1Z0-1072-25 Question 292
Single answerYour analytics team runs a data processing application on an Oracle Cloud Infrastructure (OCI) Compute instance located in the 'ProdCompartment'. This application needs to write log files daily to an Object Storage bucket named 'AnalyticsLogsBucket' in the 'LogCompartment'. You do not wish to manage or rotate user credentials on the instance. Which approach should you take to allow the instance to automatically write logs to the Object Storage bucket with minimal management overhead?
- A
Create a dedicated IAM user for the instance, add it to a privileged group, and store the generated API key on the instance to access the bucket.
- B
Create a dynamic group that includes the instance based on its OCID, then grant the dynamic group permission to write objects to the 'AnalyticsLogsBucket' via an IAM policy.
- C
Implement federation with an external identity provider, requiring the instance to authenticate with the external identity service first before pushing logs to the bucket.
- D
Deploy a Function in Oracle Functions with the necessary credentials, and have the instance trigger this Function to upload logs on its behalf.
Show answer and explanation
Correct answer: B
Explanation
By creating a dynamic group for your Compute instance and granting it the necessary Object Storage permissions, you enable the instance to securely and directly write objects to the 'AnalyticsLogsBucket' without manual credential management. This leverages the resource principal concept where OCI resources can authenticate using instance metadata rather than user credentials. For more details, refer to the OCI documentation on Dynamic Groups and Policies: https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm
- A. Incorrect.
Incorrect. Creating a dedicated IAM user and storing the API key on the instance introduces additional overhead and security risks. Keys must be rotated and securely managed, which the scenario aims to avoid.
- B. Correct.
Correct. Dynamic groups allow OCI resources (like Compute instances) to be placed in functional groups based on matching rules. You can then apply an IAM policy granting those resources permission to write to the bucket without managing user credentials.
- C. Incorrect.
Incorrect. While federation is valid for user access, it is not required for an OCI Compute instance. The scenario specifically aims to avoid user credential management, and dynamic groups offer a more direct solution for resource access.
- D. Incorrect.
Incorrect. Although using Oracle Functions to handle credentials might work, it� more complex than necessary for this scenario. The simplest approach is to implement a dynamic group and a corresponding policy for direct access.