Oracle Cloud Infrastructure Documentation

Manually Creating OS Management Hub Policies

For OS Management Hub, you must identify which resources the service can manage and which users can manage those resources.

To enable OS Management Hub, define the following:

Important

To enable the Resource Discovery and Monitoring feature, you must configure policies in addition to those outlined in the following sections. See Getting Started with Resource Discovery and Monitoring.

You can configure IAM policies in various ways. The following sections outline how to set the IAM policy statements for a group of OS Management Hub administrators by using a dynamic group of resources. See Example Policies for additional non-administrator use cases.

Tip

Instead of manually creating groups and policy statements, use the policy advisor to quickly enable OS Management Hub for a compartment.

User Group

Create a user group (such as osmh-admins) or identify an existing user group to administer the OS Management Hub service in the tenancy. The required policy statements then grant this administrator user group the ability to manage OS Management Hub resources.

If you need to further restrict access, you can create additional user groups and set more restrictive policy statements to limit access to specific resources. See Example Policies for non-administrator use cases. For more information about user groups, see Managing Groups.

Dynamic Group

Create a dynamic group (such as osmh-instances) to specify the resources OS Management Hub will manage by defining rule statements for OCI and on-premises or third-party cloud instances (non-OCI).

Ensure you understand the following:

Creating the dynamic group

  1. Follow the steps to create a dynamic group or update an existing dynamic group and configure the matching rules as follows.

    Tip

    Reuse the same dynamic group wherever possible across services instead of creating new dynamic groups because a single resource can only belong to a maximum of five dynamic groups.

  2. For the overall matching rule setting select: Match any rules defined below.

  3. Create rule statements for the instances that OS Management Hub will manage.

    Important

    Dynamic group rules don't use compartment inheritance. You must specify a rule statement for every compartment and subcompartment that contains instances you want managed by the service.

    Rule for OCI instances

    Add a rule statement that includes each compartment (and subcompartment) that will contain instances.

    ANY {instance.compartment.id='<compartment_ocid>',instance.compartment.id='<subcompartment_ocid>'}

    This rule will include all OCI instances in the specified compartments.

    Rule for non-OCI instances

    Add a separate rule statement for each compartment (and subcompartment) that will contain a Management Agent used by an instance.

    ALL {resource.type='managementagent', resource.compartment.id='<compartment_ocid>'}
ALL {resource.type='managementagent', resource.compartment.id='<subcompartment_ocid>'}

    Each rule statement will include every Management Agent resource in the specified compartment. Each non-OCI instance has a corresponding agent resource and therefore the statement will include the non-OCI instances in the compartment.

  4. Select Create (if creating) or Save (if updating).

Policy Statements

Create a policy (such as osmh-policies) with statements that allow instances to register with OS Management Hub and users to manage and operate the service.

Important

Policy statements use the default identity domain unless you define the identity domain before the group or dynamic group name (for example, <identity_domain_name>/<dynamic_group_name>). For more information, see Policy Syntax.
Prerequisites

Before creating the policy, ensure you have the following:

Using the Policy Builder

The policy builder provides templates for common policies used for OS Management Hub. Select a use case and then fill in the required information such as dynamic group or compartment to complete the policy statements. See Writing Policy Statements with the Policy Builder.

  1. Follow the steps in Creating a Policy, noting the following exceptions.
  2. For Policy use cases, select OS Management Hub.
  3. For Common policy templates, select one of the OS Management Hub common policies.

Common Policy Templates

The policy builder provides the following OS Management Hub common policy templates.

Manually Defining the Policy Statements

If not using the policy builder, you can manually define the policy statements. Create a new policy or modify an existing policy to include the following policy statements.

The following policy statements provide an example of how to provide administrators access to the service. For other use cases, see Example Policies.

Tenancy-level policy statements

To apply the required IAM policy at the tenancy level, use the following policy statements:

allow dynamic-group <osmh-instances> to {OSMH_MANAGED_INSTANCE_ACCESS} in tenancy where request.principal.id = target.managed-instance.id
allow group <osmh-admins> to manage osmh-family in tenancy

Include the following additional statements if managing on-premises or third-party cloud instances. These aren't required if managing only OCI instances.

allow group <osmh-admins> to manage management-agents in tenancy
allow group <osmh-admins> to manage management-agent-install-keys in tenancy
Compartment-level policy statements (if not using tenancy-level)

If the tenancy administrator doesn't permit setting IAM policies at the tenancy level, you can restrict the use of OS Management Hub resources to a compartment and its subcompartments (policies use compartment inheritance). To allow users to replicate vendor software sources and use service-provided profiles, the user group requires read access to profiles and software sources in the root compartment.

To apply the IAM policy to a compartment inside the tenancy, use the following policy statements:

allow dynamic-group <osmh-instances> to {OSMH_MANAGED_INSTANCE_ACCESS} in compartment <compartment_name> where request.principal.id = target.managed-instance.id
allow group <osmh-admins> to manage osmh-family in compartment <compartment_name>
allow group <osmh-admins> to read osmh-profiles in tenancy where target.profile.compartment.id = '<tenancy_ocid>'
allow group <osmh-admins> to read osmh-software-sources in tenancy where target.softwareSource.compartment.id = '<tenancy_ocid>'

Include the following additional statements if managing on-premises or third-party cloud instances. These aren't required if managing only OCI instances.

allow group <osmh-admins> to manage management-agents in compartment <compartment_name>
allow group <osmh-admins> to manage management-agent-install-keys in compartment <compartment_name>