As part of the OCI account preparation required before onboarding cloud accounts into the platform, you will need to create least privilege policies — individual policies that must be attached to your cross-account role that allow the platform to access the OCI data it needs in order to create its reports.
Least Privilege Policies by Product (Read-Write)
Each least privilege policy provides the necessary permissions to enable core functions in the platform. The policies for enabling Read-Write access to the platform are listed below organized by product and platform capability:
FinOps
Capability
Description
Least Privilege Permissions
Cost
Processing
Grants group access to manage usage reports within
the tenancy, providing insights into resource consumption
and expenditure, and facilitating monitoring, analysis,
and reporting for cost optimization purposes.
Allow group <group_name> to manage usage-reports in tenancy
Budget
Grants the group the ability to manage usage
budgets within the entire tenancy.
Allow group <group_name> to manage usage-budgets in tenancy
CloudOps
Capability
Description
Least Privilege Permissions
Activity Real Time
Sync (Write)
Grants the group full management
access to ONS topics, ONS subscriptions,
and service connectors for real-time
activity synchronization within
the entire tenancy.
Allow group <group_name> to manage ons-topics in tenancy Allow group <group_name> to manage ons-subscriptions in tenancy Allow group <group_name> to manage serviceconnectors in tenancy
Monitoring Alerts
Real Time Sync (Write)
Grants the group full management access
to alarms, ONS topics, and ONS subscriptions
for real-time synchronization of monitoring
alerts within the entire tenancy.
Allow group <group_name> to manage alarms in tenancy Allow group <group_name> to manage ons-topics in tenancy Allow group <group_name> to manage ons-subscriptions in tenancy
SecOps
Capability
Description
Least Privilege Permissions
Threats Posture
(Write)
Allows the group to manage Cloud Guard
family data for threat posture
adjustments within the entire tenancy.
Allow group <group_name> to manage cloud-guard-family in tenancy
Vulnerabilities
(Write)
Enables the group to manage Vulnerability
Scanning Service (VSS) family
data within the entire tenancy for
addressing vulnerabilities.
Allow group <group_name> to manage vss-family in tenancy
Platform
Capability
Description
Least Privilege Permissions
Tagging
Governance
Grants the group the ability to
manage various resources for
effective tagging governance
within the entire tenancy, including:
Artifact repositories
Clusters
Database systems
Instance pools
Load balancers
Public IP addresses
Repositories
Volume backups
Volumes
Allow group <group_name> to manage artifact-repositories in tenancy Allow group <group_name> to manage clusters in tenancy Allow group <group_name> to manage db-systems in tenancy Allow group <group_name> to manage instance-pools in tenancy Allow group <group_name> to manage load-balancers in tenancy Allow group <group_name> to manage public-ips in tenancy Allow group <group_name> to manage repos in tenancy Allow group <group_name> to manage volume-backups in tenancy Allow group <group_name> to manage volumes in tenancy
Inventory
Management
Grants the group the ability to
manage various resources for
comprehensive inventory management
within the entire tenancy, including:
Artifact repositories
Clusters
Database systems
Instance pools
Load balancers
Public and private IP addresses
Repositories
Volume backups
Volumes
Allow group <group_name> to manage artifact-repositories in tenancy Allow group <group_name> to manage clusters in tenancy Allow group <group_name> to manage db-systems in tenancy Allow group <group_name> to manage instance-pools in tenancy Allow group <group_name> to manage load-balancers in tenancy Allow group <group_name> to manage public-ips in tenancy Allow group <group_name> to manage repos in tenancy Allow group <group_name> to manage volume-backups in tenancy Allow group <group_name> to manage volumes in tenancy Allow group <group_name> to use private-ips in tenancy
Resource Inventory
Grants group access to manage all the
resources within the entire tenancy.
Allow group <group_name> to manage all-resources in tenancy
