Policy Creation

While creating policies, keep in mind that policies are inherited from parent to child compartments, but the reverse is not true. For example, if I grant the inspect policy to Compartment A, then its child compartments Compartment A1 and Compartment A2 will inherit it. However, if I grant the inspect policy to Compartment A1 or Compartment A2, Compartment A will not inherit it.

• Navigate to Policies

Navigation menu > Identity & Security > Policies

---

• On the policies page click Create Policy

---

Compartment level

Providing the inspect policy to the hub-group for the hub_compartment

• Provide Name and Description and select hub_compartment from Compartment list

---

• Write policies inside Policy Builder and click Create

---

Providing the read policy to the hub-group for the hub_compartment

First, I removed the inspect policy for the hub-group because read is higher in the hierarchy, so it includes both inspect and read policies.

• Provide Name and Description and select hub_compartment from Compartment list

---

• Write policies inside Policy Builder and click Create

---

Providing the use policy to the hub-group for the hub_compute_storage_compartment

• Provide Name and Description and select hub_compute_storage_compartment from Compartment list

---

• Write policies inside Policy Builder and click Create

---

Providing the manage policy to the hub-group for the hub_compute_storage_compartment

First, I removed the use policy for the hub-group because manage is highest in the hierarchy, so it includes all inspect, read, and use policies.

• Provide Name and Description and select hub_compute_storage_compartment from Compartment list

---

• Write policies inside Policy Builder and click Create

---

Tenancy level

Administrators is the group where tenancy owners reside, and they require the highest level of policy to manage all resources in the tenancy. There is already a policy named Tenant Admin Policy that provides the privilege to manage all resources. To review this policy, head over to the Policy page and follow the instructions below.

• Change the Applied filters to root in my case it's devoncloud01 (root)

• Click Tenant Admin Policy

• Head over to Statements section

• Here you can see the policy statement written