Using Tags to Manage Access

You can use the * character to match all occurrences of {tagNamespace}.{tagKeyDefinition} regardless of the value. In the policy, you can place * in single quotes '*' or between backslashes /*/ . For example,

allow group GroupA to use all-resources in compartment HR where target.resource.tag.HR.Project= '*'

In this example, GroupA can use all resources in the compartment HR that are tagged with the tag namespace and tag key: HR.Project with any value.

In addition to the expected tag-based access control policy for API Gateway resources, you'll need policy allowing manage permissions for api-workrequests.

Here is an example policy with the additional permissions:

allow group TestGroup to manage api-workrequests in compartment Compartment1

In addition to the expected tag-based access control policy for Big Data Service resources, you'll need policy allowing manage permissions for cluster-work-requests.

Here is an example policy with the additional permissions:

allow group TestGroup to manage cluster-work-requests in compartment Compartment1

Scenarios requiring additional policy:

Attach a block volume to a compute instance:

To attach a block volume to a compute instance, in addition to the tag-based access control policy to allow the use verb on volumes and instances, you'll need some additional permissions.

For example:

allow group TestGroup to use volumes in compartment Compartment1 where target.resource.tag.TagNS.TagKey = 'test'
allow group TestGroup to use instances in compartment Compartment1 where target.resource.tag.TagNS.TagKey = 'test'

These two policies allow members of TestGroup to use volumes and instances in Compartment1, when the resources have the appropriate tag. To allow members to attach a block volume to an instance, you'll also need policies that allow the permissions shown in the following statements:

allow group TestGroup to read instances in compartment Compartment1
allow group TestGroup to manage volume-attachments in compartment Compartment1 where any {request.permission='VOLUME_ATTACHMENT_CREATE', request.permission='VOLUME_ATTACHMENT_DELETE'}

Scenarios requiring additional policy:

Attach compute instance to subnet:

To manage a compute instance's subnet attachment, in addition to the expected tag-based access control policy for instances and subnets, shown here:

allow group TestGroup to use subnets in compartment Compartment1 where target.resource.tag.TagNS.TagKey = 'test'
allow group TestGroup to manage instances in compartment Compartment1 where target.resource.tag.TagNS.TagKey = 'test'

You'll need additional permissions on vnics:

allow group TestGroup to use vnics in compartment Compartment1 where ANY{request.permission='VNIC_ATTACH', request.permission='VNIC_CREATE'}

Delete a VNIC from a compute instance:

To delete a VNIC from a compute instance, in addition to the expected tag-based access control policy for instances and subnets shown here:

allow group TestGroup to manage instances in compartment Compartment1 where target.resource.tag.TagNS.TagKey = 'test'
allow group TestGroup to use subnets in compartment Compartment1 where target.resource.tag.TagNS.TagKey = 'test'

You'll need policy allowing you permissions on vnics:

allow group TestGroup to use vnics in compartment Compartment1 where ANY {request.permission='VNIC_DELETE', request.permission='VNIC_DETACH'}

In addition to the expected tag-based access control policy for Content Management resources, you'll need policy allowing manage permissions for oce-work-requests.

Here is an example policy with the additional permissions:

allow group TestGroup to manage oce-requests in compartment Compartment1

Update Tags for ExaData Infrastructure:

Not supported at this time using tag-based access control policies.

Scenarios requiring additional policy:

Delete a DB-System:

To delete or update a DB-System, in addition to the expected tag-based access control policy for db-systems, shown here:

allow group TestGroup to manage db-systems in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'

You'll need policy allowing you permissions for db-backups, db-homes, vnics, subnets and databases. Here is an example policy showing the additional permissions:

allow group TestGroup to manage db-backups in compartment Compartment1 where ANY {request.permission='DB_BACKUP_DELETE', request.permission='DB_BACKUP_INSPECT'}
allow group TestGroup to manage db-homes in compartment Compartment1 where request.permission='DB_HOME_DELETE'
allow group TestGroup to manage vnics in compartment Compartment1 where ANY {request.permission='VNIC_DELETE', request.permission='VNIC_DETACH'}
allow group TestGroup to manage subnets in compartment Compartment1 where request.permission='SUBNET_DETACH'
allow group TestGroup to manage databases in compartment compartment1

Move a DB-system to another compartment:

To move a DB-System to another compartment, in addition to the expected tag-based access control policy for db-systems shown here:

allow group TestGroup to manage db-systems in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'

You'll need policy allowing you permissions for databases, db-homes, and db-backups. Here is an example policy with the additional permissions:

allow group TestGroup to use databases in compartment Compartment1 where request.permission='DATABASE_UPDATE'
allow group TestGroup to manage db-backups in compartment Compartment1 where request.permission='DB_BACKUP_INSPECT'
allow group TestGroup to manage db-homes in compartment Compartment1 where request.permission='DB_HOME_UPDATE'

Database delete for Exadata DB-System:

To delete a database resource for an Exadata DB-System, you'll need the expected tag-based access control policy for db-systems and databases shown here:

allow group TestGroup to manage db-systems in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'
allow group TestGroup to manage databases in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'

You'll also need permissions for db-homes and db-backups. Here is an example policy with the additional permissions:

allow group TestGroup to manage db-homes in compartment Compartment1 where request.permision='DB_HOME_UPDATE'
allow group TestGroup to manage db-backups in compartment Compartment1 where ANY {request.permission='DB_BACKUP_DELETE', request.permission='DB_BACKUP_INSPECT'}

Delete Database:

Deleting a database for a baremetal or virtual machine DB system is not supported using tag-based policies on the target resource.

Database backup create:

To create a database backup, you'll need the expected tag-based access control policy for databases:

allow group TestGroup to manage databases in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'

You'll also need permissions for db-backups. Here is an example policy with the additional permissions:

allow group TestGroup to manage db-backups in compartment Compartment1 where request.permission='DB_BACKUP_CREATE'

Database restore:

To restore a database backup, you'll need the expected tag-based access control policy for databases:

allow group TestGroup to manage databases in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'

You'll also need permissions for backups, like the one shown here:

allow group TestGroup to manage db-backups in compartment Compartment1 where ANY {request.permission='DB_BACKUP_INSPECT', request.permission='DB_BACKUP_CONTENT_READ'}

Create Data Guard association:

Creating a Data Guard association is not supported using tag-based policies on the target resource.

In addition to the expected tag-based access control policy for Data Catalog resources, you'll need the following additional policies for data-catalog-family:

allow group resource_managers to read data-catalog-family in tenancy where request.operation = 'GetWorkRequest'
allow group resource_managers to read data-catalog-family in tenancy where request.operation = 'ListWorkRequestErrors'
allow group resource_managers to read data-catalog-family in tenancy where request.operation = 'listworkrequestlogs'

In addition to the expected tag-based access control policy for Data Science resources, you'll need policy allowing manage permissions for data-science-work-requests.

Here is an example policy with the additional permissions:

allow group TestGroup to manage data-science-work-requests in compartment Compartment1

In addition to the expected tag-based access control policy for the Oracle Digital Assistant resources, you'll need the following additional policies for oda-instances:

allow group TestGroup to inspect oda-instances in compartment Compartment1
allow group TestGroup to read oda-instances in compartment Compartment1 request.operation = 'GetWorkRequest'
allow group TestGroup to read oda-instances in compartment Compartment1 request.operation = 'ListWorkRequestErrors'
allow group TestGroup to read oda-instances in compartment Compartment1 request.operation = 'listworkrequestlogs'

Scenarios requiring additional policy:

Update Load Balancer:

To perform any update to load balancers, in addition to the expected tag-based access control policy for load-balancers:

allow group TestGroup to manage load-balancers in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'

You'll need policy that allows the GetWorkRequest API operation. Here is an example policy with the additional permission:

allow group TestGroup to read load-balancers in compartment Compartment1 where request.operation = 'GetWorkRequest'
network-security-group

Delete Load Balancer:

To delete a load balancer, in addition to the expected tag-based access control policy for load-balancers, subnets, and network-security-group:

allow group TestGroup to manage load-balancers in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'
allow group TestGroup to use subnets in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'
allow group TestGroup to use network-security-group in compartment Compartment1 where target.resource.tag.TagNS.TagKey= 'test'

You'll need these additional permissions for vnics :

allow group TestGroup to use vnics in compartment Compartment1 where ANY {request.permission = 'VNIC_DETACH', request.permission = 'VNIC_DELETE', request.permission='VNIC_DISASSOCIATE_NETWORK_SECURITY_GROUP'}

Attach service gateway or NAT gateway to a route table:

Attaching a service gateway or a NAT gateway to a route table is not supported using tag-based policies on the target resource.

Scenarios requiring additional policy:

Attach DRG to VCN:

To attach DRG to VCN, in addition to the following expected tag-based access control policy for virtual-network-family and vcns:

			allow group TestGroup to use virtual-network-family in compartment Compartment1 where target.resource.tag.TagNS.TagKey = 'test'

You'll need policy allowing you manage permissions for drgs. Here is an example policy with the additional permissions:

allow group TestGroup to manage drgs in compartment Compartment1

Supported resources are: nosql-tables, nosql-rows, and nosql-indexes.

In addition to the expected tag-based access control policy for the NoSQL Database Cloud resources, you'll need these additional policies:

allow group TestGroup to read nosql-tables in compartment Compartment1 where request.operation='ListWorkRequests'

allow group TestGroup to read nosql-tables in compartment Compartment1 where request.operation='ListWorkRequestErrors'

allow group TestGroup to read nosql-tables in compartment Compartment1 where request.operation='ListWorkRequestLogs'

Note that the preceding policies are required to navigate the NoSQL Database Cloud resources in the Console.

In addition to the expected tag-based access control policy for dns resources, you'll need policy allowing you manage permissions for dns-records. Here is an example policy with the additional permissions:

allow group TestGroup to manage dns-records in compartment Compartment1

Policy that grants a user access to a tag namespace based on a tag on the namespace does not allow the user to create or delete tag key definitions in that tag namespace.

For example, the policy:

allow group TestGroup to manage tag-namespaces in compartment Compartment1 where target.resource.tag.TagNS.TagKey='test'

does not allow the users in TestGroup to create or delete tag key definitions in the tag namespaces tagged with TagNS.TagKey='test'.

In addition to the expected tag-based access control policy for the WAF resources, you'll need policy allowing you manage permissions for waas-work-request. Here is an example policy with the additional permissions:

allow group TestGroup to manage waas-work-request in compartment Compartment1

In this example, each of your organization's project compartments contains two child compartments: Test and Prod. You want to give your test engineers access to the test compartments across all three projects. To accomplish this, you create a tag:

ResourceGroup.Role='Test'

and apply this to the Test compartments in each of your project compartments.

You can then use a policy like:

allow group Testers to use all-resources in tenancy where target.resource.compartment.tag.ResourceGroup.Role='Test'

to allow your group Testers to access the resources across all three test compartments.