Skip to content

Commit 08777d0

Browse files
amylesamyles
committed
Added cloud-infrastructure/private-cloud-and-edge/hsp/restrict-access-to-oci-console/README.md
Moved cloud-infrastructure/private-cloud-and-edge/hsp/iam-policies-for-isolation/README.md
1 parent 1db1ebb commit 08777d0

File tree

4 files changed

+131
-0
lines changed

4 files changed

+131
-0
lines changed

‎cloud-infrastructure/private-cloud-and-edge/hsp/iam-policies-for-isolation/README.md

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
# C3 Hosting Service Provider - IAM Policies for Isolation
2+
3+
The Hosting Service Provider (HSP) model on Compute Cloud@Customer (C3) allows
4+
hosting for multiple end customers, each isolated in a dedicated compartment
5+
with a single VCN per customer. To ensure the end customer can only
6+
create resources in just their own compartment, a set of IAM policies are
7+
required.
8+
9+
The HSP documentation suggests the following policies per end customer
10+
based on an example with two hosting customers, A & B. They assume that
11+
each end customer will have two roles for their
12+
staff: Customer Administrator and Customer End User. 
13+
14+
## Example Policies for Customer Administrator
15+
```
16+
Allows the group specified to use all C3 services in the compartment
17+
listed:
18+
19+
Allow group CustA-Admin-grp to manage all-resources in compartment
20+
path:to:CustA
21+
22+
Allow group CustB-Admin-grp to manage all-resources in compartment
23+
path:to:CustB
24+
```
25+
Note that the above policy grants permissions in the CustA and CustB
26+
compartments of the C3 but **also in the same compartment in the OCI
27+
tenancy**! To prevent permissions being granted in the OCI tenancy
28+
append a condition such as:
29+
30+
```Allow group CustA-Admin-grp to manage all-resources in compartment
31+
path:to:CustA where all {request.region != 'LHR',request.region !=
32+
'FRA'}
33+
34+
Allow group CustB-Admin-grp to manage all-resources in compartment
35+
path:to:CustB where all {request.region != 'LHR',request.region !=
36+
'FRA'}
37+
```
38+
In the example above the condition prevents resource creation in London
39+
and Frankfurt regions. Adjust the list to include all regions the
40+
tenancy is subscribed to.
41+
42+
The path to the end user compartment must be explicitly stated, using
43+
the comma format, relative to the compartment where the policy is
44+
created. 
45+
46+
## Example Policies for Customer End User
47+
```
48+
Allow group CustA-Users-grp to manage instance-family in compartment
49+
path:to:CustA
50+
Allow group CustA-Users-grp to use volume-family in compartment
51+
path:to:CustA
52+
Allow group CustA-Users-grp to use virtual-network-family in compartment
53+
path:to:CustA
54+
Allow group CustB-Users-grp to manage instance-family in compartment
55+
path:to:CustB
56+
Allow group CustB-Users-grp to use volume-family in compartment
57+
path:to:CustB
58+
Allow group CustB-Users-grp to use virtual-network-family in compartment
59+
path:to:CustB
60+
```
61+
As above append a condition to limit permissions to the C3 and prevent
62+
resource creation in OCI regions:
63+
```
64+
Allow group CustA-Users-grp to manage instance-family in compartment
65+
path:to:CustA where all {request.region != 'LHR',request.region !=
66+
'FRA'}
67+
Allow group CustA-Users-grp to use volume-family in compartment
68+
path:to:CustA where all {request.region != 'LHR',request.region !=
69+
'FRA'}
70+
Allow group CustA-Users-grp to use virtual-network-family in compartment
71+
path:to:CustA where all {request.region != 'LHR',request.region !=
72+
'FRA'}
73+
Allow group CustB-Users-grp to manage instance-family in compartment
74+
path:to:CustB where all {request.region != 'LHR',request.region !=
75+
'FRA'}
76+
Allow group CustB-Users-grp to use volume-family in compartment
77+
path:to:CustB where all {request.region != 'LHR',request.region !=
78+
'FRA'}
79+
Allow group CustB-Users-grp to use virtual-network-family in compartment
80+
path:to:CustB where all {request.region != 'LHR',request.region !=
81+
'FRA'}
82+
```
83+
## Common Policy
84+
85+
Currently any user of a C3 needs access to certain resources located at
86+
the tenancy level to use IaaS resources in the web UI.
87+
Backup policies, tag namespaces, platform images, all reside at the
88+
tenancy level and need a further policy to allow normal use of C3 IaaS
89+
services. Note that this is a subtle difference to the behaviour on OCI. 
90+
91+
An extra policy as below is required (where CommonGroup contains **all**
92+
HSP users on the C3):
93+
```
94+
allow group CommonGroup to read all-resources in tenancy where
95+
target.compartment.name='root-compartment-name'
96+
```
97+

‎cloud-infrastructure/private-cloud-and-edge/hsp/restrict-access-to-oci-console/C3-HSP-Restricting-Access-to-the-OCI-Console.md

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# C3 HSP - Restricting Access to the OCI Console
2+
3+
In the HSP scenario where end users are not employees of the rack
4+
operator it's probably not appropriate for them to be able to access the
5+
OCI console and to, possibly, create resources in the public cloud.
6+
7+
In an OCI tenancy using Identity Domains, i.e. all new tenancies, then
8+
there is an option to use [IAM Sign-On
9+
Policies](https://docs.oracle.com/en-us/iaas/Content/Identity/signonpolicies/managingsignonpolicies.htm#understand-sign-policies)
10+
to prevent access to the OCI Console. There is a [specific Sign-On
11+
Policy that controls access to the OCI
12+
Console](https://docs.oracle.com/en-us/iaas/Content/Identity/signonpolicies/managingsignonpolicies.htm#understand-sign-policies__securitypolicy-console-signonpolicy)
13+
and adding a new Sign-On Rule will disable access. Note that all users
14+
of a C3 must be created in the **default identity domain**. The Security
15+
Policy for OCI Console sign-on policy is activated by default and
16+
preconfigured with Oracle security best practices. Once located a new
17+
Sign-On rule as below will deny access to a specifed group:
18+
![](./files/media/image1.png)
19+
20+
Once the new Sign-On rule is created then it should be added to the
21+
Policy as shown, in this case before the MFA rule: 
22+
23+
![](./files/media/image2.png)
24+
25+
Note!
26+
27+
Even with OCI console access disabled there are still "live" OCI users
28+
who will have access to create/delete/modify resources via teh API in the OCI tenancy
29+
as well as the C3 as the policies and compartments are common across
30+
both. It would be wise to further restrict the capability of these users
31+
as per
32+
<https://docs.oracle.com/en-us/iaas/Content/Identity/users/edit-users-capabilities.htm>. 
33+
34+
Ideally a policy should be implemented that restricts permissions **only** to the C3, see [this](../iam-policies-for-isolation/README.md) note.

‎cloud-infrastructure/private-cloud-and-edge/hsp/restrict-access-to-oci-console/files/media/image1.png

154 KB
Loading

‎cloud-infrastructure/private-cloud-and-edge/hsp/restrict-access-to-oci-console/files/media/image2.png

1 MB
Loading

0 commit comments

Comments
 (0)