In this video, I'll show you how to perform compartment and policy administration on the
Oracle Private Cloud Appliance.
To review, in the User and Group Administration video, you were introduced to the Identity
and Access Management, or IAM service, and you were introduced to
the following IAM components.
Users manage your cloud resources such as compute instances, block storage volumes,
and virtual cloud networks.
Groups are a collection of users who need the same type of access to a particular set
of cloud resources or to a compartment.
A compartment is a collection of related resources and are a fundamental component for organizing
and isolating your cloud resources.
A policy specifies who can access which cloud resources and how.
In this video, I'll demonstrate how to create a compartment and how to create policies which
will allow a user to manage cloud resources in the new compartment.
I'm logged in to the Oracle Private Cloud compute enclave web interface as the admin
user.
From the dashboard, I'll select Identity and then Groups to show that I have a group named
demo_group and a user named demo_user who is a member of the group.
First I'll create a compartment.
Go back to the dashboard and select Identity and then Compartments.
You can have multiple compartments in a tenancy.
Here we see 3 compartments already exist in this tenancy.
Some other things to note about compartments, After initial setup, your tenancy only contains
a root compartment.
You can create a hierarchy up to six compartments deep under the tenancy or root compartment.
Compartments behave like a filter for viewing resources.
When you select a compartment, the Compute Web UI only shows you resources that are in
that compartment.
To view resources in another compartment, you must first select that compartment.
It's also important to note that users, groups, and federation providers reside in the tenancy
itself, not in an individual compartment.
I'll click Create Compartment.
I'll name my compartment demo_compartment.
I'll provide a description.
Docs is the tenancy that I'm in.
Recall that you are prompted to provide a tenancy when you first log in to the Compute
Enclave Web UI.
I could select an alternate compartment but I'll choose Docs.
And then I'll click Create Compartment.
After a few seconds, the new compartment appears in the list.
Because I'm logged in as the admin user, I can immediately create resources in this new
compartment.
For example, I'll return to the dashboard then I'll click the Networking panel.
From here I can select my new demo_compartment from the drop-down list.
And I can click Create Virtual Cloud Network to create a new VCN in this compartment.
I won't go through the entire process but notice that no errors appear and I do actually
have permission, as the admin user, to create a new VCN in
this compartment.
The reason that the admin user has permission is because of a policy.
You can grant users access to specific compartments through the use of policy statements.
Users can then create resources in this compartment and isolate these resources from other users.
I'll close this window and from the hamburg menu I'll select Identity and then Policies.
No policies exist in demo_compartment but if I select the Docs tenancy, we see an Admin
policy.
I'll click on this policy name and scroll down to view the statements.
One statement exists for this policy which says "allow group Administrators to manage
all-resources in tenancy".
The admin user is a member of this group, therefore, the admin user can manage all resources
in the Docs tenancy.
I'll add a couple more bullets to our Policy Overview list.
A basic feature of policies is the concept of inheritance.
Compartments inherit any policies from their parent compartment or tenancy.
The docs tenancy is a parent of our newly created demo compartment, therefore the demo
compartment inherits this policy.
So now we know why the admin user can create a resource in the demo comparment, let's try
to create a resource in this compartment as the demo user.
I've logged out as admin and logged back in as demo user.
I'll click the Networking panel and I immediately start getting errors and keep getting kicked
back to the dashboard.
I'll dismiss these errors and keep retrying and can eventually get to the VCN window.
But as soon as I click Create Virtual Cloud Network, I get more errors and I'm kicked
back to the dashboard.
The problem of course is lack of a policy.
If I tried to create a policy as the demo user, I would continue to get errors so I
need to create the policy as the admin user.
I've logged out as demo user and logged back in as admin.
Let's look at the existing policy again and go over the syntax of a policy statement.
I'll select Identity then select Policies.
I'll select the Docs tenancy, to see an Admin policy.
I'll click on this policy name and scroll down to view the statement.
The policy statement says "allow group Administrators to manage all-resources in tenancy".
This policy statement follows this basic syntax: Allow to
in where First of all policy statements begin with
the word allow.
Policies only allow access, they cannot deny it.
The subject can be a group name, the group OCID, or the phrase any-user to specify all
users in a tenancy.
You can specify multiple groups by separating them with commas.
For location, specify a single compartment by name or OCID or specify tenancy to cover
the entire tenancy.
Given that our demo_user is a member of demo_group, we can just change the subject and the location
in the original policy statement and write a new policy statement
to allow our demo user to create a resource in our new demo
compartment.
That statement would be "allow group demo_group to manage all-resources in compartment demo_compartment".
The subject has been changed to group demo_group.
The verb continues to be manage and we'll discuss other verb options.
The resource-type continues to be all-resources and again, there are other resource-types.
The location has been changed to compartment demo_compartment.
This should work, let's give it a try.
I'll scroll up and select Identity then Policies from the dashboard.
I'll click Create Policy.
I'll name my policy demo_policy.
I'll give it a description.
I'll create this policy in the Docs tenancy, even though I'll specify demo_compartment
in the statement.
And for the statement I'll enter, allow group demo_group to manage all-resources in compartment
demo_compartment.
I'll click Create and now my new policy appears.
I can scroll down to view the statement and all looks well.
To test this, I've logged out as admin and logged in as demo_user.
Since I can manage all-resources, I'll begin by trying to create a block storage volume.
I'll click the Block Storage panel on the dashboard.
I'll select my demo_compartment from the drop-down list.
I'll click Create Block Volume.
I'll give my volume a name and click Create Block Volume.
My volume is Provisioning and now it's Available confirming that I do have permissions to create
this resource type.
To verify that I have permissions to create all resource-types, I'll attempt to create
a VCN.
From the hamburg menu, I'll select Networking then Virtual Cloud Networks.
My demo_compartment is already selected.
I'll click Create Virtual Cloud Network.
I'll give my VCN a name and a CIDR block.
I'll click Create Virtual Cloud Network.
My VCN is Provisioning and now it's Available confirming that I also have permissions to
create this resource type.
Now suppose I only want my demo_user to be able to create a specific resource, for example
a virtual cloud network.
I don't want this user to be able to create any other types of resources.
Once again, you need to write a policy to provide these permissions.
I'll return to this slide and explain how.
The resource type can be a family resource type, an individual resource type, or all-resources
to cover all resources in the compartment or tenancy.
This table shows examples of family resource types and also some individual resource types.
For example, the volume-family resource type covers all individual resource types related
to block volumes.
The virtual-network-family resource type covers all individual resource types related to networking
services.
The family resource types make policy writing easier, as they include multiple individual
resource types that are often managed together.
If you need to write a more granular policy, use an individual resource type to give access
to only those specific resources.
So if I want my demo_user to be able to only create a VCN, and no other cloud resources,
in the demo compartment, I could use the statement:
"allow group demo_group to manage virtual-network-family in compartment demo_compartment"
The last couple things I'll briefly mention are verb options and conditions.
The verb options include inspect, read, use, and manage, ordered by increasing permissions.
Use the manage verb to perform administrator-type operations.
And finally, for conditions, you can specify a string value surrounded by single quotation
marks or you can use a pattern matching value.
Refer to the Oracle Private Cloud Appliance documentation for more information and for
examples of some common policy statements.
For additional training videos like this, go to oracle.com/goto/pcalearning.
This concludes this video.
Thank you for watching.