这是 OCI Identity and Access Management 策略名称。JMS 所需的所有策略都添加到此策略文档。
在监视 OCI 实例下,选择要监视的 OCI 实例所在的区间。要添加更多区间,请单击添加行。
单击复查可查看将创建的所有资源。
验证是否使用以下规则设置了 JMS_DYNAMIC_GROUP:
ALL {resource.type='managementagent', resource.compartment.id=<Fleet_Compartment_OCID>}
ANY {instance.compartment.id = <Fleet_Compartment_OCID>}
ALL {resource.type='managementagent', resource.compartment.id=<OCI_Instance_Compartment_OCID>}
ANY {instance.compartment.id = <OCI_Instance_Compartment_OCID>}
使用以下规则验证是否设置了 JMS_Policy_Fleet_Compartment:
ALLOW GROUP FLEET_MANAGERS TO MANAGE fleet IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO MANAGE management-agents IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO MANAGE management-agent-install-keys IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO READ METRICS IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO MANAGE instance-family IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO READ instance-agent-plugins IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO MANAGE log-groups IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO MANAGE log-content IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO MANAGE jms-plugins IN COMPARTMENT Fleet_Compartment
ALLOW GROUP FLEET_MANAGERS TO MANAGE instance-family IN COMPARTMENT <OCI_Instance_Compartment>
ALLOW GROUP FLEET_MANAGERS TO READ instance-agent-plugins IN COMPARTMENT <OCI_Instance_Compartment>
ALLOW DYNAMIC-GROUP JMS_DYNAMIC_GROUP TO USE METRICS IN COMPARTMENT Fleet_Compartment
ALLOW DYNAMIC-GROUP JMS_DYNAMIC_GROUP TO MANAGE management-agents IN COMPARTMENT Fleet_Compartment
ALLOW DYNAMIC-GROUP JMS_DYNAMIC_GROUP TO MANAGE log-content IN COMPARTMENT Fleet_Compartment
ALLOW DYNAMIC-GROUP JMS_DYNAMIC_GROUP TO MANAGE jms-plugins IN COMPARTMENT Fleet_Compartment
ALLOW DYNAMIC-GROUP JMS_DYNAMIC_GROUP TO MANAGE metrics IN COMPARTMENT Fleet_Compartment WHERE target.metrics.namespace='java_management_service'
ALLOW DYNAMIC-GROUP JMS_Dynamic_Group TO MANAGE management-agents IN COMPARTMENT <OCI_Instance_Compartment>
ALLOW DYNAMIC-GROUP JMS_DYNAMIC_GROUP TO USE METRICS IN COMPARTMENT <OCI_Instance_Compartment>
ALLOW DYNAMIC-GROUP JMS_DYNAMIC_GROUP TO MANAGE jms-plugins IN COMPARTMENT <OCI_Instance_Compartment>
ALLOW resource jms SERVER-COMPONENTS TO MANAGE metrics IN COMPARTMENT Fleet_Compartment WHERE target.metrics.namespace='java_management_service'
ALLOW resource jms SERVER-COMPONENTS TO USE management-agent-install-keys IN COMPARTMENT Fleet_Compartment
ALLOW resource jms SERVER-COMPONENTS TO MANAGE log-groups IN COMPARTMENT Fleet_Compartment
ALLOW resource jms SERVER-COMPONENTS TO MANAGE log-content IN COMPARTMENT Fleet_Compartment
ALLOW resource jms SERVER-COMPONENTS TO READ instances IN tenancy
ALLOW resource jms SERVER-COMPONENTS TO INSPECT instance-agent-plugins IN tenancy