compartment name} → Aggregate resource type

If you need to access the connections created by GoldenGate integrated service:

Allow group {group name} to manage GoldenGate-connections in compartment {compartment name}

If you need to deploy your own GoldenGate Marketplace instance and use as an advanced replication option:

Allow group {group name} to manage instance-family in compartment {compartment name}
Allow group {group name} to manage volume-family in compartment {compartment name}
Allow group {group name} to manage public-ips in compartment {compartment name}
Allow group {group name} to use tag-namespaces in tenancy
Allow group {group name} to inspect compartments in tenancy
Allow group {group name} to manage orm-family in compartment {compartment name}
Allow group {group name} to manage app-catalog-listing in compartment {compartment name}→ Required to launch the GG marketplace stack

To access the HeatWave cluster data when creating a HeatWave connection using the Database Migration Service:

Allow group {group name} to manage mysql-heatwave in compartment {compartment name} → Aggregate resource type

To use assessments, configure the following policy for the odms-assessment resource type:

Note: Creating an assessment would consume both the connection and the migration count limits.

Allow group {group name} to manage odms-assessment in compartment {compartment name}

This policy allows the following actions:

ODMS_ASSESSMENT_CREATE
ODMS_ASSESSMENT_INSPECT
ODMS_ASSESSMENT_MOVE
ODMS_ASSESSMENT_READ
ODMS_ASSESSMENT_UPDATE
ODMS_ASSESSMENT_DELETE
ODMS_ASSESSMENT_CLONE

Policies define what actions members of a group can perform, and in which compartments. You create policies using the Oracle Cloud Console. In the Oracle Cloud Console navigation menu, under Identity & Security and then under Identity, click Policies. Policies are written in the following syntax:

Allow group <group-name> to <verb> <resource-type> in <location> where <condition>

<group-name>: The name of the user group you’re giving permissions to
<verb>: Gives the group a certain level of access to a resource-type. As the verbs go from inspect to read to use to manage, the level of access increases and the permissions granted are cumulative.
<resource-type>: The type of resource you’re giving a group permission to work with, such as odms-agent, odms-connection, odms-job, and odms-migration.

For more information, see resource-types.
<location>: Attaches the policy to a compartment or tenancy. You can specify a single compartment or compartment path by name or OCID, or specify tenancy to cover the entire tenancy.
<condition>: Optional. One or more conditions for which this policy will apply.

Creating a Network Resource Policy

Database Migration requires you to provide VCN and subnet information when creating migrations and database registrations. In order to provide this information, you need to have the ability to view cloud network information. The following statement gives the group permission to inspect network resources in the compartment and select them when creating Database Migration resources:

allow group <group-name> to inspect virtual-network-family in compartment <compartment-name>

Creating a Tagging Policy

The following statement gives a group permission to manage tag-namespaces and tags for workspaces:

allow group <group-name> to manage tag-namespaces in compartment <compartment-name>

To add a defined tag, you must have permission to use the tag namespace.

Learn more about:

Required policies

Creating a Network Resource Policy

Creating a Tagging Policy

Related Topics