OCC Policies and Permissions
Create IAM policies to control who has access to OCC metric data, and to control the type of access for each group of users. Currently, OCC doesn't have any resources.
As OCC has only metric data, there is no way to restrict access based on resource IDs. You can use the family name
control-center-family and the resource type
control-center-metrics to restrict access to the metric data overall. See Policy Examples section for details.
The users in the
Administrators group have access to all the OCC resources and metric data. Create policies for users to have necessary rights to the OCC metric data.
If you’re new to IAM policies, see Getting Started with Policies.
For a complete list of Oracle Cloud Infrastructure policies, see policy reference.
This section explains the following topics:
To use OCC, create a policy that grants the following permissions to the user or groups that interact with the service accordingly.
|Resource Type||Action Assigned to User||Permissions|
|control-center-family||Includes all the Control Center metrics and any future member resources in one family.|
|control-center-metrics||Read OCC metric namespaces, metric names, and metric values.||
You can use variables to add conditions to a policy.
OCI Control Center supports the following variables:
- Entity: Oracle Cloud Identifier (OCID)
- String: Free-form text.
- List: List of Entity or String.
Variables are lowercase and hyphen-separated. For example,
name must be unique, and
display-name is the description.
Required variables are supplied by the OCI Control Center service for every request. Automatic variables are supplied by the authorization engine (either service-local with the SDK for a thick client, or on the Identity data plane for a thin client).
||Entity (OCID)||The OCID of the primary resource for the request.|
||String||The operation ID (for example,
||String||The resource kind name of the primary resource for the request.|
||Entity (OCID)||The OCID of the requesting user.|
||List of entities (OCIDs)||The OCIDs of the groups the requesting user is in.|
||String||The name of the compartment specified in
||Entity (OCID)||The OCID of the target tenant ID.|
||String||The value of each tag on a group of which the principal is a member.|
||String||The value of each tag on the compartment that contains the principal.|
||String||The value of each tag on the target resource. (Computed based on tagSlug supplied by service on each request.)|
||String||The value of each tag on the compartment that contains the target resource. (Computed based on tagSlug supplied by service on each request.)|
Here's a list of available sources for the variables:
- Request: Comes from the request input.
- Derived: Comes from the request.
- Stored: Comes from the service, retained input.
- Computed: Computed from service data.
Details for Verb + Resource Type Combinations
Identify the permissions and API operations covered by each verb for Control Center resources.
The level of access is cumulative as you go from
manage. A plus sign
(+) in a table cell indicates incremental access when compared to the preceding cell,
no extra indicates no incremental access.
For information about granting access, see Permissions.
This table lists the permissions and API operations covered by each verb, for the
||Metrics are grouped into namespaces.
List all the namespaces.
Get the list of metrics in a specific namespace.
||Get data (values) for a metric in a specific namespace.|
Permissions Required for Each API Operation
The following table lists the API operations in a logical order.For more information, see Permissions.
|API Operation||Permissions Required to Use the Operation|
Creating a Policy
Here's how you create a policy in the Console:
- Open the navigation menu and click Identity & Security. Under Identity, click Policies.
- In the Policies page, click Create Policy.
- In the Create Policy panel, enter a name, description for the policy, and specify the compartment where you want to create the policy.
Under Policy Builder, click the Show manual editor switch to enable the editor.
Enter a policy rule in the specified format. See policy examples in OCC Policies and Permissions.
- Click Create.
For instructions on how to create and manage policies using the Console or API, see Managing Policies.
OCC policies are required for viewing the OCC metric data.
For instructions to create policies using the Console, see Creating a Policy.
For more details about the syntax, see Policy Syntax.
Following policy examples are provided:
Allows the group to list metrics and read metric data.
Allow group <group name> to use control-center-metrics in tenancy
OCC Family Policies
Create this policy in your tenancy, to allow a user or to read all the metrics in OCC:
Allow <user> to read control-center-family in tenancy