Managed Access Policies

Create Oracle Cloud Infrastructure Identity and Access Management (IAM) policies to control who has access to Oracle Managed Access resources, and the type of access for each group of users.

By default, only users in the Administrators group have access to all Managed Access resources. If you're new to IAM policies, see Getting Started with Policies. The supported Oracle Managed Access policies use the term lockbox to see an Oracle Managed Access resource.

For a complete list of all policies in Oracle Cloud Infrastructure, see the Policy Reference.

Details for Oracle Managed Access

This topic covers details for writing policies to control access to the Managed Access service.

Resource-Types

The following resource types are related to Oracle Managed Access.

This topic covers details for writing policies to control access to Managed Access resources.


Resource Type	Permissions
`lockboxes`	`LOCKBOXES_INSPECT` `LOCKBOXES_READ` `LOCKBOXES_CREATE` `LOCKBOXES_UPDATE` `LOCKBOXES_DELETE` `LOCKBOXES_MOVE`
`approval-templates`	`APPROVAL_TEMPLATES_INSPECT` `APPROVAL_TEMPLATES_READ` `APPROVAL_TEMPLATES_CREATE` `APPROVAL_TEMPLATES_UPDATE` `APPROVAL_TEMPLATES_DELETE` `APPROVAL_TEMPLATES_MOVE` `APPROVAL_TEMPLATES_ATTACH`
`access-requests`	`ACCESS_REQUESTS_INSPECT` `ACCESS_REQUESTS_READ` `ACCESS_REQUESTS_CREATE` `ACCESS_REQUESTS_ACTION_HANDLE`
`access-approvals`	`ACCESS_APPROVALS_INSPECT` `ACCESS_APPROVALS_READ` `ACCESS_APPROVALS_CREATE` `ACCESS_APPROVALS_ACTION_REVOKE` `ACCESS_APPROVALS_RETRIEVE`

A policy that uses <verb> lockbox-family is equal to writing a policy with a separate <verb> <resource-type> statement for each of the individual resource types.

Individual Resource-Types

lockbox

lockboxes

approval-template

approval-templates

access-request

access-requests

access-approval

access-approvals

Aggregate Resource-Types

lockbox-family

Supported Variables

Managed Access IAM policies support all the general policy variables.

For more information about general variables supported by Oracle Cloud Infrastructure services, see General Variables for All Requests.

Details for Verb + Resource-Type Combinations

View the permissions covered by each verb for Oracle Managed Access resources.

The level of access is cumulative as you go from inspect to read to use to manage.

A plus sign (+) in a table cell indicates incremental access when compared to the preceding cell, whereas no extra indicates no incremental access.

access-approval


Verbs	Permissions
inspect	`ACCESS_APPROVAL_INSPECT`
read	+ inspect `ACCESS_APPROVAL_READ`
use	+ read `ACCESS_APPROVAL_RETRIEVE`
manage	+ use `ACCESS_APPROVAL_CREATE` `ACCESS_APPROVAL_ACTION_REVOKE`

access-request


Verbs	Permissions
inspect	`ACCESS_REQUEST_INSPECT`
read	+ inspect `ACCESS_REQUEST_READ`
use	+ read
manage	+use `ACCESS_REQUEST_CREATE` `ACCESS_REQUEST_ACTION_HANDLE`

approval-template


Verbs	Permissions
inspect	`APPROVAL_TEMPLATE_INSPECT` `GROUP_INSPECT`: Use when you specify a group in the approval template. `USER_INSPECT`: Use when you specify a user in the approval template.
read	+ inspect `APPROVAL_TEMPLATE_READ`
use	+ read `APPROVAL_TEMPLATE_ATTACH`
manage	+ use `APPROVAL_TEMPLATE_CREATE` `APPROVAL_TEMPLATE_UPDATE` `APPROVAL_TEMPLATE_DELETE` `APPROVAL_TEMPLATE_MOVE`

lockbox


Verbs	Permissions
inspect	`LOCKBOX_INSPECT`
read	+ inspect `LOCKBOX_READ`
use	+ read `LOCKBOX_UPDATE`
manage	+ use `LOCKBOX_CREATE` `LOCKBOX_DELETE` `LOCKBOX_MOVE`

Permissions Required for Each API Operation

The following table lists the Managed Access API operations in a logical order, grouped by resource type.

For more information about permissions, see Managed Access policies.


Operations	Permissions
`ListLockboxes`	`LOCKBOX_INSPECT`
`CreateLockbox`	`LOCKBOX-CREATE`
`GetLockbox`	`LOCKBOX_READ`
`UpdateLockbox`	`LOCKBOX_UPDATE` `LOCKBOX_UPDATE & APPROVAL_TEMPLATE_ATTACH`
DeleteLockbox	`LOCKBOX_DELETE`
ChangeLockboxCompartment	`LOCKBOX_MOVE`
ListApprovalTemplates	`APPROVAL_TEMPLATE_INSPECT`
CreateApprovalTemplate	`APPROVAL_TEMPLATE_CREATE` `GROUP_INSPECT`: Use when you specify a group in the approval template. `USER_INSPECT`: Use when you specify a user in the approval template.
GetApprovalTemplate	`APPROVAL_TEMPLATE_READ`
UpdateApprovalTemplate	`APPROVAL_TEMPLATE_UPDATE` `GROUP_INSPECT`: Use when you specify a group in the approval template. `USER_INSPECT`: Use when you specify a user in the approval template.
DeleteApprovalTemplate	`APPROVAL_TEMPLATE_DELETE`
ChangeApprovalTemplateCompartment	`APPROVAL_TEMPLATE_MOVE`
ListAccessRequests	`ACCESS_REQUEST_INSPECT`
CreateAccessRequest	`ACCESS_REQUEST_CREATE`
GetAccessRequest	`ACCESS_REQUEST_READ`
HandleAccessRequest	`ACCESS_REQUEST_CREATE` `ACCESS_REQUEST_ACTION_HANDLE`
GetAccessMaterials	`ACCESS_REQUEST_CREATE`
ListAccessApproval	`ACCESS_APPROVAL_INSPECT`
GetAccessApproval	`ACCESS_APPROVAL_READ`
CreateAccessApproval	`ACCESS_APPROVAL_CREATE`
GetAccessMaterials	`ACCESS_APPROVAL_RETRIEVE`
RevokeAccessApproval	`ACCESS_APPROVAL_ACTION_REVOKE`

Policy Examples

Learn about Oracle Managed Access IAM policies using examples.

Allow users in the group SecurityAdmins to create, update, and delete all Managed Access resources in the entire tenancy:
```
Allow group SecurityAdmins to manage lockbox-family in tenancy
Allow group operators to inspect access-request in compartment tenancy
```

For all policies, see Managed Access Policies.

Oracle Cloud Infrastructure Documentation