1Z0-1067-25 Question 95
Select 2Your organization runs an e-commerce application on Oracle Cloud Infrastructure (OCI). The application is deployed on a compute instance in the 'Ecommerce_Apps' compartment, and it needs read-only access to a private Object Storage bucket in the 'Asset_Storage' compartment. Following OCI best practices, which two steps must you take to grant the application the required permissions?
- A
A. Create a dynamic group that includes the compute instance, then define a policy in the 'Asset_Storage' compartment granting the dynamic group read access to the bucket.
- B
B. Create a pre-authenticated request (PAR) for the entire bucket and share it with the compute instance, ensuring unrestricted read access.
- C
C. Enable public access on the bucket in the 'Asset_Storage' compartment so that the compute instance can directly read objects without authentication.
- D
D. Create a dynamic group for the compute instance, then define a policy in the root compartment granting the dynamic group read access to the bucket in the 'Asset_Storage' compartment.
Show answer and explanation
Correct answers: A, D
Explanation
In Oracle Cloud Infrastructure, the recommended way to provide a compute instance secure, least-privileged access to Object Storage is to use instance principals and IAM policies. First, you create a dynamic group that includes the instance (based on matching rules, such as the instance OCID). Then you write a policy that grants necessary access to that dynamic group. You can attach this policy either to the compartment hosting the resource (in this case, 'Asset_Storage') or to the root compartment (for broader organizational consistency). Using pre-authenticated requests or publicly accessible buckets introduces potential security risks and should be avoided in production. See OCI documentation on Identity and Access Management for more details on configuring dynamic groups and policies.
- A. Correct.
A. CORRECT. Creating a dynamic group referencing the compute instance and then placing a policy at the compartment level (where the bucket resides) is a valid approach. The policy can allow the dynamic group to read object storage objects in that compartment.
- B. Incorrect.
B. INCORRECT. A pre-authenticated request (PAR) bypasses IAM controls and can expose the bucket to unintended access. It's typically used for temporary or public object sharing, not for an internal application requiring persistent read access.
- C. Incorrect.
C. INCORRECT. Making the bucket public openly exposes its contents. This conflicts with best practices, which recommend assigning the minimum privileges needed through IAM policies and dynamic groups.
- D. Correct.
D. CORRECT. Policies can also be placed at the tenancy (root) level granting access to resources in a specific compartment. Defining a policy in the root compartment to allow the dynamic group read access to the bucket in the 'Asset_Storage' compartment follows OCI best practices for resource compartment isolation.