1Z0-1072-25 Question 289
Single answerYour team needs to give an external partner read-only access to application logs stored in an OCI Object Storage bucket for troubleshooting, while preventing them from creating or deleting objects. Which OCI Identity and Access Management approach best ensures the principle of least privilege for these external developers?
- A
Create a new user for each external developer, assign them to a group with a policy allowing them to manage objects in the compartment containing the logs.
- B
Create a new user for the external developers, place them in a group with a policy allowing them to read objects in the compartment that contains the logs.
- C
Use a dynamic group that matches the external developers� email domain, and grant them the ability to manage buckets in the tenancy root.
- D
Enable the default policy that allows all users to read objects in any bucket across the tenancy.
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure (OCI), granting a group the permission to read objects in a specified compartment ensures the external developers can see the logs without being able to create, modify, or delete them. This setup follows the principle of least privilege by limiting the scope of allowed actions and avoiding overreach. Refer to OCI documentation on IAM Policies for details on crafting precise policy statements such as: 'Allow group
- A. Incorrect.
Option 1 is incorrect because 'manage objects' includes write, delete, and other permissions beyond read access, violating the principle of least privilege.
- B. Correct.
Option 2 is correct. Creating a dedicated user and group, then using a policy that specifically grants read-only permissions to the logs compartment, aligns with the principle of least privilege.
- C. Incorrect.
Option 3 is incorrect. Dynamic groups are typically used for OCI resources like compute instances, not user identities. Furthermore, 'manage buckets' is overly permissive.
- D. Incorrect.
Option 4 is incorrect. Allowing all users to read objects is overly broad and does not limit access to only the external partner.