1Z0-1104-25 Question 43
Single answerYou have been asked to create a policy for a new group named AppTeamComputeAdmins. They need to provision and manage compute instances in the 'Dev' compartment. However, they must not be able to modify the network configuration or gain any privileges outside of instance management. Which IAM policy statement would best fulfill this requirement?
- A
A. Allow group AppTeamComputeAdmins to manage compute-family in compartment Dev
- B
B. Allow group AppTeamComputeAdmins to use instance-family in compartment Dev
- C
C. Allow group AppTeamComputeAdmins to manage instance-family in compartment Dev
- D
D. Allow group AppTeamComputeAdmins to manage all-resources in compartment Dev
Show answer and explanation
Correct answer: C
Explanation
To adhere to least-privilege principles, it is important to grant only the access required for a given role. The 'instance-family' permission enables creating, starting, stopping, and deleting compute instances without granting networking or other resource privileges. Refer to the official Oracle Cloud Infrastructure documentation on Policy Reference (https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/policystatements.htm) for detailed information on the available verbs and resource-family definitions.
- A. Incorrect.
Option A: 'manage compute-family' would give broad privileges, including some networking-related operations tied to the compute-family. This goes beyond just managing the lifecycle of compute instances and may grant more access than required.
- B. Incorrect.
Option B: 'use instance-family' allows viewing and attaching existing resources, but it does not permit creating or deleting instances. This doesn't satisfy the need to provision and fully manage compute instances.
- C. Correct.
Option C: 'manage instance-family in compartment Dev' is correct because it grants the necessary privileges to create, update, and delete instances without extending access to other resources such as networking. This matches the requirements exactly.
- D. Incorrect.
Option D: 'manage all-resources in compartment Dev' is overly permissive. It would allow the group to manage every type of resource, including networking, storage, and more, which exceeds the stated requirements.