Policy Details for External Database

This topic provides the details for writing Oracle Cloud Infrastructure Identity and Access Management (IAM) policies to control access to external database resources.

Resource-Types

An aggregate resource-type covers the list of individual resource-types that directly follow. For example, writing one policy to allow a group to have access to the external-database-family is equivalent to writing four separate policies for the group that would grant access to the external-container-databases, external-pluggable-databases, external-non-container-databases, and external-database-connectors resource-types.

For more information, see Resource-Types in How Policies Work.

Aggregate Resource-Type

  • external-database-family

Individual Resource-Types

  • external-container-databases
  • external-pluggable-databases
  • external-non-container-databases
  • external-database-connectors

Supported Variables

Only the general variables are supported. For more information, see General Variables for All Requests in Policy Reference.

Details for Verb + Resource-Type Combinations

The following tables show the permissions and API operations covered by each verb. The level of access is cumulative as you go from inspect > read > use > manage. A plus sign (+) in a table cell indicates incremental access compared to the cell directly preceding it, whereas "no extra" indicates no incremental access.

For example, the use verb for the external-container-databases resource-type covers the same permissions and API operations as the read verb, plus the EXTERNAL_CONTAINER_DATABASE_UPDATE permission. The use verb partially covers the ScanPluggableDatabases operation, which also needs read permissions for external-pluggable-databases.

external-database-connectors

Table 4-1 external-database-connectors

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

EXTERNAL_DATABASE_CONNECTOR_INSPECT

ListExternalDatabaseConnectors

GetExternalDatabaseConnector

no extra

read

INSPECT +

EXTERNAL_DATABASE_CONNECTOR_CONTENT_READ

none

no extra

use

READ +

EXTERNAL_DATABASE_CONNECTOR_CONTENT_WRITE

EXTERNAL_DATABASE_CONNECTOR_UPDATE

UpdateExternalDatabaseConnector

EnableExternalContainerDatabaseDatabaseManagementService

DisableExternalContainerDatabaseDatabaseManagementService (both also need use external-container-databases)

EnableExternalPluggableDatabaseDatabaseManagementService

DisableExternalPluggableDatabaseDatabaseManagementService (also needs use external-pluggable-databases)

EnableExternalNonContainerDatabaseDatabaseManagementService

DisableExternalNonContainerDatabaseDatabaseManagementService (both also need use external-non-container-databases)

manage

USE +

EXTERNAL_DATABASE_CONNECTOR_CREATE

EXTERNAL_DATABASE_CONNECTOR_DELETE

CreateExternalDatabaseConnector

DeleteExternalDatabaseConnector

no extra

external-non-container-databases

Table 4-2 external-non-container-databases

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

EXTERNAL_NON_CONTAINER_DATABASE_INSPECT

ListExternalNonContainerDatabases

GetExternalNonContainerDatabase

no extra

read

INSPECT +

EXTERNAL_NON_CONTAINER_DATABASE_CONTENT_READ

none

no extra

use

READ +

EXTERNAL_NON_CONTAINER_DATABASE_CONTENT_WRITE

EXTERNAL_NON_CONTAINER_DATABASE_UPDATE

UpdateExternalNonContainerDatabase

ChangeExternalNonContainerDatabaseCompartment

CreateExternalConnector

DeleteExternalConnector (both also need manage external-connectors)

EnableExternalNonContainerDatabaseDatabaseManagementService

DisableExternalNonContainerDatabaseDatabaseManagementService (both also need use external-connectors)

manage

USE +

EXTERNAL_NON_CONTAINER_DATABASE_CREATE

EXTERNAL_NON_CONTAINER_DATABASE_DELETE

CreateExternalNonContainerDatabase

DeleteExternalNonContainerDatabase

no extra

external-container-databases

Table 4-3 external-container-databases

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

EXTERNAL_CONTAINER_DATABASE_INSPECT

ListExternalContainerDatabases

GetExternalContainerDatabase

no extra

read

INSPECT +

EXTERNAL_CONTAINER_DATABASE_CONTENT_READ

none

no extra

use

READ +

EXTERNAL_CONTAINER_DATABASE_CONTENT_WRITE

EXTERNAL_CONTAINER_DATABASE_UPDATE

UpdateExternalContainerDatabase

ChangeExternalContainerDatabaseCompartment

CreateExternalConnector

DeleteExternalConnector (both also need manage external-connectors)

CreateExternalPluggableDatabase

DeleteExternalPluggableDatabase (both also need manage external-pluggable-databases)

ScanPluggableDatabases (also needs read external-pluggable-databases)

EnableExternalContainerDatabaseDatabaseManagementService

DisableExternalContainerDatabaseDatabaseManagementService (both also need use external-connectors)

manage

USE +

EXTERNAL_CONTAINER_DATABASE_CREATE

EXTERNAL_CONTAINER_DATABASE_DELETE

CreateExternalContainerDatabase

DeleteExternalContainerDatabase

no extra

external-pluggable-databases

Table 4-4 external-pluggable-databases

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

EXTERNAL_PLUGGABLE_DATABASE_INSPECT

ListExternalPluggableDatabases

GetExternalPluggableDatabase

no extra

read

INSPECT +

EXTERNAL_PLUGGABLE_DATABASE_CONTENT_READ

none

no extra

use

READ +

EXTERNAL_PLUGGABLE_DATABASE_CONTENT_WRITE

EXTERNAL_PLUGGABLE_DATABASE_UPDATE

UpdateExternalPluggableDatabase

ChangeExternalPluggableDatabaseCompartment

CreateExternalConnector

DeleteExternalConnector (both also need manage external-connectors)

EnableExternalPluggableDatabaseDatabaseManagementService

DisableExternalPluggableDatabaseDatabaseManagementService (both also need use external-connectors)

manage

USE +

EXTERNAL_PLUGGABLE_DATABASE_CREATE

EXTERNAL_PLUGGABLE_DATABASE_DELETE

CreateExternalPluggableDatabase

DeleteExternalPluggableDatabase

no extra

For more information about permissions and verbs, see Advanced Policy Features.

Permissions Required for Each API Operation

External Database Connector API Operations

Table 4-5 External Database Connector API Operations

API Operation Permissions Required to Use the Operation

ListExternalDatabaseConnectors

EXTERNAL_DATABASE_CONNECTOR_INSPECT

GetExternalDatabaseConnector

EXTERNAL_DATABASE_CONNECTOR_INSPECT

UpdateExternalDatabaseConnector

EXTERNAL_DATABASE_CONNECTOR_UPDATE

CreateExternalDatabaseConnector

One or more of the following three permissions:
  • EXTERNAL_CONTAINER_DATABASE_UPDATE
  • EXTERNAL_CONTAINER_DATABASE_UPDATE
  • EXTERNAL_PLUGGABLE_DATABASE_UPDATE

and

EXTERNAL_DATABASE_CONNECTOR_CREATE

DeleteExternalDatabaseConnector

One or more of the following three permissions:
  • EXTERNAL_CONTAINER_DATABASE_UPDATE
  • EXTERNAL_CONTAINER_DATABASE_UPDATE
  • EXTERNAL_PLUGGABLE_DATABASE_UPDATE

and

EXTERNAL_DATABASE_CONNECTOR_DELETE

CheckExternalDatabaseConnectorConnectionStatus

EXTERNAL_DATABASE_CONNECTOR_UPDATE

External Non-Container Database API Operations

Table 4-6 External Non-Container Database API Operations

API Operation Permissions Required to Use the Operation

ListExternalNonContainerDatabases

EXTERNAL_NON_CONTAINER_DATABASE_INSPECT

GetExternalNonContainerDatabase

EXTERNAL_NON_CONTAINER_DATABASE_INSPECT

UpdateExternalNonContainerDatabase

EXTERNAL_NON_CONTAINER_DATABASE_INSPECT

EXTERNAL_NON_CONTAINER_DATABASE_UPDATE

ChangeExternalNonContainerDatabaseCompartment

EXTERNAL_NON_CONTAINER_DATABASE_INSPECT

EXTERNAL_NON_CONTAINER_DATABASE_UPDATE

EXTERNAL_DATABASE_CONNECTOR_INSPECT

EXTERNAL_DATABASE_CONNECTOR_UPDATE

CreateExternalNonContainerDatabase

EXTERNAL_NON_CONTAINER_DATABASE_INSPECT

EXTERNAL_NON_CONTAINER_DATABASE_CREATE

DeleteExternalNonContainerDatabase

EXTERNAL_NON_CONTAINER_DATABASE_INSPECT

EXTERNAL_NON_CONTAINER_DATABASE_DELETE

EnableExternalNonContainerDatabaseDatabaseManagementService

and

DisableExternalNonContainerDatabaseDatabaseManagementService

EXTERNAL_NON_CONTAINER_DATABASE_INSPECT

EXTERNAL_NON_CONTAINER_DATABASE_UPDATE

EXTERNAL_DATABASE_CONNECTOR_DELETE

EXTERNAL_DATABASE_CONNECTOR_UPDATE

External Container Database API Operations

Table 4-7 External Container Database API Operations

API Operation Permissions Required to Use the Operation

ListExternalContainerDatabases

EXTERNAL_CONTAINER_DATABASE_INSPECT

GetExternalContainerDatabase

EXTERNAL_CONTAINER_DATABASE_INSPECT

UpdateExternalContainerDatabase

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_CONTAINER_DATABASE_UPDATE

ChangeExternalContainerDatabaseCompartment

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_CONTAINER_DATABASE_UPDATE

EXTERNAL_DATABASE_CONNECTOR_INSPECT

EXTERNAL_DATABASE_CONNECTOR_UPDATE

ScanPluggableDatabases

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_PLUGGABLE_DATABASE_INSPECT

CreateExternalContainerDatabase

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_CONTAINER_DATABASE_CREATE

DeleteExternalContainerDatabase

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_CONTAINER_DATABASE_DELETE

EnableExternalContainerDatabaseDatabaseManagementService

and

DisableExternalContainerDatabaseDatabaseManagementService

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_CONTAINER_DATABASE_UPDATE

EXTERNAL_DATABASE_CONNECTOR_INSPECT

EXTERNAL_DATABASE_CONNECTOR_UPDATE

External Pluggable Database API Operations

Table 4-8 External Pluggable Database API Operations

API Operation Permissions Required to Use the Operation

ListExternalPluggableDatabases

EXTERNAL_PLUGGABLE_DATABASE_INSPECT

GetExternalPluggableDatabase

EXTERNAL_PLUGGABLE_DATABASE_INSPECT

UpdateExternalPluggableDatabase

EXTERNAL_PLUGGABLE_DATABASE_UPDATE

ChangeExternalPluggableDatabaseCompartment

EXTERNAL_PLUGGABLE_DATABASE_INSPECT

EXTERNAL_PLUGGABLE_DATABASE_UPDATE

EXTERNAL_DATABASE_CONNECTOR_INSPECT

EXTERNAL_DATABASE_CONNECTOR_UPDATE

CreateExternalPluggableDatabase

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_CONTAINER_DATABASE_UPDATE

EXTERNAL_PLUGGABLE_DATABASE_CREATE

DeleteExternalPluggableDatabase

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_CONTAINER_DATABASE_UPDATE

EXTERNAL_PLUGGABLE_DATABASE_DELETE

EnableExternalPluggableDatabaseDatabaseManagementService

and

DisableExternalPluggableDatabaseDatabaseManagementService

EXTERNAL_CONTAINER_DATABASE_INSPECT

EXTERNAL_CONTAINER_DATABASE_UPDATE

EXTERNAL_PLUGGABLE_DATABASE_UPDATE

EXTERNAL_DATABASE_CONNECTOR_UPDATE

For more information about permissions and verbs, see Advanced Policy Features.