1Z0-1104-25 Question 46
Single answerYou have a new project that requires the 'ReportCreators' IAM group to access objects in an Object Storage bucket named 'MonthlyReports' within the 'FinanceCompartment.' They need to download objects for analysis but must not be able to upload or delete objects. Which of the following policy statements correctly grants these required permissions?
- A
allow group ReportCreators to read object-family in compartment FinanceCompartment
- B
allow group ReportCreators to manage object-family in compartment FinanceCompartment
- C
allow group ReportCreators to use object-family in compartment FinanceCompartment
- D
allow group ReportCreators to read objectstorage-buckets in compartment FinanceCompartment
Show answer and explanation
Correct answer: A
Explanation
To grant read-only access to Object Storage, you use 'read object-family' in a policy statement targeted at the appropriate compartment. This aligns with the least privilege principle. For more information, refer to the Oracle Cloud Infrastructure IAM Policy Reference documentation (https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policy_language.htm).
- A. Correct.
Option 1 is correct. 'allow group ReportCreators to read object-family in compartment FinanceCompartment' grants list and read access to the objects in the bucket without allowing uploads or deletions. This satisfies the read-only requirement.
- B. Incorrect.
Option 2 is incorrect because 'manage object-family' allows the group to create, update, and delete buckets and objects, which exceeds the required read-only permission.
- C. Incorrect.
Option 3 is incorrect because 'use object-family' may allow some operational actions (such as attaching resource to another service) but does not guarantee proper read access to objects. It also potentially allows more than mere retrieval of objects.
- D. Incorrect.
Option 4 is incorrect because 'read objectstorage-buckets' only provides read access to bucket metadata, not the objects inside the bucket. It does not fulfill the requirement to download objects.