|
1 | 1 | # C3 Hosting Service Provider - IAM Policies for Isolation
|
2 | 2 |
|
3 |
| -The Hosting Service Provider (HSP) model on C3 allows hosting for a |
4 |
| -maximum of 8 end customers, each isolated in a dedicated compartment |
| 3 | +The Hosting Service Provider (HSP) model on Compute Cloud@Customer (C3) allows |
| 4 | +hosting for multiple end customers, each isolated in a dedicated compartment |
5 | 5 | with a single VCN per customer. To ensure the end customer can only
|
6 |
| -create resources in just their own compartment a set of IAM policies are |
| 6 | +create resources in just their own compartment, a set of IAM policies are |
7 | 7 | required.
|
8 | 8 |
|
9 | 9 | The HSP documentation suggests the following policies per end customer
|
@@ -83,10 +83,10 @@ path:to:CustB where all {request.region != 'LHR',request.region !=
|
83 | 83 | ## Common Policy
|
84 | 84 |
|
85 | 85 | Currently any user of a C3 needs access to certain resources located at
|
86 |
| -the tenancy level to use IaaS resources withgout errors in the web UI. |
87 |
| -Backup policies, tag namespaces, platform images all reside at the |
| 86 | +the tenancy level to use IaaS resources in the web UI. |
| 87 | +Backup policies, tag namespaces, platform images, all reside at the |
88 | 88 | tenancy level and need a further policy to allow normal use of C3 IaaS
|
89 |
| -services. Note that this is **different** to the behaviour on OCI. |
| 89 | +services. Note that this is a subtle difference to the behaviour on OCI. |
90 | 90 |
|
91 | 91 | An extra policy as below is required (where CommonGroup contains **all**
|
92 | 92 | HSP users on the C3):
|
|
0 commit comments