2-1 IAM Overview Explained

Key Concepts

• Users
• Groups
• Policies
• Compartments
• Dynamic Groups
• Identity Providers

Users

Users represent individual accounts within an Oracle Cloud Infrastructure (OCI) tenancy. Each user has a unique set of credentials and can be granted specific permissions to access resources. Users can be created, updated, and deleted by administrators.

Example: A company creates a user account for each employee, such as "jdoe@example.com", to manage their access to cloud resources.

Groups

Groups are collections of users with shared access permissions. By assigning policies to groups, administrators can manage permissions more efficiently. Users can belong to multiple groups, and each group can have different policies.

Example: A group named "Developers" is created, and all developers in the company are added to this group. Policies are assigned to the "Developers" group to grant access to development tools and resources.

Policies

Policies define permissions and rules for accessing resources. They are written in a specific language and can be applied to users, groups, or dynamic groups. Policies determine what actions are allowed or denied.

Example: A policy named "Allow Developers to Manage Compute Instances" grants members of the "Developers" group permission to create, start, stop, and terminate compute instances.

Compartments

Compartments are logical containers used to organize and isolate resources within a tenancy. They help in managing access control and resource visibility. Resources within a compartment can be accessed only by users with the appropriate permissions.

Example: A compartment named "Production" is created to house all production resources. Policies are set to restrict access to this compartment to only authorized users and groups.

Dynamic Groups

Dynamic Groups allow you to group cloud resources for policy application. Instead of manually adding resources to a group, you define rules that automatically include matching resources. This simplifies policy management for large-scale environments.

Example: A dynamic group named "Compute Instances" is created with a rule to include all compute instances with a specific tag. Policies applied to this dynamic group will automatically apply to all matching instances.

Identity Providers

Identity Providers (IdPs) enable federated identity management, allowing users to authenticate using their existing credentials from an external identity provider. This enhances security and simplifies user management.

Example: A company integrates OCI with an external IdP like Okta. Users can log in to OCI using their Okta credentials, and their access permissions are managed through OCI policies.

By understanding and implementing these IAM concepts, you can effectively manage user access, permissions, and resource organization in Oracle Cloud Infrastructure, ensuring security and compliance.