OCI IAM policies control who can access which resources, how, and under what conditions. All resources have an implicit deny by default — access must be explicitly granted via policy statements. Policies are collections of one or more statements written in a human-readable language.
asheliahut
/ DetailedOCIPermissionRefGuide.md
Created
March 13, 2026 18:26
Detailed guide around what can be inside {}
Permissions are the atomic units of authorization in OCI IAM. Instead of using a verb like use or manage, you can list exact permissions inside {} for surgical least-privilege access.
-- Syntax
Allow group <group> to {PERMISSION_ONE, PERMISSION_TWO} <resource-type> in <location>
-- Example
Allow group AppReaders to {VAULT_INSPECT, VAULT_READ} vaults in compartment ProductionOlderNewer