1Z0-1067-25 Question 112
Single answerYour organization has a new compartment named 'ProjectAlpha' in Oracle Cloud Infrastructure (OCI). The ProjectAlpha_Developers group needs to create, update, and terminate compute instances in that compartment without having access to manage networking or other types of resources. Which policy statement best enforces the principle of least privilege in this scenario?
- A
- Allow group ProjectAlpha_Developers to manage all-resources in compartment ProjectAlpha
- B
- Allow group ProjectAlpha_Developers to manage instance-family in compartment ProjectAlpha
- C
- Allow group ProjectAlpha_Developers to inspect all-resources in compartment ProjectAlpha
- D
- Allow group ProjectAlpha_Developers to manage instance-family in tenancy
Show answer and explanation
Correct answer: B
Explanation
In OCI IAM, �manage instance-family� is the correct verb to grant the necessary permissions to create, update, and delete compute instances while restricting access to other resource types. Granting broader permissions (e.g., manage all-resources) or applying permissions at the tenancy level exposes more than the minimum required, contrary to least-privilege principles. Refer to OCI documentation on writing IAM policies for further guidance on applying these permissions at a granular level.
- A. Incorrect.
Option 1 is incorrect because it grants privileges to manage all resources in the compartment, including networking, storage, and other services, which violates least-privilege principles.
- B. Correct.
Option 2 is correct. The �manage instance-family� verb in OCI policies allows creation, update, and termination of instances without broader permissions, thus aligning with least-privilege best practices.
- C. Incorrect.
Option 3 is incorrect because �inspect� only allows viewing resources without the ability to create or update them. The developers would not be able to create or modify instances with this policy.
- D. Incorrect.
Option 4 is incorrect because it applies to the entire tenancy rather than just ProjectAlpha, providing more access than necessary and violating least-privilege guidelines.