Managed Access Policies

Create Oracle Cloud Infrastructure Identity and Access Management (IAM) policies to control who has access to Oracle Managed Access resources, and the type of access for each group of users.

By default, only users in the Administrators group have access to all Managed Access resources. If you're new to IAM policies, see Getting Started with Policies. The supported Oracle Managed Access policies use the term lockbox to see an Oracle Managed Access resource.

For a complete list of all policies in Oracle Cloud Infrastructure, see the Policy Reference.

Note

Oracle Managed Access is only supported for Fusion Applications customers who subscribe to Break Glass.

Details for Oracle Managed Access

This topic covers details for writing policies to control access to the Managed Access service.

Resource-Types

The following resource types are related to Oracle Managed Access.

This topic covers details for writing policies to control access to Managed Access resources.

Resource Type Permissions
lockboxes

LOCKBOXES_INSPECT

LOCKBOXES_READ

LOCKBOXES_CREATE

LOCKBOXES_UPDATE

LOCKBOXES_DELETE

LOCKBOXES_MOVE

approval-templates

APPROVAL_TEMPLATES_INSPECT

APPROVAL_TEMPLATES_READ

APPROVAL_TEMPLATES_CREATE

APPROVAL_TEMPLATES_UPDATE

APPROVAL_TEMPLATES_DELETE

APPROVAL_TEMPLATES_MOVE

APPROVAL_TEMPLATES_ATTACH

access-requests

ACCESS_REQUESTS_INSPECT

ACCESS_REQUESTS_READ

ACCESS_REQUESTS_CREATE

ACCESS_REQUESTS_ACTION_HANDLE

access-approvals

ACCESS_APPROVALS_INSPECT

ACCESS_APPROVALS_READ

ACCESS_APPROVALS_CREATE

ACCESS_APPROVALS_ACTION_REVOKE

ACCESS_APPROVALS_RETRIEVE

A policy that uses <verb> lockbox-family is equal to writing a policy with a separate <verb> <resource-type> statement for each of the individual resource types.

Individual Resource-Types

lockbox

lockboxes

approval-template

approval-templates

access-request

access-requests

access-approval

access-approvals

Aggregate Resource-Types

lockbox-family

Supported Variables

Managed Access IAM policies support all the general policy variables.

For more information about general variables supported by Oracle Cloud Infrastructure services, see General Variables for All Requests.

Details for Verb + Resource-Type Combinations

View the permissions covered by each verb for Oracle Managed Access resources.

The level of access is cumulative as you go from inspect to read to use to manage.

A plus sign (+) in a table cell indicates incremental access when compared to the preceding cell, whereas no extra indicates no incremental access.

access-approval
Verbs Permissions
inspect

ACCESS_APPROVAL_INSPECT

read

+ inspect

ACCESS_APPROVAL_READ

use

+ read

ACCESS_APPROVAL_RETRIEVE

manage

+ use

ACCESS_APPROVAL_CREATE

ACCESS_APPROVAL_ACTION_REVOKE

access-request
Verbs Permissions
inspect

ACCESS_REQUEST_INSPECT

read

+ inspect

ACCESS_REQUEST_READ

use

+ read

manage

+use

ACCESS_REQUEST_CREATE

ACCESS_REQUEST_ACTION_HANDLE

approval-template
Verbs Permissions
inspect

APPROVAL_TEMPLATE_INSPECT

GROUP_INSPECT: Use when you specify a group in the approval template.

USER_INSPECT: Use when you specify a user in the approval template.

read

+ inspect

APPROVAL_TEMPLATE_READ

use

+ read

APPROVAL_TEMPLATE_ATTACH

manage

+ use

APPROVAL_TEMPLATE_CREATE

APPROVAL_TEMPLATE_UPDATE

APPROVAL_TEMPLATE_DELETE

APPROVAL_TEMPLATE_MOVE

lockbox
Verbs Permissions
inspect

LOCKBOX_INSPECT

read

+ inspect

LOCKBOX_READ

use

+ read

LOCKBOX_UPDATE

manage

+ use

LOCKBOX_CREATE

LOCKBOX_DELETE

LOCKBOX_MOVE

Permissions Required for Each API Operation

The following table lists the Managed Access API operations in a logical order, grouped by resource type.

For more information about permissions, see Managed Access policies.

Operations Permissions
ListLockboxes

LOCKBOX_INSPECT

CreateLockbox

LOCKBOX-CREATE

GetLockbox

LOCKBOX_READ

UpdateLockbox

LOCKBOX_UPDATE

LOCKBOX_UPDATE & APPROVAL_TEMPLATE_ATTACH

DeleteLockbox

LOCKBOX_DELETE

ChangeLockboxCompartment

LOCKBOX_MOVE

ListApprovalTemplates

APPROVAL_TEMPLATE_INSPECT

CreateApprovalTemplate

APPROVAL_TEMPLATE_CREATE

GROUP_INSPECT: Use when you specify a group in the approval template.

USER_INSPECT: Use when you specify a user in the approval template.

GetApprovalTemplate

APPROVAL_TEMPLATE_READ

UpdateApprovalTemplate

APPROVAL_TEMPLATE_UPDATE

GROUP_INSPECT: Use when you specify a group in the approval template.

USER_INSPECT: Use when you specify a user in the approval template.

DeleteApprovalTemplate

APPROVAL_TEMPLATE_DELETE

ChangeApprovalTemplateCompartment

APPROVAL_TEMPLATE_MOVE

ListAccessRequests

ACCESS_REQUEST_INSPECT

CreateAccessRequest

ACCESS_REQUEST_CREATE

GetAccessRequest

ACCESS_REQUEST_READ

HandleAccessRequest

ACCESS_REQUEST_CREATE

ACCESS_REQUEST_ACTION_HANDLE

GetAccessMaterials

ACCESS_REQUEST_CREATE

ListAccessApproval

ACCESS_APPROVAL_INSPECT

GetAccessApproval

ACCESS_APPROVAL_READ

CreateAccessApproval

ACCESS_APPROVAL_CREATE

GetAccessMaterials

ACCESS_APPROVAL_RETRIEVE

RevokeAccessApproval

ACCESS_APPROVAL_ACTION_REVOKE

Policy Examples

Learn about Oracle Managed Access IAM policies using examples.

  • Allow users in the group SecurityAdmins to create, update, and delete all Managed Access resources in the entire tenancy:

    Allow group SecurityAdmins to manage lockbox-family in tenancy
    Allow group operators to inspect access-request in compartment tenancy
    

For all policies, see Managed Access Policies.