1Z0-1104-25 Question 29
Single answerYou are the lead security administrator for a company using Oracle Cloud Infrastructure (OCI). You need to ensure that developers can create and manage Compute instances, but only within the 'DevCompartment' compartment. Which is the best way to achieve least privilege in this scenario?
- A
Create a dynamic group for all developer user accounts and write a policy allowing the dynamic group to manage all resources in the tenancy.
- B
Create a group named 'devGroup,' add the developers to it, and write a policy: 'Allow group devGroup to manage instance-family in compartment DevCompartment.'
- C
Create a group named 'devGroup,' add the developers to it, and write a policy: 'Allow group devGroup to manage all-resources in tenancy.'
- D
Create a user for each developer, give each user the Administrator policy, and then restrict them to the DevCompartment.
Show answer and explanation
Correct answer: B
Explanation
IAM best practices in OCI recommend using groups to manage user permissions at a fine-grained level. By writing a policy allowing a group to 'manage instance-family in compartment DevCompartment,' you ensure developers can perform all actions related to Compute instances in only that compartment, aligning with least privilege. For additional references, see the Oracle Cloud Infrastructure Identity and Access Management documentation, which outlines how to properly scope policies and assign permissions to groups.
- A. Incorrect.
Incorrect. Dynamic groups in OCI are generally used to group resources (like instances) based on specific conditions, not human users. Also, granting access to 'all resources in the tenancy' violates least privilege principles.
- B. Correct.
Correct. The standard best practice is to create an IAM group for the developers, place them in that group, and write a policy specifically granting only the necessary privileges (in this case, managing Compute instances) in the appropriate compartment ('DevCompartment'). This ensures least privilege.
- C. Incorrect.
Incorrect. Granting manage privileges on 'all-resources' in the entire tenancy exceeds the scope of required developer access and violates the principle of least privilege.
- D. Incorrect.
Incorrect. Assigning each developer the Administrator policy is overly broad and provides access to resources well beyond the required Compute services in 'DevCompartment'.