1Z0-1072-25 Question 298
Select 2You are an OCI administrator for a company that has created a new compartment called 'ProjectsCompartment' to host multiple upcoming project resources. The security team requires that only the group 'ProjectDevelopers' can create and manage resources in 'ProjectsCompartment.' Additionally, a build pipeline running on a compute instance needs to manage these project resources. Which TWO steps must you perform in Oracle Cloud Infrastructure Identity and Access Management (IAM) to meet these requirements?
- A
Create a policy at the tenancy level granting the 'ProjectDevelopers' group manage permission on 'ProjectsCompartment.'
- B
Add the build pipeline� compute instance to a dynamic group and set up a policy granting that dynamic group permissions on 'ProjectsCompartment.'
- C
Create a policy in 'ProjectsCompartment' authorizing the 'ProjectDevelopers' group to manage all resources in the root compartment.
- D
Assign the 'ProjectDevelopers' group directly to the compute instance� API key configuration.
Show answer and explanation
Correct answers: A, B
Explanation
To implement fine-grained access with OCI IAM, you create a policy that specifically references a user group (in this case 'ProjectDevelopers') and grants privileges in the target compartment ('ProjectsCompartment'). For resources (such as a build pipeline) running on a compute instance, you create a dynamic group to include that instance and then define a policy granting the dynamic group the required permissions in the compartment. Refer to the Oracle Cloud Infrastructure documentation (Identity and Access Management, Compartments, and Dynamic Groups) for details on best practices for configuring policies and access control.
- A. Correct.
Correct. A policy at the tenancy level or at an appropriate higher compartment level grants 'ProjectDevelopers' the privileges needed in 'ProjectsCompartment.' This is the standard way to allow a group to manage resources in a specific compartment.
- B. Correct.
Correct. A compute instance cannot directly be assigned a group membership, but you can include it in a dynamic group and then create a policy allowing that dynamic group to manage resources in 'ProjectsCompartment.' This covers your build pipeline use case.
- C. Incorrect.
Incorrect. A policy within 'ProjectsCompartment' would not authorize the 'ProjectDevelopers' group to manage resources in the root compartment. Additionally, this approach reverses the intended scope. You must define a policy at or above the compartment where you want to grant permissions, referencing the correct group and the target compartment, not the other way around.
- D. Incorrect.
Incorrect. An API key configuration on a compute instance does not involve direct assignment of an OCI group to that instance. Access for an instance is typically configured using dynamic groups and instance principals, not by linking user groups to compute instances.