Configure Object Storage Access

Configure the required Identity and Access Management (IAM) policies to allow extract jobs to access Customer-managed OCI Object Storage.

Overview

To use Customer-managed OCI Object Storage as an extract output destination, configure the required Identity and Access Management (IAM) policies in your OCI tenancy.

These policies allow extract jobs to create, overwrite, and delete files in the target object storage bucket.

Placeholder Values

Placeholder Values

Placeholder	Value
<compartment_OCID>	OCI compartment containing the bucket
<bucket_name>	Object Storage bucket used for extract output
<object_prefix>	Prefix used for extract output files

Sample Policy

Object Storage upload, delete, and overwrite policy

Allow any-user to {OBJECT_CREATE, OBJECT_DELETE, OBJECT_OVERWRITE} in compartment id <compartment_OCID>
where all {
  request.principal.id = /urn_opc_resource_fusion_*/,
  request.principal.id = /*_saas-batch_APPID/,
  target.bucket.name = '<bucket_name>',
  target.object.name = /<object_prefix>*/
}

Allow any-user to read objectstorage-namespaces in compartment id <compartment_OCID>
where all {
  request.principal.id = /urn_opc_resource_fusion_*/,
  request.principal.id = /*_saas-batch_APPID/
}

Example

Allow any-user to {OBJECT_CREATE, OBJECT_DELETE, OBJECT_OVERWRITE} in compartment id ocid1.compartment.oc1..aaaaaaaatc7w5ll7vftzusdcs7fl7i6cgfu4sp42qvgjsvljnuvbvx4gvwhq
where all {
  request.principal.id = /urn_opc_resource_fusion_*/,
  request.principal.id = /*_saas-batch_APPID/,
  target.bucket.name = 'scm_data_export',
  target.object.name = /dac-exports*/
}

Allow any-user to read objectstorage-namespaces in compartment id ocid1.compartment.oc1..aaaaaaaatc7w5ll7vftzusdcs7fl7i6cgfu4sp42qvgjsvljnuvbvx4gvwhq
where all {
  request.principal.id = /urn_opc_resource_fusion_*/,
  request.principal.id = /*_saas-batch_APPID/
}