DevOps policies
 required for using various DevOps resources such as code repositories, build pipelines and deployment pipelines.

Following policy examples are provided:

Environment policies
Code repository policies
Build pipeline policies
Policies for accessing ADM resources
Deployment pipeline policies
Artifact policies
Environment Policies

Policy example for creating target environment that is used for deployment.

See the instructions for creating policies using the Console.

Create policy to allow users in a group to create, update or delete a private OKE environment:
Copy
Allow group <group-name> to manage virtual-network-family in compartment <compartment_name> where any {request.operation='CreatePrivateEndpoint', request.operation='UpdatePrivateEndpoint', request.operation='DeletePrivateEndpoint', request.operation='EnableReverseConnection', request.operation='ModifyReverseConnection', request.operation='DisableReverseConnection'}
Code Repository Policies

Policy examples for creating a code repository and connecting to external code repositories such as GitHub and GitLab.

See the instructions for creating policies, groups, and dynamic groups using the Console.

To create a code repository, create following IAM policies:
Allow users in a group to have access to the DevOps project:
Copy
Allow group <group-name> to read devops-project in compartment <compartment_name>
Allow users in a group to read, create, update, or delete a repository:
Copy
Allow group <group-name> to manage devops-repository in compartment <compartment_name>
To clone a repository, create following IAM policies:
Allow users in a group to have access to the DevOps project:
Copy
Allow group <group-name> to read devops-project in compartment <compartment_name>
Allow users in a group to read or update a repository:
Copy
Allow group <group-name> to use devops-repository in compartment <compartment_name>
To integrate with external code repositories, create a policy in the root compartment. For example, to allow the dynamic group to read secrets:
Copy
Allow dynamic-group DevOpsDynamicGroup to read secret-family in compartment <compartment_name>
To validate an external connection, create the following IAM policy along with the policy to read secrets:
Copy
Allow group <group-name> to use devops-connection in compartment <compartment_name>
Build Pipeline Policies

Policy examples for creating build pipelines and adding stages to the pipeline.

See the instructions for creating policies using the Console.

Create IAM policies to allow the dynamic group to access OCI resources in the compartment:
To deliver artifacts, provide access to the Container Registry (OCIR):
Copy
Allow dynamic-group DevOpsDynamicGroup to manage repos in compartment <compartment_name>
To access vault for personal access token (PAT), provide access to secret-family. This policy is required in the Managed Build stage for accessing PAT to download the source code:
Copy
Allow dynamic-group DevOpsDynamicGroup to read secret-family in compartment <compartment_name>
Provide access to read deployment artifacts in the Deliver Artifacts stage, read DevOps code repository in the Managed Build stage, and trigger deployment pipeline in the Trigger Deploy stage:
Copy
Allow dynamic-group DevOpsDynamicGroup to manage devops-family in compartment <compartment_name>
To deliver artifacts, provide access to the Artifact Registry:
Copy
Allow dynamic-group DevOpsDynamicGroup to manage generic-artifacts in compartment <compartment_name>
To send notifications, provide access to the build pipeline:
Copy
Allow dynamic-group DevOpsDynamicGroup to use ons-topics in compartment <compartment_name>
Create policies to allow private access setup in the Managed Build stage:
Copy
Allow dynamic-group DevOpsDynamicGroup to use subnets in compartment <customer subnet compartment>
Copy
Allow dynamic-group DevOpsDynamicGroup to use vnics in compartment <customer subnet compartment>
If any network security groups (NSGs) are specified in the private access configuration, then the policy must allow access to the NSGs:
Copy
Allow dynamic-group DevOpsDynamicGroup to use network-security-groups in compartment <customer subnet compartment>
Create a policy to allow the build pipeline to access the Certificate Authority (CA) bundle resource for Transport Layer Security (TLS) verification:
Copy
Allow dynamic-group DevOpsDynamicGroup to use cabundles in compartment <compartment_name>
Policies for Accessing ADM Resources

Policy examples for accessing Application Dependency Management (ADM) service's resources from the build pipeline.

See the instructions for creating policies using the Console.

Create IAM policies to allow the dynamic group to access ADM resources in the tenancy:
Copy
Allow dynamic-group DevOpsDynamicGroup to use adm-knowledge-bases in tenancy
Copy
Allow dynamic-group DevOpsDynamicGroup to manage adm-vulnerability-audits in tenancy
Deployment Pipeline Policies

Policy examples for creating deployment pipelines and adding stages to the pipeline.

See the instructions for creating policies using the Console.

Create IAM policies to allow the deployment pipeline dynamic group to access your compartment resources:
OKE cluster deployments:
Copy
Allow dynamic-group DevOpsDynamicGroup to read all-artifacts in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to manage cluster in compartment <compartment_name>
Functions:
Copy
Allow dynamic-group DevOpsDynamicGroup to manage fn-function in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to read fn-app in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to use fn-invocation in compartment <compartment_name>
Instance Group deployments:
Copy
Allow dynamic-group DevOpsDynamicGroup to read all-artifacts in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to read instance-family in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to use instance-agent-command-family in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to use load-balancers in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to use vnics in compartment <compartment_name>
For an instance group deployment, you also need to create a dynamic group for the following instances and give the dynamic group certain permissions:
Create a dynamic group for your instances. For example, you can name the dynamic group as, DeployComputeDynamicGroup and replace compartmentOCID with the OCID of your compartment:
Copy
All {instance.compartment.id = 'compartmentOCID'}
Create IAM policies to give required access to the deployment instances:
Copy
Allow dynamic-group DeployComputeDynamicGroup to use instance-agent-command-execution-family in compartment <compartment_name>
Allow dynamic-group DeployComputeDynamicGroup to read generic-artifacts in compartment <compartment_name>
Allow dynamic-group DeployComputeDynamicGroup to read secret-family in compartment <compartment_name>
Approval stage:
Copy
Allow group pipeline1_approvers to use devops-family in compartment <compartment_name>  where all {request.principal.id = 'ocid1.pipeline1'}
Allow group pipeline2_approvers to use devops-family in compartment <compartment_name>  where all {request.principal.id = 'ocid1.pipeline2'}
Shell stage:
Copy
Allow dynamic-group DevOpsDynamicGroup to manage compute-container-instances in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to manage compute-containers in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to use vnics in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to use subnets in compartment <compartment_name>
Allow dynamic-group DevOpsDynamicGroup to use dhcp-options in compartment <compartment_name>
If you’re using Network security group while creating Shell stage, then add the following policy:
Copy
Allow dynamic-group DevOpsDynamicGroup to use network-security-groups in compartment <compartment_name>
Artifact Policies

Policy examples for adding the Deliver Artifacts stage to the build pipeline.

The Deliver Artifacts stage maps the build outputs from the Managed Build stage with the version to deliver to a DevOps artifact resource, and then to the Oracle Cloud Infrastructure (OCI) code repository. DevOps supports artifacts stored in OCI Container Registry and Artifact Registry repositories. See Adding a Deliver Artifacts Stage.

See the instructions for creating policies using the Console.

Create following IAM policies:

To see a list of all repositories in Container Registry belonging to the tenancy or to a particular compartment:
Copy
Allow dynamic-group DevOpsDynamicGroup to inspect repos in tenancy
Copy
Allow dynamic-group DevOpsDynamicGroup to inspect repos in compartment <compartment_name>
Allow artifacts to be pushed to the Container Registry (OCIR) that belongs to the tenancy or to a particular compartment:
Copy
Allow dynamic-group DevOpsDynamicGroup to use repos in tenancy
Copy
Allow dynamic-group DevOpsDynamicGroup to use repos in compartment <compartment_name>

See Policies to Control Repository Access.

Ability to see a list of generic artifacts in Artifact Registry belonging to the tenancy or to a particular compartment:
Copy
Allow dynamic-group DevOpsDynamicGroup to inspect generic-artifacts in tenancy
Copy
Allow dynamic-group DevOpsDynamicGroup to inspect generic-artifacts in compartment <compartment_name>
Allow generic artifacts to be pushed to the Artifact Registry that belongs to the tenancy or to a particular compartment:
Copy
Allow dynamic-group DevOpsDynamicGroup to use generic-artifacts in tenancy
Copy
Allow dynamic-group DevOpsDynamicGroup to use generic-artifacts in compartment <compartment_name>

See Artifact Registry Policies.

Allow users to pull generic artifacts that belongs to the tenancy or to a particular compartment:
Copy
Allow dynamic-group DevOpsDynamicGroup to read generic-artifacts in tenancy
Copy
Allow dynamic-group DevOpsDynamicGroup to read generic-artifacts in compartment <compartment_name>
Accessing Artifact Registry

Oracle Cloud Infrastructure Artifact Registry is a repository service for storing, sharing, and managing software development packages.

You can access the artifacts that you store in Artifact Registry from the DevOps service. You can create a reference to three types of artifacts in Artifact Registry: instance group deployment configurations, general artifacts, and Kubernetes manifests. Your administrator must grant the read all-artifacts permission to the pipeline resources.

See the instructions for creating policies using the console.

Create IAM policy to allow the dynamic group to access the artifacts from a specific compartment:
Copy
Allow dynamic-group DevOpsDynamicGroup to read all-artifacts in compartment <compartment_name>

For more information, see Artifact Registry Policies.

 Expand All Expandable Areas
DevOps IAM Policies
Resource Types and Permissions
Supported Variables
Details for Verb + Resource Type Combinations
Creating a Policy and Dynamic Group
Policy Examples
Accessing Artifact Registry