Explain the IAM Policy Levels in OCI

In OCI, Inspect, Read, Use, and Manage are policy verbs that define how much access a user or group has to a resource.

Think of them as levels of permission, from basic information access to full control.

1. Inspect — “I can see basic information”

• Inspect gives the user permission to view basic information about a resource, but not its detailed contents or configuration.

Example: A user can see that a Compute instance exists and view basic information about it.

Inspect = See that the resource exists.

2. Read — “I can see more details”

• Read includes the permissions of Inspect and allows the user to view more detailed information about a resource.

Example: A user can view the configuration and detailed information of a Compute instance but cannot change it.

Read = View detailed information.

3. Use — “I can use the resource”

• Use includes the permissions of Read and allows the user to perform certain actions using the resource, but generally not change its core configuration.

Example: A user might be allowed to use an existing resource without being allowed to modify its fundamental configuration.

Use = Use the resource, but with limited control.

4. Manage — “I have full control”

• Manage is the highest predefined permission level. It includes the permissions of Inspect, Read, and Use, and allows the user to create, modify, and delete resources where the relevant service supports those operations.

Example: A user with Manage permission for Compute can create, modify, and terminate Compute instances, subject to the specific policy and resource type.

Manage = Full administrative control.