Oracle Cloud Infrastructureドキュメント

組織管理の詳細

このトピックでは、組織管理へのアクセスを制御するポリシーの記述に関する詳細を説明します。

リソース・タイプ

  • organizations-family
  • organizations-link
  • organizations-recipient-invitation
  • organizations-sender-invitation
  • organizations-invitation
  • organizations-domain
  • organizations-domain-governance
  • organizations-entity
  • organizations-tenancy
  • organizations-order
  • organizations-subscription
  • organizations-subscription-mapping
  • organizations-assigned-subscription
  • organizations-subscription-region
  • organizations-governance-rules
  • organizations-enforced-governance-rules

サポートされている変数

組織管理では、すべての一般的な変数(「すべてのリクエストの一般変数」を参照)に加えて、ここにリストされているその他の変数がサポートされています:

必須変数(リクエストごとにサービスによって提供される):

変数 変数タイプ コメント
target.resource.kind 文字列 リクエストのプライマリ・リソースのリソース種類名

自動変数(リクエストごとにSDKによって提供されます):

変数 変数タイプ コメント
target.tenant.id エンティティ(OCID) ターゲット・テナントIDのOCID

動詞とリソース・タイプの組合せの詳細

次の表に、各動詞でカバーされている権限およびAPI操作を示します。アクセス・レベルは、inspect > read > use > manageの順に累積されます。たとえば、リソースを使用できるグループは、そのリソースを検査して読み取ることもできます。表セル内のプラス記号(+)は、その上のセルと比較して増分アクセスを示しますが、「余分なし」は増分アクセスを示しません。

organizations-family
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_LINK_INSPECT

ORGANIZATIONS_RECIPIENT_INVITATION_INSPECT

ORGANIZATIONS_SENDER_INVITATION_INSPECT

ORGANIZATIONS_DOMAIN_INSPECT

ORGANIZATIONS_DOMAIN_GOVERNANCE_INSPECT

ORGANIZATIONS_TENANCY_INSPECT

ORGANIZATIONS_SUBSCRIPTION_INSPECT

ORGANIZATIONS_SUBSCRIPTION_MAPPING_INSPECT

ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_INSPECT

ORGANIZATIONS_SUBSCRIPTION_REGION_INSPECT

GOVERNANCE_RULE_INSPECT

ORGANIZATIONS_ENTITY_INSPECT

ORGANIZATIONS_TENANCY_INSPECT

 ListLinks


                                            ListRecipientInvitations
                                        


                                            ListSenderInvitations
                                        


                                            ListDomains
                                        


                                            ListDomainGovernances
                                        


                                            ListOrganizationTenancies
                                        


                                            ListSubscriptions
                                        


                                            ListSubscriptionMappings
                                        


                                            ListAssignedSubscriptions
                                            ListAvailableRegions
                                        


                                            ListGovernanceRules
                                        


                                            ListOrganizations
                                        

 なし
READ 検査 + ORGANIZATIONS_LINK_READ

ORGANIZATIONS_RECIPIENT_INVITATION_READ

ORGANIZATIONS_SENDER_INVITATION_READ

ORGANIZATIONS_DOMAIN_READ

ORGANIZATIONS_DOMAIN_GOVERNANCE_READ

ORGANIZATIONS_ENTITY_READ

ORGANIZATIONS_TENANCY_READ

ORGANIZATIONS_SUBSCRIPTION_READ

ORGANIZATIONS_SUBSCRIPTION_MAPPING_READ

ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_READ

GOVERNANCE_RULE_READ

 検査 + GetLink


                                            GetRecipientInvitation
                                        


                                            GetSenderInvitation
                                        


                                            GetDomain
                                        


                                            GetDomainGovernance
                                        


                                            GetOrganizationTenancy
                                        


                                            GetSubscriptionMapping
                                        


                                            GetAssignedSubscription
                                        


                                            GetGovernanceRule
                                        


                                            ListTenancyAttachments
                                        


                                            GetTenancyAttachment
                                        

 なし
USE 読取り + ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE


ORGANIZATIONS_DOMAIN_UPDATE

ORGANIZATIONS_DOMAIN_GOVERNANCE_UPDATE

ORGANIZATIONS_ENTITY_UPDATE

ORGANIZATIONS_SENDER_INVITATION_UPDATE

GOVERNANCE_RULE_UPDATE

GOVERNANCE_RULE_RETRY

 読取り + AcceptRecipientInvitation


                                            IgnoreRecipientInvitation
                                        


                                            CancelSenderInvitation
                                        


                                            UpdateSenderInvitation
                                        


                                            UpdateDomain
                                        


                                            UpdateDomainGovernance
                                        


                                            UpdateOrganization
                                        

GetGovernanceRule


                                            DeleteInclusionCriterion
                                        


                                            RetryGovernanceRule
                                        


                                            RetryTenancyAttachment
                                        

 なし
MANAGE USE + ORGANIZATIONS_LINK_PARENT_DELETE

ORGANIZATIONS_LINK_CHILD_DELETE

ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATE

ORGANIZATIONS_SENDER_INVITATION_CREATE

ORGANIZATIONS_DOMAIN_CREATE

ORGANIZATIONS_DOMAIN_DELETE

ORGANIZATIONS_ORDER_ACTIVATE

ORGANIZATIONS_DOMAIN_GOVERNANCE_CREATE

ORGANIZATIONS_DOMAIN_GOVERNANCE_DELETE

ORGANIZATIONS_ENTITY_UPDATE

ORGANIZATIONS_TENANCY_CREATE

ORGANIZATIONS_SUBSCRIPTION_MAPPING_DELETE

ORGANIZATIONS_TENANCY_DELETE

ORGANIZATIONS_TENANCY_RESTORE

GOVERNANCE_RULE_CREATE

GOVERNANCE_RULE_DELETE

 USE + DeleteLink


                                            CreateSenderInvitation
                                        


                                            CreateDomain
                                        


                                            DeleteDomain
                                        


                                            ActivateOrder
                                        


                                            CreateDomainGovernance
                                        


                                            DeleteDomainGovernance
                                        


                                            UpdateOrganization
                                        


                                            CreateChildTenancy
                                        


                                            DeleteSubscriptionMapping
                                        


                                            DeleteOrganizationTenancy
                                        


                                            RestoreOrganizationTenancy
                                        


                                            CreateSubscriptionMapping
                                        


                                            CreateGovernanceRule
                                        


                                            DeleteGovernanceRule
                                        

 なし
organizations-recipient-invitation
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_RECIPIENT_INVITATION_INSPECT ListRecipientInvitations なし
READ 検査 + ORGANIZATIONS_RECIPIENT_INVITATION_READ 検査 + GetRecipientInvitation なし
USE、MANAGE 読取り + ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE 読取り + AcceptRecipientInvitation


                                            IgnoreRecipientInvitation
                                        


                                            UpdateRecipientInvitation
                                        

 なし
organizations-sender-invitation
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_SENDER_INVITATION_INSPECT ListRecipientInvitations なし
READ 検査 + ORGANIZATIONS_SENDER_INVITATION_READ 検査 + GetSenderInvitation なし
USE 読取り + ORGANIZATIONS_SENDER_INVITATION_UPDATE 読取り + UpdateSenderInvitation


                                            CancelSenderInvitation
                                        

 なし
MANAGE USE + ORGANIZATIONS_SENDER_INVITATION_CREATE USE + CreateSenderInvitation なし
organizations-invitation
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_RECIPIENT_INVITATION_INSPECT

ORGANIZATIONS_SENDER_INVITATION_INSPECT

 ListRecipientInvitations


                                            ListSenderInvitations
                                        

 なし
READ 検査 + ORGANIZATIONS_RECIPIENT_INVITATION_READ

ORGANIZATIONS_SENDER_INVITATION_READ

 検査 + GetRecipientInvitation


                                            GetSenderInvitation
                                        

 なし
USE 読取り + ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE

ORGANIZATIONS_SENDER_INVITATION_UPDATE

 読取り + AcceptRecipientInvitation


                                            UpdateRecipientInvitation
                                        


                                            UpdateSenderInvitation
                                        


                                            CancelSenderInvitation
                                        

 なし
MANAGE USE + ORGANIZATIONS_SENDER_INVITATION_CREATE USE + CreateSenderInvitation なし
organizations-domain
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_DOMAIN_INSPECT ListDomains なし
READ 検査 + ORGANIZATIONS_DOMAIN_READ 検査 + GetDomain なし
USE 読取り + ORGANIZATIONS_DOMAIN_UPDATE 読取り + UpdateDomain なし
MANAGE USE + ORGANIZATIONS_DOMAIN_CREATE

ORGANIZATIONS_DOMAIN_DELETE

 USE + CreateDomain


                                            DeleteDomain
                                        

 なし
organizations-domain-governance
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_DOMAIN_GOVERNANCE_INSPECT ListDomainGovernances なし
READ 検査 + ORGANIZATIONS_DOMAIN_GOVERNANCE_READ 検査 + GetDomainGovernance なし
USE 読取り + ORGANIZATIONS_DOMAIN_GOVERNANCE_UPDATE 読取り + UpdateDomainGovernance なし
MANAGE USE + ORGANIZATIONS_DOMAIN_GOVERNANCE_CREATE

ORGANIZATIONS_DOMAIN_GOVERNANCE_DELETE

 USE + CreateDomainGovernance


                                            DeleteDomainGovernance
                                        

 なし
organizations-entity
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_ENTITY_INSPECT ListOrganizations なし
READ 検査 + ORGANIZATIONS_ENTITY_READ 検査 + GetOrganization なし
USE 読取り + ORGANIZATIONS_ENTITY_UPDATE 読取り + UpdateOrganization なし
MANAGE - - なし
organizations-tenancy
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_TENANCY_INSPECT ListOrganizationTenancies なし
READ、USE 検査 + ORGANIZATIONS_TENANCY_READ 検査 + GetOrganizationTenancy なし
MANAGE USE + ORGANIZATIONS_TENANCY_CREATE

ORGANIZATIONS_TENANCY_DELETE

ORGANIZATIONS_TENANCY_RESTORE

 USE + CreateChildTenancy


                                            DeleteOrganizationTenancy
                                        


                                            RestoreOrganizationTenancy
                                        

 なし
organizations-order
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT - - なし
READ - - なし
USE - - なし
MANAGE ORGANIZATIONS_ORDER_ACTIVATE ActivateOrder なし
organizations-subscription
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_SUBSCRIPTION_INSPECT ListSubscriptions なし
READ 検査 + ORGANIZATIONS_SUBSCRIPTION_READ 検査 + GetSubscription なし
USE、MANAGE USE + ORGANIZATIONS_SUBSCRIPTION_ASSIGN

ORGANIZATIONS_SUBSCRIPTION_DELETE
ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATE

 USE + AssignTenancySubscription


                                            AssignDefaultSubscription
                                        


                                            CreateSubscriptionMapping
                                        

 なし
organizations-subscription-mapping
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_SUBSCRIPTION_MAPPING_INSPECT ListSubscriptionMappings なし
READ 検査 + ORGANIZATIONS_SUBSCRIPTION_MAPPING_READ 検査 + GetSubscriptionMapping なし
USE、MANAGE USE + ORGANIZATIONS_SUBSCRIPTION_MAPPING_DELETE

ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATE

 USE + DeleteSubscriptionMapping


                                            CreateSubscriptionMapping
                                        

 なし
organizations-assigned-subscription
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_INSPECT ListAssignedSubscriptions なし
READ 検査 + ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_READ 検査 + GetAssignedSubscription なし
USE - - なし
MANAGE - - なし
organizations-subscription-region
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT ORGANIZATIONS_SUBSCRIPTION_REGION_INSPECT ListAvailableRegions なし
READ - - なし
USE - - なし
MANAGE - - なし
organizations-governance-rules
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT GOVERNANCE_RULE_INSPECT ListGovernanceRules


                                            ListOrganizations
                                        


                                            ListOrganizationTenancies
                                        

 なし
READ 検査 + GOVERNANCE_RULE_READ 検査 + GetGovernanceRule


                                            ListTenancyAttachments
                                        


                                            GetTenancyAttachment
                                        

 なし
USE 読取り + GOVERNANCE_RULE_UPDATE

GOVERNANCE_RULE_RETRY

 読取り + GetGovernanceRule


                                            DeleteInclusionCriterion
                                        


                                            RetryGovernanceRule
                                        


                                            RetryTenancyAttachment
                                        

 なし
MANAGE USE + GOVERNANCE_RULE_CREATE

GOVERNANCE_RULE_DELETE

 USE + CreateGovernanceRule


                                            DeleteGovernanceRule
                                        

 なし
organizations-enforced-governance-rules
動詞 権限 完全に対象となるAPI 部分的に対象となるAPI
INSPECT GOVERNANCE_RULE_ENFORCED_INSPECT ListEnforcedGovernanceRules


                                            ListOrganizations
                                        


                                            ListOrganizationTenancies
                                        

 なし
READ 検査 + GOVERNANCE_RULE_ENFORCED_READ 検査 + GetEnforcedGovernanceRule なし
USE - - なし
MANAGE - - なし

各API操作に必要な権限

次の表は、API操作を論理的な順序で、リソース・タイプ別にグループ化して示しています。権限の詳細は、権限を参照してください。

API操作 操作の使用に必要な権限
GetLink ORGANIZATIONS_LINK_READ
ListLinks ORGANIZATIONS_LINK_INSPECT
DeleteLink ORGANIZATIONS_LINK_CHILD_DELETE

ORGANIZATIONS_LINK_PARENT_DELETE
GetRecipientInvitation ORGANIZATIONS_RECIPIENT_INVITATION_READ
AcceptRecipientInvitation ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE
IgnoreRecipientInvitation ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE
UpdateRecipientInvitation ORGANIZATIONS_RECIPIENT_INVITATION_UPDATE
ListRecipientInvitations ORGANIZATIONS_RECIPIENT_INVITATION_INSPECT
CreateSenderInvitation ORGANIZATIONS_SENDER_INVITATION_CREATE
GetSenderInvitation ORGANIZATIONS_SENDER_INVITATION_READ
ListSenderInvitations ORGANIZATIONS_SENDER_INVITATION_INSPECT
CancelSenderInvitation ORGANIZATIONS_SENDER_INVITATION_UPDATE
UpdateSenderInvitation ORGANIZATIONS_SENDER_INVITATION_UPDATE
UpdateSenderInvitation ORGANIZATIONS_DOMAIN_READ
ListDomains ORGANIZATIONS_DOMAIN_INSPECT
CreateDomain ORGANIZATIONS_DOMAIN_CREATE
UpdateDomain ORGANIZATIONS_DOMAIN_UPDATE
DeleteDomain ORGANIZATIONS_DOMAIN_DELETE
GetDomainGovernance ORGANIZATIONS_DOMAIN_GOVERNANCE_READ
ListDomainGovernances ORGANIZATIONS_DOMAIN_GOVERNANCE_INSPECT
CreateDomainGovernance ORGANIZATIONS_DOMAIN_GOVERNANCE_CREATE
UpdateDomainGovernance ORGANIZATIONS_DOMAIN_GOVERNANCE_UPDATE
DeleteDomainGovernance ORGANIZATIONS_DOMAIN_GOVERNANCE_DELETE
GetOrganization ORGANIZATIONS_ENTITY_READ
ListOrganizations ORGANIZATIONS_ENTITY_INSPECT
UpdateOrganization ORGANIZATIONS_ENTITY_UPDATE
GetOrganizationTenancy ORGANIZATIONS_TENANCY_READ
ListOrganizationTenancies ORGANIZATIONS_TENANCY_INSPECT
approveForTransfer/unapproveForTransfer ORGANIZATIONS_TENANCY_TRANSFER_APPROVAL_UPDATE
CreateChildTenancy ORGANIZATIONS_TENANCY_CREATE

ノート: 作成された子テナンシにsubscriptionId属性を指定する場合は、ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATEも必要です。詳細については、CreateChildTenancyDetailsリファレンスを参照してください。
DeleteOrganizationTenancy ORGANIZATIONS_TENANCY_DELETE
RestoreOrganizationTenancy ORGANIZATIONS_TENANCY_RESTORE
ActivateOrder ORGANIZATIONS_ORDER_ACTIVATE
ListSubscriptions ORGANIZATIONS_SUBSCRIPTION_INSPECT
ListSubscriptionMappings ORGANIZATIONS_SUBSCRIPTION_MAPPING_INSPECT
GetSubscription ORGANIZATIONS_SUBSCRIPTION_READ
GetSubscriptionMapping ORGANIZATIONS_SUBSCRIPTION_MAPPING_READ
AssignTenancySubscription ORGANIZATIONS_SUBSCRIPTION_ASSIGN
AssignDefaultSubscription ORGANIZATIONS_SUBSCRIPTION_ASSIGN
DeleteSubscriptionMapping ORGANIZATIONS_SUBSCRIPTION_MAPPING_DELETE
CreateSubscriptionMapping ORGANIZATIONS_SUBSCRIPTION_MAPPING_CREATE
ListAssignedSubscriptions ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_INSPECT
GetAssignedSubscription ORGANIZATIONS_ASSIGNED_SUBSCRIPTION_READ
ListAvailableRegions ORGANIZATIONS_SUBSCRIPTION_REGION_INSPECT
ListGovernanceRules GOVERNANCE_RULE_INSPECT
GetGovernanceRule GOVERNANCE_RULE_READ
CreateGovernanceRule GOVERNANCE_RULE_CREATE
UpdateGovernanceRule GOVERNANCE_RULE_UPDATE
DeleteGovernanceRule GOVERNANCE_RULE_DELETE
RetryGovernanceRule GOVERNANCE_RULE_RETRY
CreateInclusionCriterion GOVERNANCE_RULE_UPDATE
DeleteInclusionCriterion GOVERNANCE_RULE_UPDATE
ListTenancyAttachments GOVERNANCE_RULE_READ
GetTenancyAttachment GOVERNANCE_RULE_READ
RetryTenancyAttachment GOVERNANCE_RULE_RETRY
ListEnforcedGovernanceRules GOVERNANCE_RULE_ENFORCED_INSPECT
GetEnforcedGovernanceRule GOVERNANCE_RULE_ENFORCED_READ