Common Policies


This section includes some common policies you might want to use in your organization.

 Note



These policies use example group and compartment names. Make sure to replace them with your own names.

Let the Help Desk manage users
Let auditors inspect your resources
Let Autonomous Recovery Service admins manage protected databases, recovery service subnets, and protection policies
Let compliance admins manage protection policies
Let network admins manage a cloud network
Let network admins manage load balancers
Let users launch compute instances
Let users launch compute instances from a specific custom image
Let image admins manage custom images
Let users manage Compute instance configurations, instance pools, and cluster networks
Let users manage Compute autoscaling configurations
Let users list and subscribe to images from the Partner Image catalog
Let users create Compute instance console connections
Let users manage Compute dedicated virtual machine hosts
Let users launch Compute instances on dedicated virtual machine hosts
Let volume admins manage block volumes, backups, and volume groups
Let volume backup admins manage only backups
Let boot volume backup admins manage only backups
Let users create a volume group
Let users clone a volume group
Let users create a volume group backup
Let users restore a volume group backup
Let users create, manage, and delete file systems
Let users create file systems
Let Object Storage admins manage buckets and objects
Let users write objects to Object Storage buckets
Let users download objects from Object Storage buckets
Let users access customer data in Object Storage encrypted with customer-managed key
Let database admins manage Oracle Cloud database systems
Let database admins manage Exadata Database Service on Cloud@Customer instances
Let database admins manage MySQL Database resources
Let database admins manage Oracle Cloud external database resources
Let database and fleet admins manage Autonomous Databases
Let security admins manage vaults, keys, and secrets
Let security admins manage all keys in a specific vault in a compartment
Let security admins use a specific key in a compartment
Let a user group delegate key usage in a compartment
Let Block Volume, Object Storage, File Storage, Container Engine for Kubernetes, and Streaming services encrypt and decrypt volumes, volume backups, buckets, file systems, Kubernetes secrets, and stream pools
Let security admins manage all secrets in a specific vault in a compartment
Let users read, update, and rotate all secrets
Let users manage their own passwords and credentials
Let a compartment admin manage the compartment
Restrict admin access to a specific region
Restrict user access to view only summary announcements
Let users view details of announcements
Let streaming admins manage streaming resources
Let streaming users publish messages to streams
Let streaming users publish messages to a specific stream
Let streaming users publish messages to a stream in a specific stream pool
Let streaming users consume messages from streams
Let users list metric definitions in a compartment
Let users query metrics in a compartment
Restrict queries to a specific metric namespace
Let users publish custom metrics
Let instances make API calls to access monitoring metrics in the tenancy
Let users view alarms
Let users manage alarms
Let users manage alarms and create topics
Let users access usage reports
Let users analyze costs
Allow a group to manage topics and subscriptions
Allow a group to manage subscriptions
Allow a group to publish messages to topics
Let users create, deploy, and manage functions and applications
Let users list Events rules in a compartment
Let admins manage Events rules in a compartment
Allow a group to access all of Cloud Guard
Allow a group to access Cloud Guard problems
Allow a group to access Cloud Guard detector recipes
Allow a group to access Cloud Guard in a single compartment
Allow a group to administer all aspects of Full Stack Disaster Recovery operations in the entire tenancy
Allow a group to create Full Stack Disaster Recovery configurations and execute Prechecks
Allow a group of users to create Full Stack Disaster Recovery configurations in a specific compartment
Allow Object Storage to use Keys in Vault
Let security admins manage all bastions and sessions
Let security admins manage bastion sessions
Let security admins manage bastion sessions for a specific target host in a compartment
Let security admins configure scanning of instances in all compartments
Let users view vulnerability scan results in all compartments
Allow a group to manage connectors
Allow a group to call Operations Insights ingest operations at tenancy
Let users create and delete workspaces without networking (Data Integration)
Let users create and delete workspaces with networking (Data Integration)
Let users and resource principal access and use Object Storage for a given workspace (Data Integration)
Let users and resource principal access and use autonomous databases as a target for a given workspace (Data Integration)
Let users search objects within a workspace (Data Integration)
Let users move workspaces to a new compartment (Data Integration)
Let users publish tasks to the OCI Data Flow service (Data Integration)
Let users access the OCI Vault service for a given workspace (Data Integration)
Let admins manage announcement subscriptions
 Expand All Expandable Areas