Oracle Cloud Infrastructure GoldenGate Policies

To control access to Oracle Cloud Infrastructure GoldenGate and the type of access each user group has, you must create policies.

For example, you can create an Administrators group whose members can access all OCI GoldenGate resources. You can then create a separate group for everyone else who’s involved with OCI GoldenGate, and create policies that restricts their access to OCI GoldenGate resources in different compartments.

For a complete list of Oracle Cloud Infrastructure policies, see policy reference.

Create policies

Policies define what actions members of a group can perform, and in which compartments.

Use the Oracle Cloud console to create policies. In the Oracle Cloud console navigation menu, select Identity & Security, and then under Identity, and select Policies. Policies are written in the following syntax:

allow group <identity-domain>/<group-name> to <verb> <resource-type> in <location> where <condition>

Parameter definitions are as follows:

Learn more about policy syntax.

How to create a policy

To create a policy:

  1. In the Oracle Cloud navigation menu, select Identity & Security, and then under Identify, select Policies.

  2. On the Policies page, select Create Policy.

  3. On the Create Policy page, enter a name and description for the policy.

  4. Select the Compartment in which to create this policy.

  5. In the Policy Builder section, you can either

    • Select GoldenGate Service from the Policy use case dropdown and a common policy template, such as Required policies to let users manage GoldenGate resources.

    • Select Show manual editor to enter a policy rule in the following format:

      allow <subject> to <verb> <resource-type> in <location> where <condition>

      Conditions are optional. See Details for Verbs + Resource-Type Combinations.

    Tip: See Minimum recommended policies for more information.

  6. Select Create.

For more information about policies, see how policies work, policy syntax, and policy reference.

Minimum recommended policies

Tip:

To use a common policy template to add all the required policies:

  1. For Policy use cases, select GoldenGate Service from the dropdown.

  2. For Common use templates, select Required policies to let users manage GoldenGate resources from the dropdown.

At minimum, you need policies to:

Depending on whether you intend to use the following services, you may also need to add policies for:

The following statement gives a group permission to manage tag-namespaces and tags for workspaces:

allow group <identity-domain>/<group-name> to manage tag-namespaces in <location>

To add a defined tag, you must have permission to use the tag namespace. To learn more about tagging, see Resource Tags.

Policy Examples for Network Resources

You can easily allow users access to network resources within a compartment with the policy:

allow group <group-name> to use virtual-network-family in compartment <compartment-name>

Alternatively, you can use the following policies to secure network resources at a more granular level:

Operation Required Access on Underlying Resources
Create a private endpoint For the private endpoint compartment:
  • Create VNIC (VNIC_CREATE)
  • Delete VNIC (VNIC_DELETE)
  • Update members in a network security group (NETWORK_SECURITY_GROUP_UPDATE_MEMBERS)
  • Associate a network security group (VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP)

For the subnet compartment:

  • Attach subnet (SUBNET_ATTACH)
  • Detach subnet (SUBNET_DETACH)
Update a private endpoint For the private endpoint compartment:
  • Update VNIC (VNIC_UPDATE)
  • Update members in a network security group (NETWORK_SECURITY_GROUP_UPDATE_MEMBERS)
  • Associate a network security group (VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP)
Delete a private endpoint For the private endpoint compartment:
  • Delete VNIC (VNIC_DELETE)
  • Update members in a network security group (NETWORK_SECURITY_GROUP_UPDATE_MEMBERS)

For the subnet compartment:

  • Detach subnet (SUBNET_DETACH)
Change a private endpoint compartment If moving from one compartment to another, all permissions in the original compartment must also be present in the new compartment.

Resource-Types

Oracle Cloud Infrastructure GoldenGate offers both aggregate and individual resource-types for writing policies.

Aggregate Resource-Type Individual Resource-Types
goldengate-family

goldengate-deployments

goldengate-deployment-backups

goldengate-deployment-upgrades

goldengate-connections

goldengate-connection-assignments

goldengate-pipelines

The APIs covered for the aggregate goldengate-family resource-type also cover the APIs for each of the individual resource-types. For example,

allow group gg-admins to manage goldengate-family in compartment <compartment-name>

is the same as writing the following policies:

allow group gg-admins to manage goldengate-deployments in compartment <compartment-name>
allow group gg-admins to manage goldengate-connections in compartment <compartment-name>
allow group gg-admins to manage goldengate-connection-assignments in compartment <compartment-name>
allow group gg-admins to manage goldengate-deployment-upgrades in compartment <compartment-name>
allow group gg-admins to manage goldengate-deployment-backups in compartment <compartment-name>
allow group gg-admins to manage goldengate-pipelines in compartment <compartment-name>

Supported Variables

When you add conditions to your policies, you can use either Oracle Cloud Infrastructure general or service specific variables.

Oracle Cloud Infrastructure GoldenGate supports all general variables. For more information, see general variables for all requests.

Details for Verbs + Resource-Type Combinations

There are various Oracle Cloud Infrastructure verbs and resource-types that you can use when you create a policy.

The following tables show the permissions and API operations covered by each verb for Oracle Cloud Infrastructure GoldenGate. The level of access is cumulative as you go from inspect to read to use to manage.

goldengate-deployments

Permission APIs Fully Covered
INSPECT
GOLDENGATE_DEPLOYMENT_INSPECT ListDeployments
ListWorkRequests
READ
INSPECT + INSPECT+
GOLDENGATE_DEPLOYMENT_READ GetDeployment
GetWorkRequestList
WorkRequestErrorsList
WorkRequestLogs
USE
READ + READ +
GOLDENGATE_DEPLOYMENT_UPDATE UpdateDeployment
StartDeployment
StopDeployment
RestoreDeployment
MANAGE
USE + USE +
GOLDENGATE_DEPLOYMENT_CREATE CreateDeployment
GOLDENGATE_DEPLOYMENT_DELETE DeleteDeployment
GOLDENGATE_DEPLOYMENT_MOVE ChangeDeploymentCompartment

goldengate-connections

Permission APIs Fully Covered
INSPECT
GOLDENGATE_CONNECTION_INSPECT ListConnections
READ
INSPECT + INSPECT+
GOLDENGATE_CONNECTION_READ GetConnection
USE
READ + READ +
GOLDENGATE_CONNECTION_UPDATE UpdateConnection
MANAGE
USE + USE +
GOLDENGATE_CONNECTION_CREATE CreateConnection
GOLDENGATE_CONNECTION_DELETE DeleteConnection
GOLDENGATE_CONNECTION_MOVE ChangeConnectionCompartment

goldengate-connection-assignments

Permission APIs Fully Covered
INSPECT
GOLDENGATE_CONNECTION_ASSIGNMENT_INSPECT ListConnectionAssignments
READ
INSPECT + INSPECT+
GOLDENGATE_CONNECTION_ASSIGNMENT_READ GetConnectionAssignment
USE
READ + READ +
n/a n/a
MANAGE
USE + USE +
GOLDENGATE_CONNECTION_ASSIGNMENT_CREATE CreateConnectionAssignment
GOLDENGATE_CONNECTION_ASSIGNMENT_DELETE DeleteConnectionAssignment

goldengate-deployment-backups

Permission APIs Fully Covered
INSPECT
GOLDENGATE_DEPLOYMENT_BACKUP_INSPECT ListDeploymentBackups
READ
INSPECT + INSPECT+
GOLDENGATE_DEPLOYMENT_BACKUP_READ GetDeploymentBackup
RestoreDeployment
USE
READ + READ +
GOLDENGATE_DEPLOYMENT_BACKUP_UPDATE UpdateDeploymentBackup
MANAGE
USE + USE +
GOLDENGATE_DEPLOYMENT_BACKUP_CREATE CreateDeploymentBackup
GOLDENGATE_DEPLOYMENT_BACKUP_DELETE DeleteDeploymentBackup
GOLDENGATE_DEPLOYMENT_BACKUP_MOVE ChangeDeploymentBackupCompartment

Permissions Required for Each API Operation

Here’s a list of the API operations for Oracle Cloud Infrastructure GoldenGate in logical order, grouped by resource-type.

The resource-types are goldengate-deployments, goldengate-connections, and goldengate-deployment-backups.

API Operation Permission
ListDeployments GOLDENGATE_DEPLOYMENT_INSPECT
CreateDeployment GOLDENGATE_DEPLOYMENT_CREATE
GetDeployment GOLDENGATE_DEPLOYMENT_READ
UpdateDeployment GOLDENGATE_DEPLOYMENT_UPDATE
DeleteDeployment GOLDENGATE_DEPLOYMENT_DELETE
StartDeployment GOLDENGATE_DEPLOYMENT_UPDATE
StopDeployment GOLDENGATE_DEPLOYMENT_UPDATE
RestoreDeployment GOLDENGATE_DEPLOYMENT_BACKUP_READ and GOLDENGATE_DEPLOYMENT_UPDATE
ChangeDeploymentCompartment GOLDENGATE_DEPLOYMENT_MOVE
UpgradeDeployment GOLDENGATE_DEPLOYMENT_UPDATE
ListConnections GOLDENGATE_CONNECTION_INSPECT
CreateConnection GOLDENGATE_CONNECTION_CREATE
GetConnection GOLDENGATE_CONNECTION_READ
UpdateConnection GOLDENGATE_CONNECTION_UPDATE
DeleteConnection GOLDENGATE_CONNECTION_DELETE
ChangeConnectionCompartment GOLDENGATE_CONNECTION_MOVE
ListConnectionAssignments GOLDENGATE_CONNECTION_ASSIGNMENT_INSPECT
CreateConnectionAssignment GOLDENGATE_CONNECTION_ASSIGNMENT_CREATE, GOLDENGATE_DEPLOYMENT_UPDATE, GOLDENGATE_CONNECTION_UPDATE
GetConnectionAssignment GOLDENGATE_CONNECTION_ASSIGNMENT_READ
DeleteConnectionAssignment GOLDENGATE_CONNECTION_ASSIGNMENT_DELETE, GOLDENGATE_DEPLOYMENT_UPDATE, GOLDENGATE_CONNECTION_UPDATE
ListDeploymentBackups GOLDENGATE_DEPLOYMENT_BACKUP_INSPECT
GetDeploymentBackup GOLDENGATE_DEPLOYMENT_BACKUP_READ
CreateDeploymentBackup GOLDENGATE_DEPLOYMENT_BACKUP_CREATE, GOLDENGATE_DEPLOYMENT_READ
UpdateDeploymentBackup GOLDENGATE_DEPLOYMENT_BACKUP_UPDATE
CancelDeploymentBackup GOLDENGATE_DEPLOYMENT_BACKUP_UPDATE
DeleteDeploymentBackup GOLDENGATE_DEPLOYMENT_BACKUP_DELETE
ChangeDeploymentBackupCompartment GOLDENGATE_DEPLOYMENT_BACKUP_MOVE
GetDeploymentUpgrade GOLDENGATE_DEPLOYMENT_UPGRADE_READ
ListDeploymentUpgrades GOLDENGATE_DEPLOYMENT_UPGRADE_INSPECT
GetWorkRequest GOLDENGATE_DEPLOYMENT_READ
ListWorkRequests GOLDENGATE_DEPLOYMENT_INSPECT
ListWorkRequestErrors GOLDENGATE_DEPLOYMENT_READ
ListWorkRequestLogs GOLDENGATE_DEPLOYMENT_READ