Your search did not match any results.
Oracle Identity and Access Management (IAM) allows you to securely control access to all of your cloud resources.
The key concepts of IAM are:
With Oracle Cloud Infrastructure IAM, you can leverage a single model for authentication and authorization across all Oracle Cloud Infrastructure services. Oracle IAM makes it easy to manage access for organizations of all sizes, from one person working on a single project to large companies with many groups working on many projects at the same time, all within a single account. Resource management and authorization can happen at the account level or at the compartment level, while still allowing central auditing and billing.
Oracle IAM was built from the ground up to allow you to enforce the security principle of least privilege—by default, new users are not allowed to perform any actions on any resources. Administrators can then grant each user only the access appropriate for that specific user.
Oracle Cloud Infrastructure supports multi-factor authentication (MFA) natively through Identity and Access Management. Additionally, federated users can be authenticated with MFA through Oracle Identity Cloud Service or any supported third-party Identity Provider that supports MFA.
Yes. To support enterprise requirements for auditing and compliance, all changes are recorded and can be made available to you at no additional cost.
Oracle IAM is enabled by default at no additional charge. The very first user in your account is the default administrator. All subsequent users are created through the IAM service, where you explicitly grant them privileges to interact with specified cloud resources.
To reset your password for Oracle Cloud Infrastructure, you must first ensure that you have associated an email address with your account. Visit the user profile page for your Oracle Cloud Infrastructure account and add an email address that only you have access to. You will receive an email to confirm that you intended to register that address with your account. Then, you can reset your password with your email account unless it has been disabled by your tenant administrator.
A compartment is a secure logical container within your account used to host your infrastructure resources (such as compute, storage, and network), along with a set of access management policies for these resources. Compartments allow you to logically organize your cloud resources to support a wide variety of use cases.
The following are a few common ways to use compartments to:
Yes. Compartments are a logical groupings of resources distinct from the physical constructs of Availability Domains. An individual compartment can contain resources across Availability Domains.
All policies are attached to a compartment, which could be either the root compartment or a child compartment. Each policy consists of one or more policy statements that follow this basic syntax:
Policy statements allow you to use compartments to simplify permission management; for instance, you can write a policy that allows the group HRAdministrators to manage all resources in the compartment HRCompartment.
Yes, you can delete compartments.
No, at this time you cannot move entire compartments trees and their included resources.
No, at this time you cannot move resources from one compartment into another. Currently, we recommend that you create new resources in the required compartments.
Yes, you can create a hierarchy of compartments by nesting them. With hierarchical or nested compartments, the system administrator is able to organize resources and enable lower-level administrators to do the same, while still retaining full visibility and control via policy.
The maximum depth of a nested compartment is six.
Yes, policies on higher-level compartments do get inherited by sub compartments.
Yes, you can track costs and usage by compartments in My Services.
For each account, Oracle Cloud Infrastructure automatically creates a top-level compartment known as the root compartment. Much like the root folder in a file system, the root compartment behaves exactly like its child compartments, except for a few special characteristics:
Note: Currently, you can create additional compartments only within the root compartment, and not within other compartments.
Generally, resources should be created in a compartment that is not the root compartment. It is best to design your compartment hierarchy before you begin creating compartments and resources. Currently, resources cannot be moved from one compartment to another, and compartments cannot be edited or deleted.
A user is someone who can successfully authenticate against Oracle IAM, and who has sufficient privileges to either consume or manage cloud resources within your account. Administrators can create one or more users within their account, and assign them to groups in order to give them permissions to resources in specific compartments.
Your account is provisioned with a single user: the default administrator, and a single group: Administrators, of which the default administrator user is a member. This group (Administrators) has full access in your account. This special user (default administrator) must create any additional users, or grant permission to other users to create new users.
By default, a new user does not have permission to use any resource or service within your account – all permissions must be explicitly granted. This approach allows you to adhere to the security principle of least privilege whereby you grant each user only the access required for that specific user. You must either explicitly add the user to an existing group or create a new group for them, and then assign appropriate permissions to that group through a policy.
Currently, you cannot disable user access. However, you can reset passwords or remove keys.
You can automate resetting passwords, changing keys, or editing users and group memberships through the REST API and SDKs.
A group is a collection of users who need similar access privileges to either use or manage a specific resource within your account. Users can be in multiple groups. Permissions are additive. For example, if membership in one group allows a user to use compute instances, and membership in a second group allows that user to manage block volumes, then the user is permitted to manage both instances and block volumes.
Administrators write policies that specify groups (not individual users) with the required access they need, whether to a specific compartment or the account. Administrators then add users to the appropriate groups.
Yes. Your account is provisioned with a single default administrator who belongs to an Administrators group within your root compartment. This group has full privileges to create and manage all Oracle Cloud Infrastructure resources in your account, including users, groups, policies, and compartments, as well as all other cloud infrastructure resources within any compartments. You can add additional users to this Administrators group.
A policy is a document consisting of descriptive policy statements that grant specific permissions to groups of users. They are written with an easy-to-understand SQL-like syntax. Example policies might enforce:
A policy allows a group to work in certain ways with specific types of resources in a particular compartment. Optionally, policies can contain a conditional clause ("where ...") that further restricts the policy statement. Policies adhere to the following syntax:
For example, here is a policy statement that grants permissions to use compute instances:
Allow group Developers to use instances in compartment ProjectA
For more details, see the Oracle IAM section of the Oracle Cloud Infrastructure documentation.
Yes. A policy granting permissions in the root compartment automatically grants the same permissions for all child compartments. For example, the following policy gives permission to all users in the group "InstanceAdmins" to manage instances in the root compartment as well as all child compartments:
Allow Group InstanceAdmins to manage instances in tenancy
Yes. Each policy is "attached" to a compartment. Where you attach it controls who can then modify it or delete it. If you attach a policy to the root compartment, then anyone with access to manage policies in the root compartment can change or delete it. If you instead attach the policy to the compartment, then anyone with access to manage policies in that compartment can change or delete it. In practical terms, this means it is easy to give compartment administrators (i.e., a group with access to "manage all-resources" in the compartment) access to manage their own compartment's policies, without giving them broader access to manage policies that reside in the account.
Identity federation is a mechanism to delegate user management for your Oracle Cloud Infrastructure tenancy to another entity called an Identity Provider or IdP. This is useful to companies that have an existing Identity system they would like to use, rather than creating and maintaining a new set of users. Federation requires a one-time configuration between Oracle Cloud Infrastructure and the IdP known as a Federation Trust.
Federated users (external identities) are users you manage outside of Oracle Cloud Infrastructure (for example, in your corporate directory), but to whom you grant access to your Oracle Cloud Infrastructure account. They differ from Oracle Cloud Infrastructure users, which are created and maintained in your Oracle Cloud Infrastructure account.
Yes. Federated users can access the Oracle Cloud Infrastructure Console.
Yes. Federated users can access the Oracle Cloud Infrastructure SDK and CLI.
Federated users cannot change nor reset their passwords in the Oracle Cloud Infrastructure Console.
You use the same Oracle Cloud Infrastructure policies to manage federated users that you use to manage native users. You map roles and groups in your Identity Provider to groups in Oracle Cloud Infrastructure. When a federated user logs in, the Oracle Cloud Infrastructure Console then applies policies based on their Oracle Cloud Infrastructure group membership, just as with native users. See the documentation for examples.
A single role or group in your Identity Provider can be mapped to multiple Oracle Cloud Infrastructure groups. Also, multiple roles or groups in your Identity Provider can be mapped to a single Oracle Cloud Infrastructure group.
There is no limit to the number of federated users who can be given access to the console.
Currently, we support Oracle's Identity Cloud Service (IDCS), Microsoft Active Directory Federation Services (AD FS), Okta, and any other SAML 2.0 compliant identity provider.