1Z0-1067-25 Question 113
Single answerYou have a DevOps group that needs the ability to create, update, and delete Compute instances only within their designated compartment. They should not be able to access or modify resources such as networking configurations, block volumes, or buckets. Which policy statement enforces the principle of least privilege for this scenario?
- A
A. Allow group DevOps to manage all-resources in tenancy
- B
B. Allow group DevOps to manage instance-family in compartment DevCompartment
- C
C. Allow group DevOps to read all-resources in compartment DevCompartment
- D
D. Allow group DevOps to manage networking and instance-family in tenancy
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure, carefully scoping policies is key to enforcing least privilege. By granting 'manage instance-family' only in the relevant compartment, you ensure the DevOps group can manage Compute instances without acquiring unnecessary permissions for other resources or compartments. For more details, refer to the Oracle Cloud Infrastructure documentation on writing IAM policies to control resource access.
- A. Incorrect.
Option A is incorrect because granting 'manage all-resources in tenancy' exceeds the minimal access required. It allows managing all resources across the entire tenancy, which violates the principle of least privilege.
- B. Correct.
Option B is correct. Granting 'manage instance-family in compartment DevCompartment' restricts the group to only perform instance-related actions in the specified compartment, which aligns with least-privilege principles.
- C. Incorrect.
Option C is incorrect because 'read all-resources' only allows viewing resources but not creating or deleting Compute instances. It fails to provide the necessary permissions for instance lifecycle management.
- D. Incorrect.
Option D is incorrect because it allows the group to manage both networking and instances across the entire tenancy, which is broader than necessary and violates least-privilege guidelines.