Policy Examples

Important

Pre-General Availability: 2024-10-11

The following legal notice applies to Oracle pre-GA releases. For copyright and other applicable notices, see Oracle Legal Notices.

Pre-General Availability Draft Documentation Notice

This documentation is in pre-General Availability status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

When writing policies, you can use the Administrators group for tenancy management, for example:

allow group Administrators to manage wlms-managed-instances in tenancy
allow group Administrators to manage wlms-wlsdomains in tenancy
allow group Administrators to manage wlms-family in tenancy

You can also simplify permissions by combining policy statements where multiple groups require the same permissions. For example, these policy statements:

allow group <user-grp-01> to inspect wlms-wlsdomains in tenancy
allow group <user-grp-01> to inspect wlms-work-requests in tenancy
allow group <user-grp-02> to inspect wlms-wlsdomains in tenancy
allow group <user-grp-02> to inspect wlms-work-requests in tenancy

Can become:

allow group <user-grp-01>,<user-grp-01> { WLMS_WLSDOMAIN_INSPECT, WLMS_WORK_REQUEST_INSPECT } in tenancy

Example policies restricting user group

The examples provided are sample policies used to restrict resource or compartment access for a particular user group. The tenancy in these examples has the following compartment structure:

root compartment (tenancy)
- <dev> compartment
  - <test> subcompartment of <dev>
- <prod> compartment

Admin user with tenancy permissions

For this example:

The dynamic group is <wlms-dyn-grp>. The rule statements include OCI instances in the root compartment (tenancy), <dev> compartment, <test> subcompartment, and <prod> compartment.
The user belongs to the user group <wlms-admin-grp> which is allowed to manage all resources within the tenancy.

Policy statements

Allows the dynamic group to view and scan managed instances in a specific compartment.

allow dynamic-group <wlms-dyn-grp> to {WLMS_MANAGED_INSTANCE_USE} in tenancy where target.compartment.id='<dev_compartment_ocid>'

Allows the user group to view, scan and update all managed instance in the tenancy.
```
allow group <wlms-admin-grp> to use wlms-managed-instances in tenancy
```
Allows the user group to use, update, restart, patch and move all domains in the tenancy.
```
allow group <wlms-admin-grp> to use wlms-wlsdomains in tenancy
```
Allows the user group to manage all resources in the tenancy.
```
allow group <wlms-admin-grp> to manage wlms-family in tenancy
```

Admin user restricted to a compartment

For this example:

The user belongs to the user group wlms-admin-grp-dev which can manage all resources within the <dev> compartment and <test> subcompartment.

Policy statements

Allows the user group to manage all WebLogic Management Service resources in the <dev> compartment. Policies use compartment inheritance, so the user will also be able to manage resources in any subcompartments of <dev> (in this example, <test>).
```
allow group <wlms-admin-grp-dev> to manage wlms-family in compartment <dev>
```

Allows the user group to read managed instances in the root compartment.

allow group <wlms-admin-grp-dev> to read wlms-managed-instances in tenancy where target.compartment.id = '<tenancy_ocid>'

Allows the user to use managed instances in the dev compartment.

allow group <wlms-admin-grp-dev> to use wlms-managed-instances in compartment <dev>

Allows the user to use, update, restart, patch, move, and delete domains in the dev compartment.
```
allow group <wlms-admin-grp-dev> to manage wlms-wlsdomains in compartment <dev>
```

User restricted to a compartment

For this example:

The dynamic group is <wlms-instances>. The rule statement includes the plugin agent resource in the <prod> compartment.
The user belongs to the user group <wlms-users> which can read all WebLogic Management resources within the <prod> compartment.

Policy statements

Allows the agent on the managed instances to interact with WebLogic Management.

allow dynamic-group <wlms-instances> to {WLMS_MANAGED_INSTANCE_PLUGIN_ACCESS} in compartment prod where request.principal.id = target.managed-instance.i

Allows the user group to view all WebLogic Management resources in the <prod> compartment.
```
allow group <wlms-users> to read wlms-family in compartment <prod>
```

Advanced Example Policies

The advanced WebLogic Management examples provided are sample policies used to restrict resource or compartment access for a particular user group.

Allow a user group to only view WebLogic Management resources

Type of access: Ability to view all compute instances in a compartment on which the WebLogic Management plugin is enabled, the WebLogic Server domains and servers discovered by the WebLogic Management plugin, and all configuration settings. With this policy a user in the group cannot perform any service actions that could change the state of the WebLogic Server domains.

When to use: This policy is useful when you want to control access to a compartment where you have your production WebLogic Server domains.