Details for Public Safety and Security Policies
Configure the Identity Domain service policy, user access to Public Safety and Security instances and work requests, and read access to metrics, Events rules, and Audit records.
Use OCI IAM policies for three purposes: authorize Public Safety and Security service access to your Identity Domain, authorize user groups to manage Public Safety and Security instances and work requests, and authorize user groups to view metrics and event-related resources. These grants are separate; managing Public Safety and Security instances doesn't automatically grant Monitoring, Events, or Audit access.
These IAM policies don't grant Oracle Radio application permissions. Configure Radio group permissions separately. Start with the setup steps before creating an instance.
Required Identity Domain Service Policy
An IAM administrator must add the following statements before you create a Public Safety and Security instance. They authorize application-service creation, lookup, and deletion, and user lookup in the selected Identity Domain.
Create this policy in the tenancy's root compartment, even when the Public Safety and Security instance is in a child compartment. Don't create it only in the instance's compartment. The Identity Domain OCID condition limits access to the specified domain.
Add both statements to the same policy in your tenancy's root compartment. Enter each statement on a separate line and replace the <identity-domain-OCID> placeholders in both statements. Each statement authorizes different principals.
Replace <identity-domain-OCID> with the OCID of the Identity Domain selected for the Public Safety and Security instance.
Allow any-user to {idcs_appservice_create, idcs_appservice_get, idcs_appservice_delete, idcs_user_viewer} in tenancy where all {request.principal.type = 'domain', request.app.provisioning.principal.name = 'pss', request.app.provisioning.principal.type = 'service', target.resource.domain.id = '<identity-domain-OCID>'}
Allow service pss to {idcs_user_viewer} in tenancy where target.resource.domain.id = '<identity-domain-OCID>'Follow the setup steps to confirm the required Identity domain settings, verify the initial administrator, and create the policy.
Resource Types
The following resource types identify the Public Safety and Security resources that OCI IAM policies can authorize.
| Resource type | Purpose |
|---|---|
pss-instance | An individual Public Safety and Security instance. |
pss-work-request | A work request for an asynchronous Public Safety and Security operation. |
pss-instance-family | The aggregate resource type for Public Safety and Security instances and work requests. |
Permissions for Public Safety and Security Instances
The access level is cumulative from inspect through manage.
| Verb | Included permissions | Operations added at this level |
|---|---|---|
inspect | PSS_INSTANCE_INSPECT | ListInstances |
read | inspect + PSS_INSTANCE_READ | GetInstance |
use | read + PSS_INSTANCE_UPDATE | UpdateInstance |
manage | use + PSS_INSTANCE_CREATE, PSS_INSTANCE_MOVE, and PSS_INSTANCE_DELETE | CreateInstance, ChangeInstanceCompartment, and DeleteInstance |
Permissions for Public Safety and Security Work Requests
The access level is cumulative from inspect through manage.
| Verb | Included permissions | Operations added at this level |
|---|---|---|
inspect | PSS_WORK_REQUEST_INSPECT | ListWorkRequests |
read | inspect + PSS_WORK_REQUEST_READ | GetWorkRequest, ListWorkRequestErrors, and ListWorkRequestLogs |
manage | read + PSS_WORK_REQUEST_DELETE | CancelWorkRequest |
Sample Policies
Let a group manage Public Safety and Security instances and work requests in a compartment:
allow group <group-name> to manage pss-instance-family in compartment <compartment-name>Let a group inspect Public Safety and Security instances in a compartment:
allow group <group-name> to inspect pss-instance in compartment <compartment-name>Let a group read Public Safety and Security work requests in a compartment:
allow group <group-name> to read pss-work-request in compartment <compartment-name>Read Metrics, Events Rules, and Audit Records
Depending on your configuration, if you want to read metrics, events, or audit records, an IAM administrator must grant the following read-only access to a user group. Replace the group and compartment names with the intended OCI IAM group and the compartment containing the metrics, rules, or audited resources. Choose only the statements the group needs.
Lets a group read Public Safety and Security metrics in the oci_pss namespace, For more information about user authorizations for monitoring, see IAM Policies. For Administrators, find common policies that give groups access to metrics, see Metric Access for Groups:
Allow group <group-name> to read metrics in compartment <compartment-name> where target.metrics.namespace = 'oci_pss'List and view OCI Events rules in the compartment:
Allow group <group-name> to read cloudevents-rules in compartment <compartment-name>View OCI Audit records for activity in the compartment:
Allow group <group-name> to read audit-events in compartment <compartment-name>Reading Events rules isn't the same as reading event payloads or Audit records. These read policies don't authorize creating alarms, creating or changing Events rules, or reading a rule's destination. Those actions need their own policies. See metrics access and event access.
The root-compartment requirement above applies to the Identity Domain service policy. These group policies are scoped to the named compartment; and do not grant read access across the entire tenancy.