Summary of OCI IAM Module 3: Advanced Policy Management

1. Policy Inheritance

• Inheritance principle: Policies attached to a parent compartment automatically apply

to all its child compartments.

• Example: A policy written in the root compartment applies to all subcompartments.

→ e.g., “Admin group” in the root can manage resources in all compartments below it.

• Downstream flow: Permissions flow downward through nested compartments.

• Best practice: Use inheritance strategically to avoid redundant policies.

2. Policy Attachment

• Every policy must be attached to a specific compartment or the tenancy (root).

• Attachment level determines who can edit/delete the policy.

o Policy attached to the root can only be modified by root-level admins.

o Policy attached to a child compartment can be modified by admins of that

compartment.

• Inheritance still applies: A policy in a parent compartment affects all its children.

• Path requirement: When attaching policies at higher levels (e.g., root), use the full
compartment path (e.g., A:B:C) to specify the exact resource location.

• Best practice: Attach policies at the lowest possible compartment where they’re
needed, for better control and simplicity.

3. Conditional Policies

• Introduced through the where clause for fine-grained access control.

• Two main variables:

o request → attributes about the request (e.g., [Link], [Link])

o target → attributes about the resource (e.g., [Link])

 • Operators:

o Equality (= / !=),

o Logical conditions using any (OR) and all (AND).

• Use cases:

o Restrict access by region → where [Link] = 'Phoenix'

o Exclude a compartment → where [Link] != <OCID>

o Limit by workload type or specific bucket name.

• Supports pattern matching for flexible string-based conditions.

4. Advanced Policies and Least Privilege

• Permissions are atomic units of access (e.g., VOLUME_INSPECT, VOLUME_DELETE).

• Verbs simplify permissions:

o inspect < read < use < manage

(Each higher verb includes all lower-level ones.)

• Least privilege principle:

Grant the minimum necessary permissions by using:

o Specific resource targets (e.g., only one bucket)

o Conditional clauses ([Link], [Link])

o Limited verbs (avoid “manage” unless essential)

• Examples:

o Allow create-only access → restrict to OBJECT_CREATE.

o Prevent deletion → use [Link] != 'VOLUME_DELETE'.

o Limit time-based access → use time-based variables.

5. Tag-Based Access Control

• Tags allow policy control based on metadata (key–value pairs).

• Tag placement:
 o On the requester (group, user, compartment)

o On the target resource or target compartment

• Variables:

o Requester tags → [Link].<namespace>.<key>

o Target tags → [Link].<namespace>.<key>

• Use cases:

o Grant access to all groups tagged “Admin” → no need to edit policy for new
groups.

o Allow testers access to all compartments tagged “Test.”

• Benefits:

o Policies span multiple compartments/resources.

o Access can be granted or revoked by changing tags, not by editing policies.

• Note: Not all OCI services support [Link] (refer to documentation).

6. Network Sources

• Control access based on originating IP addresses.

• Two-step setup:

1. Define a network source object (list of allowed IPs).

2. Write a policy with a condition:

where [Link] = 'OfficeNetwork'

• Use cases: Restrict access to trusted IPs, office networks, or VCNs.

• Adds a location-based security layer to IAM policies.

7. Dynamic Groups

• Dynamic Groups = Collections of resource principals (like instances, DBs, functions)

that change automatically.

• Purpose: Let OCI resources (not just users) make API calls to other services.
 • Defined using matching rules, e.g.:

o [Link] = '[Link]...'

o [Link] = 'dbaas'

• Workflow:

1. Create Dynamic Group

2. Define membership rule

3. Write policy granting actions to that dynamic group.

• Examples:

o Instance calling Object Storage.

o Database writing backups to Object Storage.

• Benefits: Automatic membership updates, reduced admin effort, flexible machine-to-

machine access.

8. Optimizing IAM Policies

• Reasons to optimize:

o Prevent policy duplication and redundancy.

o Avoid exceeding OCI limits on policies/statements.

o Improve performance and simplify audits.

• Best practices:

o Remove exact duplicate statements.

o Avoid redundant policies in child compartments (inheritance already covers

them).

o Consolidate permissions using higher-level verbs instead of repeating granular

ones.

o Implement clear ownership and review processes for policy management.

• Remember: When multiple policies apply, OCI grants the maximum permission from
all applicable policies.
 Key Takeaways

• Policies can inherit, attach, or extend through conditions and tags.

• Granularity and least privilege are essential for secure design.

• Dynamic groups and network sources add automation and network-level control.

• Tag-based policies simplify large-scale environments.

• Optimization ensures security, clarity, and system efficiency.

Lesson Summary: Granular Access Control in OCI Object Storage

1. Overview

This lesson explains how Oracle Cloud Infrastructure (OCI) Identity and Access Management
(IAM) supports granular, object-level access control within Object Storage.
Granular access control enables administrators to define highly specific permissions — down to
individual files — improving both security and flexibility, especially for large-scale workloads
like data lakes, IoT data, and big data environments.

2. Object Storage Basics

• OCI Object Storage is a durable, scalable, and high-performance service designed for
storing unstructured data (files, images, videos, etc.).

• Data is organized as:

o Buckets: Containers that hold data.

o Objects: Individual files or data items within a bucket.

• Access management applies at two levels:

o Bucket-level policies – control actions on entire buckets.

o Object-level policies – control actions on specific objects or subsets of objects.

3. Policy Scope and Granularity

 • IAM policies can be defined at the tenancy or compartment level, automatically
covering all buckets and objects in that scope.

• For finer control, administrators can add conditions that target specific buckets or
objects.
Example:

• Allow group DataCreators to manage objects in bucket BucketA

• where [Link] = 'BucketA'

• and [Link] in ('OBJECT_CREATE', 'OBJECT_INSPECT')

• This limits users to specific actions (like creating or viewing objects) within a defined
bucket.

4. The Need for Object-Level Permissions

• In shared buckets with multiple datasets (e.g., active projects, archives), different users
or groups may need different access levels to specific datasets.

• Examples:

o Group 1 → Read & Write access to dataset 1

o Group 2 → Read & Copy access to the same dataset

• To support this, OCI allows defining object-level permissions using the variable:

• [Link]

• This enables permissions at the object or folder level — for example, controlling access
to certain files within a bucket.

5. How Object-Level Policies Work

• The [Link] variable refines access beyond the bucket, down to specific files
or directories.

• Common permissions used:

o OBJECT_READ

o OBJECT_WRITE
 o OBJECT_DELETE

o OBJECT_INSPECT

o OBJECT_CREATE

o OBJECT_COPY

• This allows precision control, such as:

o Allowing users to upload new files but not delete existing ones.

o Restricting visibility to only a subset of objects within a bucket.

6. Practical Examples

Example 1: Folder-Level Full Access

Grant full access (read, write, delete) to all objects in the “prod” folder within a bucket:

where [Link] = 'production*'

Restricts access to objects beginning with “production” inside that bucket.

Example 2: Read-Only Access

Grant a group permission to only view or read objects:

where [Link] in ('OBJECT_INSPECT', 'OBJECT_READ')

Prevents creation, deletion, or overwriting.

Example 3: Write-Once Access

Allow creation and reading, but disallow updates or listing of all objects in a specific folder
(e.g., development).
Useful when users should upload or view files but not browse or edit all contents.

Example 4: Targeted File-Type Access

Grant a specific user full access to only PDF files in test-bucket:

where [Link] = '*.pdf'

and [Link] = '<User_OCID>'

Ensures only that user can list, read, write, delete, or copy .pdf files.
7. Benefits of Object-Level IAM

• Enhanced Security: Restrict actions (read, write, delete, copy) at the most precise level.

• Flexibility: Different users or groups can have different permissions within the same
bucket.

• Scalability: Works well with large data environments containing millions of objects.

• Simplified Management: Policies can be applied by object patterns or metadata,

reducing complexity.

8. Key Takeaways

• Granular IAM allows precise, condition-based access control within Object Storage.

• The [Link] variable is critical for object-level permissions.

• You can combine permissions, conditions, and patterns to enforce flexible, fine-grained
access.

• Ideal for use cases like:

o Folder-specific permissions

o Read-only or write-once restrictions

o File-type-based access

o Multi-application data sharing

Perfect — we’ll now create 40 high-quality Multiple-Choice Questions (MCQs) covering

both of your last two lesson summaries:

1. OCI IAM Advanced Policy Management

2. Granular Access Control in OCI Object Storage

Each question includes four options (A–D), the correct answer, and a brief explanation for
clarity.
 OCI IAM & Object-Level Access Control – 40 MCQs with Answers & Explanations

1.

Which of the following statements best describes policy inheritance in OCI IAM?
A. Policies flow upward from child compartments to parent compartments.
B. Policies apply only to the compartment they’re attached to.
C. Policies attached to a parent compartment automatically apply to all child compartments.
D. Policies only apply when explicitly linked to users.

Answer: C
Explanation: OCI IAM policy inheritance ensures that permissions in parent compartments are
automatically applied to all child compartments.

2.

What determines who can modify or delete a policy in OCI IAM?

A. The group that created the policy.
B. The level at which the policy is attached.
C. The policy’s name prefix.
D. The policy’s OCID.

Answer: B
Explanation: Policies attached at the root can be modified only by tenancy administrators, while
policies in compartments are managed by that compartment’s admins.

3.

Which OCI IAM condition variable allows filtering based on a resource’s name or attributes?
A. [Link]
B. [Link]
C. [Link]
D. [Link]

Answer: B
Explanation: The [Link] variable specifies the name of the target bucket in
conditional IAM statements.
4.

What does the where clause in an IAM policy do?

A. Specifies the policy location.
B. Defines fine-grained conditions for access control.
C. Sets the default permission level.
D. Limits access to specific API endpoints.

Answer: B
Explanation: The where clause refines permissions using conditions like region, compartment,
or resource name.

5.

Which logical operators are used in conditional IAM statements?

A. not and between
B. sum and join
C. any and all
D. and and or

Answer: C
Explanation: OCI IAM uses any (logical OR) and all (logical AND) to evaluate multiple conditions.

6.

In OCI IAM, which verb provides full control over a resource?

A. use
B. read
C. inspect
D. manage

Answer: D
Explanation: The manage verb encompasses all actions, including inspect, read, and use.

7.
The principle of least privilege in IAM recommends:
A. Giving all users manage permissions for flexibility.
B. Granting only necessary access to perform specific tasks.
C. Allowing all users temporary access.
D. Denying all access by default.

Answer: B
Explanation: Least privilege ensures security by granting only the permissions required for a
specific role.

8.

Tag-based access control policies use which variable for requester tags?
A. [Link]
B. [Link].<namespace>.<key>
C. [Link]
D. [Link]

Answer: B
Explanation: Requester tags use this syntax to define tag-based conditions for groups or users.

9.

Which policy condition limits access by IP address or CIDR block?

A. Dynamic group
B. Tag policy
C. Network source
D. Security list

Answer: C
Explanation: A network source defines trusted IPs or networks to restrict access based on
location.

10.

Dynamic Groups in OCI allow:

A. Organizing users manually.
B. Automatically grouping resource principals like instances.
C. Controlling human user permissions only.
D. Managing subnet rules.

Answer: B
Explanation: Dynamic groups automatically group OCI resources (like compute instances) to
allow API access via IAM policies.

11.

Which statement about policy optimization is TRUE?

A. Policies should be duplicated for redundancy.
B. Multiple overlapping policies increase performance.
C. Duplicate or redundant policies should be removed.
D. Policies cannot be optimized.

Answer: C
Explanation: Removing redundant or duplicate policies simplifies management and improves
security.

12.

If multiple policies apply to a user, OCI grants:

A. The minimum permissions.
B. The maximum permissions.
C. Only read permissions.
D. Permissions from the most recent policy.

Answer: B
Explanation: OCI applies the union of all applicable permissions, giving the maximum level
allowed.

13.

Which IAM variable allows conditions based on the type of permission requested?
A. [Link]
B. [Link]
C. [Link]
D. [Link]
 Answer: A
Explanation: [Link] filters access depending on specific actions (e.g., create,
delete).

14.

Object-level IAM policies are mainly used in which OCI service?

A. Compute
B. Object Storage
C. Networking
D. Identity Domains

Answer: B
Explanation: Granular object-level access control applies to OCI Object Storage for managing
file-level permissions.

15.

A bucket in OCI Object Storage is best described as:

A. A user account.
B. A compute instance.
C. A container for storing objects.
D. A database table.

Answer: C
Explanation: Buckets act as containers that organize and store unstructured data (objects).

16.

Which IAM variable provides fine-grained control at the object level?

A. [Link]
B. [Link]
C. [Link]
D. [Link]

Answer: B
Explanation: [Link] allows you to specify access to individual objects or folders.
17.

What is a single-object family policy?

A. Policy granting access to one specific OCI service.
B. Policy that targets both buckets and objects together.
C. Policy that creates new compartments.
D. Policy for assigning roles to users.

Answer: B
Explanation: A single-object family policy combines permissions for buckets and objects under
one statement.

18.

In object-level policies, the pattern 'production*' is used to:

A. Match all objects beginning with “production”.
B. Deny all access to production data.
C. Grant access to a specific file only.
D. Apply permissions to all buckets.

Answer: A
Explanation: The wildcard * matches all object names that start with “production”.

19.

Which permissions allow only reading and viewing objects?

A. OBJECT_READ and OBJECT_INSPECT
B. OBJECT_CREATE and OBJECT_DELETE
C. OBJECT_MANAGE
D. OBJECT_USE

Answer: A
Explanation: These two permissions restrict users to viewing object metadata and content
without modifying them.

20.
Which condition would limit a user to accessing only .pdf files?
A. where [Link] = 'PDF'
B. where [Link] = '*.pdf'
C. where [Link] = 'PDF'
D. where [Link] = '*.pdf'

Answer: B
Explanation: Pattern matching on [Link] enables file-type-based access control.

21.

To grant a user access to upload but not delete objects, you would allow:
A. OBJECT_DELETE
B. OBJECT_CREATE and OBJECT_READ
C. OBJECT_MANAGE
D. OBJECT_USE

Answer: B
Explanation: Create and read allow adding and viewing data while preventing deletions.

22.

Which of these workloads benefits most from granular object-level IAM?

A. Web hosting
B. IoT data collection
C. VCN routing
D. Compute scaling

Answer: B
Explanation: IoT and big data workloads often need secure, fine-grained control for millions of
stored objects.

23.

Object-level IAM improves security by:

A. Allowing bucket-wide deletion.
B. Restricting specific actions like read, write, or delete.
C. Allowing anonymous public access.
D. Disabling IAM for objects.

Answer: B
Explanation: Object-level IAM restricts actions at the file or folder level, enhancing data
security.

24.

Which statement is TRUE about OCI Object Storage?

A. It supports only structured data.
B. It is not durable.
C. It automatically stores multiple data copies.
D. It cannot scale for big data workloads.

Answer: C
Explanation: OCI Object Storage ensures durability by replicating data across multiple locations.

25.

Granular object IAM is defined primarily using:

A. Tags
B. Conditions
C. Network sources
D. Security lists

Answer: B
Explanation: Conditions in IAM policies (like [Link]) define object-level granularity.

26.

Which of the following permissions prevents a user from listing objects but allows creating
them?
A. OBJECT_DELETE
B. OBJECT_CREATE
C. OBJECT_MANAGE
D. OBJECT_INSPECT
 Answer: B
Explanation: OBJECT_CREATE allows uploading objects without granting the ability to list them.

27.

An OCI IAM tag-based policy can be modified by changing:

A. The group name only.
B. The tag values instead of the policy text.
C. The compartment name.
D. The policy OCID.

Answer: B
Explanation: Tag-based access control allows granting or revoking access simply by modifying
tag values.

28.

Which OCI IAM concept groups compartments under a parent compartment?

A. Dynamic group
B. Policy inheritance
C. Network source
D. Tag namespace

Answer: B
Explanation: Policy inheritance ensures that parent policies apply to all nested child
compartments.

29.

What is the purpose of network source policies?

A. Define IAM groups
B. Restrict access by IP or VCN
C. Create dynamic groups
D. Control object replication

Answer: B
Explanation: Network sources control access by specifying trusted IPs or VCNs.
30.

A dynamic group membership rule uses which attribute?

A. [Link]
B. [Link]
C. [Link]
D. [Link]

Answer: B
Explanation: Dynamic group rules often use compartment IDs or resource types to determine
membership.

31.

Which IAM permission is the most restrictive?

A. manage
B. use
C. read
D. inspect

Answer: D
Explanation: inspect allows only viewing metadata and is the least privileged verb.

32.

Tag-based access control can apply to:

A. Requesters and target resources
B. Only policies
C. Only compartments
D. Only dynamic groups

Answer: A
Explanation: Tags can be attached to both requesters (users/groups) and target resources.

33.
Object IAM supports pattern matching for:
A. API keys
B. Object names
C. Policy OCIDs
D. Network CIDRs

Answer: B
Explanation: Pattern matching (*, ?) applies to [Link] for flexible access control.

34.

What is one major benefit of optimizing IAM policies?

A. Reduces redundancy and improves readability.
B. Disables inheritance.
C. Prevents conditional policies.
D. Merges user accounts.

Answer: A
Explanation: Optimization reduces duplication and simplifies audits and performance.

35.

In a policy, [Link] != <OCID> means:

A. Include that compartment.
B. Exclude that compartment.
C. Create that compartment.
D. Rename that compartment.

Answer: B
Explanation: The “not equal” condition excludes access to the specified compartment.

36.

Which policy scope covers all compartments in a tenancy?

A. Bucket scope
B. Compartment scope
C. Root tenancy scope
D. Object scope
 Answer: C
Explanation: A policy attached to the root tenancy applies to all compartments.

37.

Dynamic groups are especially useful for:

A. Human user authentication.
B. Resource-to-resource API access.
C. MFA configuration.
D. Manual user grouping.

Answer: B
Explanation: Dynamic groups enable resources like instances to authenticate and access
services via IAM.

38.

Which OCI IAM feature provides access control based on file type?
A. Network source
B. Tagging
C. Object-level policies
D. Compartments

Answer: C
Explanation: Object-level policies use [Link] patterns like *.pdf to filter access by
file type.

39.

The wildcard * in object IAM policies represents:

A. An empty object.
B. Any sequence of characters.
C. A policy comment.
D. A bucket delimiter.

Answer: B
Explanation: The wildcard * matches any sequence of characters in object names.
40.

What is the overall benefit of granular object-level IAM?

A. Reduces performance.
B. Provides fine-grained, secure control for large-scale data management.
C. Increases redundancy.
D. Restricts all access globally.

Answer: B
Explanation: Granular IAM enhances flexibility and security for workloads like data lakes and IoT
applications.