1Z0-1104-25 Question 47
Single answerYour organization manages two OCI compartments: 'Development' for testing and 'Production' for live workloads. You have a group called DevOps that needs to fully manage compute instances (create, update, delete) only in the Development compartment, while requiring read-only access to compute instances in the Production compartment. Which IAM policy statements best meet these requirements?
- A
A) Allow group DevOps to manage instance-family in compartment Development and Allow group DevOps to read instance-family in compartment Production
- B
B) Allow group DevOps to use instance-family in compartment Development and Allow group DevOps to read instance-family in compartment Production
- C
C) Allow group DevOps to manage all-resources in compartment Development and Allow group DevOps to manage instance-family in compartment Production
- D
D) Allow group DevOps to read instance-family in compartment Development and Allow group DevOps to manage instance-family in compartment Production
Show answer and explanation
Correct answer: A
Explanation
In Oracle Cloud Infrastructure IAM, 'manage' on 'instance-family' grants create, update, and delete permissions for compute resources, while 'read' provides view-only access. According to OCI best practices, granting the least privilege necessary ensures better security. Allowing DevOps to manage compute resources in Development fulfills their operational needs, and providing 'read' in Production prevents unintended changes to critical live environments. Refer to the official OCI IAM documentation for more details on supported verbs (inspect, read, use, manage) and resource types such as 'instance-family.'
- A. Correct.
Option A is correct because 'manage' on the instance-family in the Development compartment gives DevOps permissions to create, modify, and delete compute instances, meeting the management requirement. 'read' on instance-family in the Production compartment restricts DevOps to viewing compute instances without granting create or delete privileges.
- B. Incorrect.
Option B grants the group only 'use' privileges for the Development compartment, which allows them to work with existing instances but not necessarily create or delete them. This does not fully meet the requirement to 'manage' resources in Development.
- C. Incorrect.
Option C grants DevOps full manage privileges in both compartments (Development and Production) because 'manage instance-family' in Production allows more than read-only access. This violates the requirement that DevOps should only have read privileges in Production.
- D. Incorrect.
Option D flips the permissions, allowing only read in Development and manage in Production, which is the opposite of the stated requirements.