1Z0-1072-25 Question 308
Select 2You have created a new group called 'DataScienceTeam' in Oracle Cloud Infrastructure (OCI) and want to grant them read-only access to an existing Object Storage bucket named 'MarketingData' in the 'Marketing' compartment. They should be able to view the bucket metadata and download objects, but must not be able to create or delete objects or the bucket. Which two IAM policy statements would satisfy this requirement?
- A
Allow group DataScienceTeam to read objectstorage-buckets in compartment Marketing where target.bucket.name='MarketingData'
- B
Allow group DataScienceTeam to read objectstorage-objects in compartment Marketing where target.bucket.name='MarketingData'
- C
Allow group DataScienceTeam to manage objectstorage-buckets in compartment Marketing where target.bucket.name='MarketingData'
- D
Allow group DataScienceTeam to read objectstorage-objects in tenancy
Show answer and explanation
Correct answers: A, B
Explanation
To provide read-only access to a specific bucket, you should grant both 'read' privileges to the bucket and the objects within it. Using 'manage' exceeds read-only permissions, and granting access at the tenancy level is too broad. For more details, refer to the 'Managing Policies' section in the Oracle Cloud Infrastructure Identity and Access Management documentation.
- A. Correct.
Correct. This statement grants read access (view metadata) on the 'MarketingData' bucket without permitting modifications. Specifying where target.bucket.name='MarketingData' limits permissions strictly to that one bucket.
- B. Correct.
Correct. This statement grants read access to the objects in the 'MarketingData' bucket. In OCI, you typically need separate statements to read bucket metadata and read objects. This ensures the group can download objects but not modify or delete them.
- C. Incorrect.
Incorrect. The 'manage' verb grants full control, including creating and deleting buckets, which exceeds the stated requirement of read-only access.
- D. Incorrect.
Incorrect. Granting read object access at the tenancy level means the group can read objects in any bucket throughout the tenancy. This violates the principle of least privilege and does not restrict access to the 'MarketingData' bucket only.