1Z0-1067-25 Question 6
Select 2Your organization is deploying a multi-tier application using Oracle Cloud Infrastructure (OCI) Resource Manager with Terraform. Different teams have created separate compartments for production and development resources. However, when you run your Resource Manager job, it fails with authorization errors indicating that required operations are not permitted in the target compartments. You need to fix these errors so you can deploy resources across multiple compartments in a single Terraform run. Which two actions should you take to resolve this issue?
- A
- Update or create appropriate IAM policies in the root compartment granting the Resource Manager service the ability to manage resources in the target compartments.
- B
- Configure your Resource Manager Stack to use separate tenancy IDs for each compartment to avoid permission conflicts.
- C
- Specify the compartment OCID for each resource in the Terraform configuration (e.g., using the 'compartment_id' attribute) to ensure resources are created in the intended compartments.
- D
- Add a local Terraform variable file that only includes the target_compartment IDs, so Resource Manager does not require cross-compartment access.
Show answer and explanation
Correct answers: A, C
Explanation
To deploy and manage OCI resources across multiple compartments using Resource Manager, you must grant Resource Manager the appropriate IAM policies and specify the correct compartment IDs in your Terraform configuration. Refer to the Oracle Cloud Infrastructure documentation on Resource Manager and IAM policies (https://docs.oracle.com/en-us/iaas/Content/ResourceManager/Concepts/resourcemanager.htm and https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm) for detailed guidance on setting up cross-compartment access.
- A. Correct.
Option 1: CORRECT. The Resource Manager service (or the user/group running it) must have explicit IAM permissions to create and manage resources in different compartments. Creating or updating a policy in the root compartment to allow these operations is essential. Without proper IAM policies, Resource Manager is blocked from acting within the target compartments.
- B. Incorrect.
Option 2: INCORRECT. A single tenancy ID is used for your overall OCI tenancy. You do not configure multiple tenancy IDs for separate compartments. Compartments are logical subdivisions within the same tenancy. Thus, using separate tenancy IDs is not a valid approach.
- C. Correct.
Option 3: CORRECT. In your Terraform configuration, each resource must specify the correct target compartment (for example, using 'compartment_id' = var.prod_compartment_ocid) to ensure that the resource is deployed where you intend. This step is crucial when deploying into multiple compartments.
- D. Incorrect.
Option 4: INCORRECT. Simply storing compartment IDs in a local variable file does not eliminate the need for Resource Manager to have permissions to manage resources across compartments. It also does not replace the requirement to define the correct compartment for each resource in Terraform.