Oracle Cloud Infrastructure Documentation

Cloud Guard Policies

To control who has access to Oracle Cloud Guard, and the type of access for each group of users, you must create policies.

By default only the users in the Administrators group have access to all Cloud Guard resources. For everyone else who's involved with Cloud Guard, you must create new policies that assign them proper rights to Cloud Guard resources.

For a complete list of Oracle Cloud Infrastructure policies, see policy reference.

Resource Types

Cloud Guard offers both aggregate and individual resource types for writing policies.

You can use aggregate resource types to write fewer policies. For example, instead of allowing a group to manage cloud-guard-detectors and cloud-guard-problems, you can have a policy that allows the group to manage the aggregate resource type, cloud-guard-family.

Aggregate Resource Type Individual Resource Types
cloud-guard-family

cloud-guard-adhoc-query

cloud-guard-condition-metadata-types

cloud-guard-config

cloud-guard-coverage

cloud-guard-data-mask-rules

cloud-guard-data-sources

cloud-guard-detector-recipes

cloud-guard-detector-rule-definitions

cloud-guard-detectors

cloud-guard-findings

cloud-guard-managed-lists

cloud-guard-metadata

cloud-guard-meta-data-sync

cloud-guard-problems

cloud-guard-recommendations

cloud-guard-resource-profile

cloud-guard-resource-types

cloud-guard-resource-view

cloud-guard-responder-recipes

cloud-guard-responder-rules

cloud-guard-responder-executions

cloud-guard-risk-scores

cloud-guard-saved-query

cloud-guard-schemas

cloud-guard-security-scores

cloud-guard-service-logging

cloud-guard-signals

cloud-guard-summary-event

cloud-guard-target-detector-rules

cloud-guard-targets

cloud-guard-user-preferences

security-policy

security-recipe

security-zone

The APIs covered for the aggregate cloud-guard-family resource type cover every API listed under "Individual Resource Types" in the preceding table.

For example, 

allow group cloudguard-admins to manage cloud-guard-family in compartment <x>

...is the same as writing 20 policies with this format:

allow group cloudguard-admins to manage <resource_type> in compartment <x>
Note

If the Cloud Guard admins group is not in the default identity domain, you must include the <identity_domain_name>, followed by a forward slash ("/"), before the group name:

allow group <identity_domain_name>/cloudguard-admins to manage cloud-guard-family in compartment <x>

Details for Verbs + Resource-Type Combinations

Tables of permissions and API operations covered by each verb for Cloud Guard.

The level of access is cumulative as you go from inspect > read > use > manage. A plus sign (+) in a table cell indicates incremental access compared to the cell directly above it, whereas "no extra" indicates no incremental access. For more information on permissions in Oracle Cloud Infrastructure, see Permissions.

Permissions Required for Each API Operation

Tables listing the API operations in a logical order, grouped by resource-type.

The resource-types are listed in Resource Types, in the "Individual Resource-Types "column.

For information about permissions, see permissions.

Creating a Policy

Steps to create a policy to support Cloud Guard REST API calls.

Here's how you create a policy:

  1. Open the Console navigation menu and select Identity & Security, then select Identity, then select Policies.
  2. select Create Policy.
  3. Enter a name and description for the policy.
    Avoid entering confidential information.
  4. In the Statement field, enter a policy rule in the following format:

    allow service cloudguard to <verb> <resource_type> in <compartment or tenancy details>

  5. select Create.

For more information on creating policies, see how policies work and policy reference.

Policy Examples

Learn about Cloud Guard IAM policies using examples.

  • Allow users in the group SecurityAdmins to create, update, and delete all Cloud Guard resources in the entire tenancy:

    Allow group SecurityAdmins to manage cloud-guard-family in tenancy

  • Allow users in the group SecurityAdmins to create, update, and delete all security zones and recipes in the entire tenancy:

    Allow group SecurityAdmins to manage security-zone in tenancy
Allow group SecurityAdmins to manage security-recipe in tenancy

  • Allow users in the group SecurityAuditors to view the security zones and recipes in the compartment SecurityArtifacts:

    Allow group SecurityAuditors to read security-zone in compartment SecurityArtifacts
Allow group SecurityAuditors to read security-recipe in compartment SecurityArtifacts

For more policy examples, see Policy Statements for Users.