1Z0-1072-25 Question 311
Single answerYour organization has created a new compartment named 'Development' to isolate testing resources. You want users in the 'DevTeam' group to have full control over Compute instances in this compartment, but no permissions in other compartments. Which IAM policy statement satisfies this requirement?
- A
A) Allow group DevTeam to manage all-resources in compartment Development
- B
B) Allow group DevTeam to manage instance-family in compartment Development
- C
C) Allow group DevTeam to use instance-family in tenancy
- D
D) Allow group DevTeam to manage instance-family in root
Show answer and explanation
Correct answer: B
Explanation
In Oracle Cloud Infrastructure IAM, writing effective policies requires specifying the correct resource family, action level (inspect, use, manage), and compartment scope. The policy 'Allow group DevTeam to manage instance-family in compartment Development' precisely grants the DevTeam group full control over instances in the Development compartment only, aligning with best practices and the principle of least privilege. For more details, refer to the Oracle Cloud Infrastructure documentation on writing policies (https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policies.htm).
- A. Incorrect.
Option A: This policy statement grants broad permissions across all resources (including networking, storage, etc.) in the Development compartment. Although it covers Compute, it goes beyond just instances and may violate the principle of least privilege. Hence it's not the most appropriate limiting policy.
- B. Correct.
Option B: This policy statement precisely grants the DevTeam group full management capabilities (launch, update, terminate, etc.) over Compute instances in the Development compartment. It limits permissions to the instance-family, fulfilling the requirement of controlling only Compute resources in this specific compartment. This is the correct answer.
- C. Incorrect.
Option C: Using 'use instance-family' at the tenancy level grants the DevTeam group limited operations on instances across the entire tenancy. This undermines the goal of scoping access solely to the Development compartment and also may exceed the intended scope for all compartments. Therefore, it's incorrect.
- D. Incorrect.
Option D: Specifying 'root' (or the root compartment) for managing instance-family essentially gives the DevTeam group the same broad access throughout all compartments as the root compartment includes all subcompartments. This fails the requirement of restricting the group to the Development compartment.