1Z0-1067-25 Question 96
Single answerYou have contracted an external partner to manage compute instances in a dedicated compartment within your Oracle Cloud Infrastructure (OCI) tenancy. They also need read-only access to the object storage buckets in the same compartment but must not be able to view or manage resources in other compartments. Which approach best satisfies this requirement while adhering to OCI IAM best practices?
- A
A. Create a new OCI user for each partner user. Assign each user to the Administrators group and use policies to grant read-only access to object storage in your tenancy.
- B
B. Create a new group for the partner. Add all partner users to this group, then write policies restricting manage permissions to the compute instance family and read-only permissions to the object family in the relevant compartment.
- C
C. Rely on the Default Security List to automatically grant partner users permission to manage compute and read object storage.
- D
D. Configure a federation with an external identity provider, granting partner users Administrator privileges across the tenancy for simplified management.
Show answer and explanation
Correct answer: B
Explanation
In OCI, you should always apply the principle of least privilege by granting only the necessary rights. The appropriate solution is to create a separate group for the partner� users and craft policies that allow managing the compute instance family and read-only access to object storage in the target compartment. For detailed guidance, refer to the Oracle Cloud Infrastructure Identity and Access Management documentation, specifically the sections on groups and policy statements (https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policyreference.htm). This ensures that external partner users have only the permissions required for their tasks without impacting other resources in your tenancy.
- A. Incorrect.
Option A: Incorrect. Placing external partner users directly in the Administrators group gives them root-level permissions in the tenancy, which contradicts the requirement of limiting their access only to specific resources in one compartment.
- B. Correct.
Option B: Correct. Creating a dedicated group for the partner and assigning targeted policies (manage compute and read object storage) within a single compartment is the recommended approach for granting precise, compartment-scoped access.
- C. Incorrect.
Option C: Incorrect. The Default Security List relates to networking (e.g., ingress/egress rules) rather than IAM. It does not grant or control permissions to manage compute or object storage resources.
- D. Incorrect.
Option D: Incorrect. While configuring federation is valid for external identity providers, granting Administrator privileges across the tenancy violates the principle of least privilege and gives the partner unnecessary access.