Getting Started with OS Management Hub

OS Management Hub can manage OCI instances and on-premises or supported third-party cloud instances. OS Management Hub provides updates as they're made available by OS vendors. Available updates are subject to the vendor's OS lifecycle programs.

You can specify which compartment the following resources reside in. This can be useful to limit access to resources on a per compartment basis.

• Software sources: Vendor software sources always reside in the root compartment, but can be replicated to other compartments. See Replicating Vendor Software Sources. Custom software sources can reside in any compartment.
• Profiles: Service-provided profiles always reside in the root compartment. Default profiles must reside in the root compartment. All other profiles can reside in any compartment. See Understanding Profiles.
• Management stations: Can reside in any compartment.
• Groups: Can reside in any compartment.
• Lifecycle environments: Can reside in any compartment.

OCI Linux

Attach instances to a virtual cloud network (VCN) that has one of the following:

• A private subnet with a service gateway that uses the All <region> Services in Oracle Services Network CIDR label.

• A private subnet with a NAT gateway.

• A public subnet with an internet gateway.

For detailed instructions, see Access to Oracle Services: Service Gateway.

OCI Windows

Define the security lists or network rules to allow Windows instances access to the Windows update server. For more information, see Windows OS Updates for Windows Images.

On-premises or supported third-party cloud

Ensure the instance acting as the management station can reach the OCI network.

• For Microsoft Azure, verify that your Azure Virtual Network allows traffic on the proxy and mirror listening ports for your management station.
• For Amazon Web Services (AWS), verify that your Amazon Virtual Private Cloud (VPC) allows traffic on the proxy and mirror listening ports for your management station.

For more information, see Creating a Management Station.

For policy management, define groups of users and dynamic groups of resources. Then create policies that grant permissions to the groups instead of individual users or resources. See Example Policies for specific use cases. See Getting Started with Policies for general information on policies.

Recommended User Group

Create a user group to administer the OS Management Hub service in the tenancy. Any user that belongs to the group automatically inherits the policies and permissions with that specific group.

Required Dynamic Group

Create a dynamic group to include the instances that will be managed by OS Management Hub. As new instances register with the OS Management Hub, the dynamic group will include them based on the rule statements. Dynamic group rules are compartment specific. You must specify a rule for every compartment and subcompartment with instances that you want managed by OS Management Hub.

Tip

A single resource can belong to a maximum of five dynamic groups. A good practice is to reuse the same dynamic group wherever possible across services instead of creating one or more dynamic groups for each service.

Note

The rule builder provides flexibility for creating rules that reference multiple resources. Be aware of the differences when using ALL and ANY conditions with rule builder. For more information, see Managing Dynamic Groups .

OCI instances require a different dynamic group rule than non-OCI instances (on-premises or third-party cloud). If managing multiple instance types, include both rules. You can use a single dynamic group that contains rules for both instance types.

Rule for OCI instances

Add a rule statement for each compartment (and subcompartment) that will contain instances.

ALL {instance.compartment.id='<compartment_ocid>'}

Rule for non-OCI instances

Add a rule statement for each compartment (and subcompartment) that will contain instances.

ALL {resource.type='managementagent', resource.compartment.id='<compartment_ocid>'}

Required Policies

You must have a policy that allows instances to register with OS Management Hub and allows users to manage and operate the service. Before creating the policy, create a dynamic group and the recommended user group. You can set the required IAM policies for OS Management Hub either at the tenancy or compartment level.

Note

The policy statement uses the default identity domain unless you define the identity domain before the group or dynamic group name (for example, <identity_domain_name>/<dynamic_group_name>). For more information, see Policy Syntax.

Tenancy-level policies

To apply the required IAM policies at the tenancy level, use the following policy statements:

allow dynamic-group <osmh_dynamic_group> to {OSMH_MANAGED_INSTANCE_ACCESS} in tenancy where request.principal.id = target.managed-instance.id
allow group <user_group> to manage osmh-family in tenancy

If managing on-premises or third-party cloud instances, include the following additional policy statements. These aren't required if managing only OCI instances.

allow group <user_group> to manage management-agents in tenancy
allow group <user_group> to manage management-agent-install-keys in tenancy

Compartment-level policies (if not using tenancy-level)

If the tenancy administrator doesn't permit setting IAM policies at the tenancy level, you can restrict the use of OS Management Hub resources to a compartment and its subcompartments (policies use compartment inheritance).

To apply the IAM policies to a compartment inside the tenancy, use the following policy statements:

allow dynamic-group <osmh_dynamic_group> to {OSMH_MANAGED_INSTANCE_ACCESS} in compartment <compartment_name> where request.principal.id = target.managed-instance.id
allow group <user_group> to manage osmh-family in compartment <compartment_name>

If managing on-premises or third-party cloud instances, include the following additional policy statements. These aren't required if managing only OCI instances.

allow group <user_group> to manage management-agents in compartment <compartment_name>
allow group <user_group> to manage management-agent-install-keys in compartment <compartment_name>

For more information, see Example Policies.