IAM

In terms of cloud IAM stands for Identity and Access Management which is related to Policies. Using policies, we write human readable statement to define permissions for the group of users which can be given on compartment level or tenancy level.

Policy Statements Limit per Compartment Hierarchy

The maximum number of policy statements allowed from the root compartment to any leaf compartment is 500. This limit includes all policy statements defined at every level of the compartment hierarchy along that path. It is recommended to start writing policies from the leaf compartment.

---

For example, if a tenancy has a compartment hierarchy such as:

• Root
  • Compartment A
    • Compartment B
      • Compartment C

then the total number of policy statements across all four compartments (Root, Compartment A, Compartment B and Compartment C) must not exceed 500.

---

However, if a tenancy has peer compartments such as:

• Root
  • Compartment A
  • Compartment B
  • Compartment C

then Root + Compartment A must not exceed 500, Root + Compartment B must not exceed 500, and Root + Compartment C must not exceed 500.

---

Example demonstration:

Levels of Policy

In OCI there are four levels of policy:

1. Inspect
2. Read
3. Use
4. Manage

Inspect level of policy (lowest-level of policy)

Inspect level of policy provides least read-only access where users can view resources within the specified service compartment and system-generated attributes such as resource's name, OCID, and current lifecycle state(eg. Running, Terminated, Available) but they can't view detailed configurations(eg. they can see that a compute instance exists, but they can't see it's details or underlying data). It is helpful for inspection purpose.

Read level of policy

Read level of policy provides full visibility access where users can view all things included in inspect and rest every thing also inside a specified service compartment. It is helpful for monitoring purpose.

Use level of policy

Use level of policy provides write access where users can do every thing(start, stop, reboot, and edit) other then create and terminate within the specified compartment. It is useful for day-to-day admins where they can't create new service and can't terminate existing service but can work on existing service.

Manage level of policy (highest-level of policy)

Manage level of policy provides complete access where users can do any thing(start, stop, reboot, edit, create, and terminate) within the specified compartment.

Navigate to policies

Navigation menu > Identity & Security > Policies