Skip to main content

Oracle Cloud Least-Privilege Policies

Cloudaware’s OCI integration is designed to use read‑only access wherever possible. Use the patterns below to grant only the minimum rights required for each scenario.

Identity Model​

  • Use a dedicated OCI IAM user for Cloudaware.
  • Add that user to an OCI IAM group created specifically for Cloudaware access.
  • Attach read‑only policies to that group at the tenancy level or scoped to specific compartments.

Baseline Discovery Access (Required)​

To allow Cloudaware to inventory core OCI resources (tenancy, compartments, compute, networking, and related objects), create a read‑only policy for the group that the Cloudaware user belongs to.

Example tenancy‑wide read access:

Allow group id <groupOcid> to read dedicated-vm-hosts in tenancy
Allow group id <groupOcid> to read all-resources in tenancy
Allow group id <groupOcid> to read compartments in tenancy

Replace <groupOcid> with your OCI IAM group details. Adjust statements if you prefer to scope access to specific compartments rather than the entire tenancy.

Compartment Scoping​

If you do not want Cloudaware to see all compartments:

  • Replace in tenancy with in compartment <compartmentName> or use nested compartment scopes as needed.
  • Ensure that the policies still cover all compartments that contain resources you expect Cloudaware to inventory.

Regions​

  • Cloudaware will use the region you configure during tenancy setup as the default API region.
  • Ensure that your region policies and subscriptions align with the regions where resources are deployed and that the Cloudaware user’s policies apply globally or to those regions.

Recommendations​

  • Use a dedicated group for Cloudaware instead of reusing existing groups.
  • Prefer read‑only permissions (read) and avoid broad manage permissions unless specifically required for future advanced features.
  • Review policies periodically, especially if your compartment layout changes, to ensure Cloudaware maintains the right level of visibility without over‑privileging.
On this page