A user needs permission to manage users and groups within your OCI tenancy, but you want to ensure they cannot modify any cloud infrastructure resources (such as VCNs or Compute instances). What is the most precise tenancy-level IAM policy statement required to achieve this?
Trap 1: Allow user UserAdmins to inspect compartments in tenancy
Groups, not individual users, are the target of OCI IAM policies, and 'inspect compartments' does not grant user management permissions.
Trap 2: Allow group UserAdmins to manage all-resources in tenancy
This would grant full access to all infrastructure resources, violating the principle of least privilege.
Trap 3: Allow group UserAdmins to manage users in tenancy
User and group management in OCI identity falls under the identity-domains or general tenancy-level identity verbs depending on IAM configuration, but 'manage identity-domains' is the standard OCI IAM construct.
- A
Allow user UserAdmins to inspect compartments in tenancy
Why wrong: Groups, not individual users, are the target of OCI IAM policies, and 'inspect compartments' does not grant user management permissions.
- B
Allow group UserAdmins to manage all-resources in tenancy
Why wrong: This would grant full access to all infrastructure resources, violating the principle of least privilege.
- C
Allow group UserAdmins to manage users in tenancy
Why wrong: User and group management in OCI identity falls under the identity-domains or general tenancy-level identity verbs depending on IAM configuration, but 'manage identity-domains' is the standard OCI IAM construct.
- D
Allow group UserAdmins to manage identity-domains in tenancy
Identity domains or user management permissions allow handling users/groups without granting rights to compute, storage, or networking resources.