OCI IAM Policy Cookbook

 

Introduction

Identity and Access Management (IAM) is one of the most critical services in Oracle Cloud Infrastructure (OCI). Every action performed within an OCI tenancy—from launching Compute instances to managing databases, networking, storage, and security services—is controlled by IAM policies.

A well-designed IAM strategy helps organizations enforce the Principle of Least Privilege, strengthen security, simplify administration, and ensure users have access only to the resources required for their responsibilities.

Despite its importance, many OCI administrators struggle with IAM policy syntax, inheritance, compartment design, and determining the correct permissions for different teams. As a result, organizations often create overly permissive policies that increase security risks or restrictive policies that impact productivity.

This article serves as a practical OCI IAM Policy Cookbook, presenting real-world policy examples that can be adapted to different environments. Whether you're managing a small OCI tenancy or a large enterprise cloud deployment, these examples will help you build secure, scalable, and maintainable access control policies.

Why IAM Policies Matter

OCI follows a policy-based authorization model where access is granted through human-readable statements instead of traditional role assignments.

Every policy answers four fundamental questions:

• Who receives access?
• What resource can be accessed?
• Which action is allowed?
• Where does the permission apply?

A typical OCI policy follows this structure:

Allow group <group-name> to <verb> <resource-type> in compartment <compartment-name>

Understanding this syntax is the foundation for designing secure Oracle Cloud environments.

Perfeito. A Parte 2 será o diferencial do artigo. Em vez de explicar teoria, vamos entregar exemplos práticos que as pessoas podem adaptar.

Real-World OCI IAM Policy Examples

The following examples demonstrate common IAM policies used in Oracle Cloud Infrastructure production environments. They are organized by administrative function and can be adapted to fit different tenancy structures and security requirements.

1. Read-Only Access

Ideal for auditors, managers, or users who only need to view OCI resources.

Allow group Auditors to inspect all-resources in tenancy

Use Case

Provides visibility without allowing any modifications.

2. Compute Administrators

Allows administrators to fully manage Compute resources.

Allow group Compute-Admins to manage instance-family in compartment Production

Use Case

Ideal for infrastructure and virtualization teams.

3. Network Administrators

Allow group Network-Admins to manage virtual-network-family in compartment Production

Use Case

Allows management of VCNs, subnets, route tables, gateways, and NSGs.

4. Storage Administrators

Allow group Storage-Admins to manage object-family in compartment Production

Use Case

Manage Object Storage buckets and objects.

5. Database Administrators

Allow group DBAs to manage database-family in compartment Production

Use Case

Provides full management of Oracle Database resources.

6. Load Balancer Administrators

Allow group LB-Admins to manage load-balancers in compartment Production

Use Case

Configure listeners, backend sets, certificates, and routing rules.

7. Security Team

Allow group Security-Team to read audit-events in tenancy

Use Case

Allows the security team to review audit logs without modifying cloud resources.

8. Cloud Guard Administrators

Allow group CloudGuard-Admins to manage cloud-guard-family in tenancy

Use Case

Manage Cloud Guard targets, detector recipes, responder recipes, and security findings.

9. Monitoring Administrators

Allow group Monitoring-Team to manage metrics in compartment Production

Use Case

Create alarms and monitor OCI resources.

10. Logging Administrators

Allow group Logging-Team to manage log-groups in compartment Production

Use Case

Manage OCI Logging configuration and log retention.

Key Takeaway

Rather than assigning broad permissions such as manage all-resources, create dedicated administrator groups for each operational area. This approach improves security, simplifies auditing, and aligns with the Principle of Least Privilege.

Advanced OCI IAM Policy Examples

As OCI environments grow, administrators often need more granular access control. The following examples demonstrate policies commonly used in enterprise environments to support automation, security, and operational efficiency.

11. Bastion Administrators

Allow group Bastion-Admins to manage bastion-family in compartment Production

Use Case

Allows administrators to create, manage, and terminate OCI Bastion sessions without granting unnecessary permissions to other cloud resources.

12. Vault Administrators

Allow group Vault-Admins to manage vault-family in compartment Security

Use Case

Allows security teams to manage encryption keys, secrets, certificates, and key rotation.

13. DNS Administrators

Allow group DNS-Admins to manage dns in tenancy

Use Case

Manage public and private DNS zones and DNS records.

14. Block Volume Administrators

Allow group Storage-Team to manage volume-family in compartment Production

Use Case

Manage Block Volumes, backups, cloning, and volume groups.

15. Resource Manager (Terraform)

Allow group Terraform-Admins to manage orm-family in tenancy

Use Case

Allows Infrastructure as Code deployments using OCI Resource Manager.

16. Functions Developers

Allow group Functions-Team to manage functions-family in compartment Development

Use Case

Deploy and manage OCI Functions for serverless applications.

17. Dynamic Groups

Instead of granting permissions directly to users, OCI can assign permissions to cloud resources through Dynamic Groups.

Example:

Allow dynamic-group AppServers to read buckets in compartment SharedServices

Use Case

Allows Compute instances to securely access Object Storage without storing credentials.

18. Object Storage Read-Only

Allow group Backup-Team to read buckets in compartment Backup

Use Case

Ideal for backup validation teams that only need to verify stored backup files.

19. Cross-Compartment Access

Allow group Monitoring-Team to read metrics in tenancy

Use Case

Allows centralized monitoring teams to collect metrics from multiple compartments without requiring full administrative privileges.

20. Security Operations

Allow group SOC-Team to read all-resources in tenancy

Use Case

Provides Security Operations teams with visibility across the tenancy while preventing resource modifications.

Common IAM Mistakes

Even experienced OCI administrators make mistakes when designing IAM policies. The most common include:

• Granting manage all-resources unnecessarily.
• Creating policies directly in the root compartment.
• Ignoring the Principle of Least Privilege.
• Not reviewing IAM policies periodically.
• Giving permanent administrative access.
• Mixing production and development permissions.
• Not using Dynamic Groups for automation.
• Forgetting to enable Multi-Factor Authentication (MFA).
• Using generic administrator accounts.
• Poorly documenting IAM policies.

Best Practices

To maintain a secure and scalable OCI environment:

• Create dedicated groups for each administrative role.
• Apply Least Privilege by default.
• Organize resources using logical compartments.
• Use Dynamic Groups for OCI services.
• Protect privileged users with MFA.
• Review IAM policies regularly.
• Remove unused users and groups.
• Document every policy.
• Test policies in non-production before deployment.
• Audit permissions on a regular basis. 

Building a Secure and Scalable IAM Strategy

Creating IAM policies is not simply about granting permissions—it is about designing a security model that protects your Oracle Cloud Infrastructure environment while allowing administrators, developers, and applications to perform their tasks efficiently.

As OCI environments grow, IAM policies become increasingly important for maintaining governance, reducing operational risk, and supporting compliance requirements. A well-designed IAM strategy should be easy to understand, simple to maintain, and scalable as new services and teams are introduced.

Rather than creating broad permissions that apply to the entire tenancy, organizations should organize resources into logical compartments, create dedicated groups for each administrative role, and regularly review policies to ensure they continue to meet business and security requirements.

Remember that IAM is not a one-time configuration. It should evolve alongside your cloud environment through periodic reviews, audits, and continuous improvements.

Key Takeaways

The most successful OCI environments are not those with the largest number of cloud services—they are the environments built on a strong security foundation.

A well-designed IAM strategy provides:

• Better security
• Simpler administration
• Improved governance
• Reduced operational risk
• Easier compliance
• Greater scalability
• Better user experience

Investing time in designing clean, well-structured IAM policies today can prevent security incidents and administrative challenges in the future.

Final Thoughts

Identity and Access Management is the foundation of every Oracle Cloud Infrastructure deployment. Every Compute instance, database, network, storage service, and cloud-native application depends on correctly configured IAM policies to ensure secure and controlled access.

The examples presented in this cookbook are intended to serve as practical references that administrators can adapt to their own environments. Rather than relying on overly permissive policies, organizations should focus on creating reusable, well-documented access models that follow Oracle Cloud security best practices.

Whether you're deploying your first OCI tenancy or managing a large enterprise environment, mastering IAM policies will help you build a cloud platform that is secure, scalable, and ready for future growth.

About the Author

João Teixeira

Oracle ACE Apprentice

Oracle EPM & OCI Infrastructure Specialist

JLTDS Oracle Tech

Sharing practical guides, best practices, and real-world solutions for Oracle Cloud Infrastructure (OCI) and Oracle Enterprise Performance Management (EPM).