Policy Reference (without Identity Domains)
 You're viewing OCI IAM documentation for tenancies in regions that have not been updated to use identity domains.
Was my region updated?
Access Governance
Analytics Cloud
Anomaly Detection
API Gateway
Application Dependency Management
Application Performance Monitoring
Archive Storage
Artifact Registry
Audit
Automated CEMLI Execution
Bastion
Big Data Service
Billing and Cost Management
Block Volume
Blockchain Platform
New Cache with Redis
Certificates
Classic Migration
Cloud Advisor
Cloud Guard
Cloud Shell
Compartment Quotas
Compliance Documents
Compute
Compute Cloud@Customer
Connector Hub
Console Dashboards
Container Engine
Container Instances
Container Registry
Content Management
Data Catalog
Data Flow
Data Integration
Data Labeling
Data Safe
Data Science
Data Transfer
Database
Database Management
Database Migration
Database Tools
DevOps
Digital Assistant
Disaster Recovery
DNS and Traffic Management
Document Understanding
Email Delivery
Events
File Storage
Functions
Fusion Analytics Warehouse
Generative AI (Beta)
GoldenGate
Health Checks
IAM with Identity Domains
IAM without Identity Domains
Overview of Identity and Access Management
Getting Started with Policies
How Policies Work
Common Policies
Advanced Policy Features
Policy Syntax
Policy Reference
Details for the Announcements Service
Details for API Gateway
Details for Application Performance Monitoring
Details for the Audit Service
Details for the Certificates Service
Details for Connector Hub
Details for Container Engine for Kubernetes
Details for the Core Services
Details for the Database Service
Details for Database Management
Details for the DNS Service
Details for the Email Delivery Service
Details for the Events Service
Details for the File Storage Service
Details for Functions
Details for Health Checks
Details for IAM without Identity Domains
Details for Integration
Details for the Java Management Service
Details for License Manager
Details for Load Balancing
Details for Logging
Details for Logging Analytics
Details for Management Agent
Details for Management Dashboard
Details for the Marketplace Service
Details for Monitoring
Details for Network Load Balancer
Details for Notifications
Details for Object Storage, Archive Storage, and Data Transfer
Details for Operations Insights
Details for Oracle Cloud VMware Solution
Details for Organization Management
Details for Process Automation
Details for the Quotas Service
Details for Container Registry
Details for Resource Manager
Details for Search
Details for the Streaming Service
Details for Subscriptions, Invoices, and Payment History
Details for the Vault Service
Details for the Network Monitoring Service
Details for the WAF Service
Details for the Web Application Acceleration Service
User Credentials
Identity Providers and Federation
User Provisioning for Federated Users
Managing User Capabilities for Federated Users
Calling Services from an Instance
Managing Users
Managing Groups
Managing Dynamic Groups
Managing Network Sources
Managing Compartments
Managing Regions
Managing Platform Regions
Managing the Tenancy
Managing Policies
Managing User Credentials
Managing Password Policy
Managing Multi-Factor Authentication
Known Issues
Deprecated IAM Service APIs
Integration 3
Integration Generation 2
Java Management
Language
Load Balancer
Logging
Logging Analytics
Managed Access
Managed Cloud Self Service Platform
Management Agent
Management Dashboard
Marketplace
Media Services
Monitoring
MySQL Heatwave
Network Firewall
Network Load Balancer
Networking
NoSQL Database
Notifications
Object Storage
OCI Control Center
New OCI Database with PostgreSQL
Operations Insights
Oracle APEX Application Development
Oracle Cloud Marketplace
Oracle Cloud Migrations
Oracle Linux
OS Management
OS Management Hub
Partner Portal
Oracle Cloud Marketplace Territory and Export Compliance Policy
Process Automation
New Publisher
Pulse
Queue
Resource Manager
Roving Edge Infrastructure
Search
Search with OpenSearch
Secure Desktops
Security Advisor
Security Zones
Service Catalog
Service Mesh
Speech
Stack Monitoring
Storage Gateway
Streaming
Tagging
Threat Intelligence
Vault
Vision
Visual Builder
Visual Builder Studio
VMware Solution
Vulnerability Scanning
Web Application Acceleration
Web Application Firewall
Developer Resources
Security
More Resources
Glossary
Oracle Cloud Console
Skip to main content
Policy Reference

Get an overview of IAM policy reference topics, including verbs, resources types, and general variables.

This reference includes:

Verbs: A list of the available actions to pair with a resource-type
Resource-Types: A list of the main resource-types
General Variables for All Requests: Variables you can use when writing policies for any resource-type
Service Limits: View your tenancy's limits, quotas, and usage in the Console
Details for Process Automation
Analytics Cloud: See Give Users Permissions to Manage Analytics Cloud Instances
Details for the Announcements Service
Details for API Gateway
Details for Application Performance Monitoring
Classic Migration Service: See Manage Service Access and Security
Artifact Registry: See Artifact Registry Policies
Details for the Audit Service
Autonomous Recovery Service: See Autonomous Recovery Service Policies
Bastion: See Bastion Policies
Big Data Service: See Understand Big Data Service Resources and Permissions in IAM Policies
Blockchain Platform: See About Permissions and Policies to Manage Oracle Blockchain Platform
Details for the Certificates Service
Cloud Advisor: See Creating Cloud Advisor policies
Cloud Guard: See Cloud Guard Policies
Details for Compute Cloud@Customer
Details for Container Engine for Kubernetes
Container Instances: See Container Instances IAM Policies
Details for the Core Services (this includes Networking, Compute, and Block Volume)
Content Management: See Service Policies
Console Dashboards: See Policy Details for Console Dashboards
Data Catalog: See Data Catalog Policies
Data Flow: See Data Flow Policies
Data Integration: See Data Integration Policies
Data Safe: See Create IAM Policies for Oracle Data Safe Users
Data Science: See Data Science Policies
Details for the Database Service
Details for Database Management
Database Migration: See Database Migration Policies
OCI Database with PostgreSQL: See OCI Database with PostgreSQL Policies
DevOps: See DevOps Policies
Digital Assistant: See Digital Assistant Policies
Details for the DNS Service
Details for the Email Delivery Service
Details for the Events Service
Details for the File Storage Service
Details for Functions
Full Stack Disaster Recovery: See Full Stack Disaster Recovery Policies
GoldenGate: See Oracle Cloud Infrastructure GoldenGate Policies
Details for Health Checks
Details for IAM without Identity Domains
For Integration Generation 2 and Integration 3, see Details for Oracle Integration.
Details for the Java Management Service
Details for License Manager
Details for Load Balancing
Details for Logging
Details for Logging Analytics
Details for Management Agent
Details for Management Dashboard
Details for the Marketplace Service
Media Services: See Media Flow Policies and Media Streams Policies
Details for Monitoring
MySQL Heatwave: See IAM Policies
NoSQL Database Cloud: See Details for NoSQL Database Cloud
Oracle Cloud Migrations: See Oracle Cloud Migration Policies
Details for Notifications
Network Firewall Policy Reference
Details for Object Storage, Archive Storage, and Data Transfer
OCI Control Center: See Control Center Policies
Details for Operations Insights
OS Management: See OS Management Policy Reference
OS Management Hub: See OS Management Hub Policies
Details for Process Automation
Details for Queue
Details for the Quotas Service
Details for Container Registry
Details for Resource Manager
Details for the Search Service
Details for Secure Desktops
Security Zones: See Cloud Guard Policies
Details for Connector Hub
Service Mesh: See Service Mesh IAM Policies
Details for the Streaming Service
Details for Subscriptions, Invoices, and Payment History
Threat Intelligence: See Threat Intelligence Policies
Details for the Vault Service
Visual Builder: See Input Variables
Visual Builder Studio: See IAM Policy Details for VB Studio
Details for Oracle Cloud VMware Solution
Details for Organization Management
Vulnerability Scanning: See Scanning Policies
Details for the WAF Service
Details for the Web Application Acceleration Service

For instructions on how to create and manage policies using the Console or API, see Overview of Working with Policies.

Verbs

The verbs are listed in order of least amount of ability to most. The exact meaning of a each verb depends on which resource-type it's paired with. The tables later in this section show the API operations covered by each combination of verb and resource-type.

Verb	Types of Access Covered	Target User
inspect	Ability to list resources, without access to any confidential information or user-specified metadata that may be part of that resource. Important: The operation to list policies includes the contents of the policies themselves, and the list operations for the Networking resource-types return all the information (e.g., the contents of security lists and route tables).	Third-party auditors
read	Includes inspect plus the ability to get user-specified metadata and the actual resource itself.	Internal auditors
use	Includes read plus the ability to work with existing resources (the actions vary by resource type). Includes the ability to update the resource, except for resource-types where the "update" operation has the same effective impact as the "create" operation (e.g., UpdatePolicy, UpdateSecurityList, etc.), in which case the "update" ability is available only with the manage verb. In general, this verb does not include the ability to create or delete that type of resource.	Day-to-day end users of resources
manage	Includes all permissions for the resource.	Administrators
Resource-Types

A few common family resource-types are listed below. For the individual resource-types that make up each family, follow the links.

all-resources: All Oracle Cloud Infrastructure resource-types
cluster-family: See Details for Container Engine for Kubernetes
compute-management-family: See Details for the Core Services
data-catalog-family: See Data Catalog Policies
data-science-family: See Data Science Policies
database-family: See Details for the Database Service
datasafe-family-resources: See OCI Resources for Oracle Data Safe
dns: See Details for the DNS Service
email-family: See Details for the Email Delivery Service
file-family: See Details for the File Storage Service
instance-agent-command-family : See Details for the Core Services
instance-agent-family: See Details for the Core Services
instance-family: See Details for the Core Services
object-family: See Details for Object Storage, Archive Storage, and Data Transfer
optimizer-api-family: See Creating Cloud Advisor policies
virtual-network-family: See Details for the Core Services
volume-family: See Details for the Core Services

IAM has no family resource-type, only individual ones. See Details for IAM with Identity Domains or Details for IAM without Identity Domains, depending on whether your tenancy has identity domains or not.

General Variables for All Requests

You use variables when adding conditions to a policy. For more information, see Conditions. Here are the general variables applicable to all requests.

Name	Type	Description
request.user.id	Entity (OCID)	The OCID of the requesting user.
request.user.name	String	Name of the requesting user.
request.user.mfaTotpVerified	Boolean	

Whether the user has been verified by multifactor authentication (MFA). To restrict access to only MFA-verified users, add the condition

where request.user.mfaTotpVerified='true'

See Managing Multifactor Authentication for information on setting up MFA.


request.groups.id	List of entities (OCIDs)	The OCIDs of the groups the requesting user is in.
request.permission	String	The underlying permission being requested (see Permissions).
request.operation	String	The API operation name being requested (for example, ListUsers).
request.networkSource.name	String	The name of the network source group that specifies allowed IP addresses the request may come from. See Managing Network Sources for information.
request.utc-timestamp	String	The UTC time that the request is submitted, specified in ISO 8601 format. See Restricting Access to Resources Based on Time Frame for more information.
request.utc-timestamp.month-of-year	String	The month that the request is submitted in, specified in numeric ISO 8601 format (for example, '1', '2', '3', ... '12'). See Restricting Access to Resources Based on Time Frame for more information.
request.utc-timestamp.day-of-month	String	The day of the month that the request is submitted in, specified in numeric format '1' - '31'. See Restricting Access to Resources Based on Time Frame for more information.
request.utc-timestamp.day-of-week	String	The day of the week that the request is submitted in, specified in English (for example, 'Monday', 'Tuesday', 'Wednesday', etc.). See Restricting Access to Resources Based on Time Frame for more information.
request.utc-timestamp.time-of-day	String	The UTC time interval that request is submitted during, in ISO 8601 format (for example, '01:00:00Z' AND '02:01:00Z'). See Restricting Access to Resources Based on Time Frame for more information.
request.region	String	

The 3-letter key for the region the request is made in. Allowed values are:

Note: For quota policies, the region name must be specified instead of the following 3-letter key values. Also see Sample Quotas for more information.

AMS - use for Netherlands Northwest (Amsterdam)
ARN - use for Sweden Central (Stockholm)
AUH - use for UAE Central (Abu Dhabi)
BEG - use for Serbia Central (Jovanovac)
BOG - use for Colombia Central (Bogota)
BOM - use for India West (Mumbai)
CDG - use for France Central (Paris)
CWL - use for UK West (Newport)
DXB - use for UAE East (Dubai)
FRA - use for Germany Central (Frankfurt)
GRU - use for Brazil East (Sao Paulo)
HYD - use for India South (Hyderabad)
IAD - use for US East (Ashburn)
ICN - use for South Korea Central (Seoul)
JED - use for Saudi Arabia West (Jeddah)
JNB - use for South Africa Central (Johannesburg)
KIX - use for Japan Central (Osaka)
LHR - use for UK South (London)
LIN - use for Italy Northwest (Milan)
MAD - use for Spain Central (Madrid)
MEL - use for Australia Southeast (Melbourne)
MRS - use for France South (Marseille)
MTY - use for Mexico Northeast (Monterrey)
MTZ - use for Israel Central (Jerusalem)
NRT - use for Japan East (Tokyo)
ORD - use for US Midwest (Chicago)
PHX - use for US West (Phoenix)
QRO - use for Mexico Central (Queretaro)
SCL - use for Chile Central (Santiago)
SIN - use for Singapore (Singapore)
SJC - use for US West (San Jose)
SYD - use for Australia East (Sydney)
VCP - use for Brazil Southeast (Vinhedo)
YNY - use for South Korea North (Chuncheon)
YUL - use for Canada Southeast (Montreal)
YYZ - use for Canada Southeast (Toronto)
ZRH - use for Switzerland North (Zurich)

request.ad	String	The name of the availability domain the request is made in. To get a list of availability domain names, use the ListAvailabilityDomains operation.
request.principal.compartment.tag	String	The tags applied to the compartment that the requesting resource belongs to are evaluated for a match. For usage instructions, see Using Tags to Manage Access.
request.principal.group.tag	String	The tags applied to the groups that the user belongs to are evaluated for a match. For usage instructions, see Using Tags to Manage Access.
target.compartment.name	String	The name of the compartment specified in target.compartment.id.
target.compartment.id	Entity (OCID)	

The OCID of the compartment containing the primary resource.

Note: target.compartment.id and target.compartment.name cannot be used with a "List" API operation to filter the list based on the requesting user's access to the compartment.


target.resource.compartment.tag	String 	The tag applied to the target compartment of the request is evaluated. For usage instructions, see Using Tags to Manage Access.
target.resource.tag	String 	The tag applied to the target resource of the request is evaluated. For usage instructions, see Using Tags to Manage Access.
Policy Reference
Verbs
Resource-Types
General Variables for All Requests