How OCI made simple to IAM Service lets you control who has access to your cloud resources!

Oracle Cloud Infrastructure Identity and Access Management (IAM) Service lets you control who has access to your cloud resources. 

Prerequisites:

1. You should have OCI account created.

2. OCI basic understanding

Login to your OCI and Create the Compartment 

                       

In left pane, Identity & Security -> Identity -> Compartments then create your Compartment

Once you create, you should be able to see as –

      Managing Users, Groups and Policies to Control Access

We should create a user, a group, and a security policy to understand the concept.

Again, login to OCI console and Menu -> Identity & Security -> Groups 

Below are my policy statements –

Policy Statements

Allow group oci-testgroup1 to inspect users in compartment vishwa-test1

Allow group oci-testgroup1 to inspect groups in compartment vishwa-test1

Allow group oci-testgroup1 to use users in compartment vishwa-test1 where target.group.name != 'Administrators'

Allow group oci-testgroup1 to use groups in compartment vishwa-test1 where target.group.name != 'Administrators'

Now, create the new user:

Verify user permissions

a) Go to the Menu, click Compute and then click Instances.

b) Try to select any compartment from the left menu.

c) The message “You don’t have permission to view these resources” appears. This is normal as you did not add the user to the group where you associated the policy.

Sign Out as ‘testuser01’

 

Add User to a Group

a) Sign back in with the your Admin account.

b) On the Menu click Identity & Security, and then click Users. From the Users list, click the user account that you just created (for example, testuser01) to go to the User Details page.

Go to the Menu, click Identity and select Groups.

The message “Authorization failed or requested resource not found” appears. This is expected, since your user has no permission to modify groups. (Note: You may instead get the "An unexpected error occurred" message instead. That is also fine.)

Sign Out from testuser01

Happy Learning!