Skip to content

Commit 76d5853

Browse files
Refined policies update (#100)
* Policy updates. * Refined policy documentation.
1 parent 4298294 commit 76d5853

File tree

1 file changed

+159
-43
lines changed

1 file changed

+159
-43
lines changed

docs/iam_policies.md

Lines changed: 159 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,14 @@
22

33
Many OCI AI Blueprints users choose to give full admin access to OCI AI Blueprints when using it for the first time or developing a POC, and making the permissions more granular overtime. We provide you with two different variations of IAM Policies for you to choose from - depending on your situation.
44

5-
## Step 1: Create Dynamic Group in Identity Domain
5+
To learn more details about the policy breakdowns, see the relevant sections below in the [Detailed Policy Breakdown](#detailed-policy-breakdown):
6+
- [OKE Cluster Stack Creation Policies](#oke-cluster-creation-policies)
7+
- [Blueprints App Stack Creation Policies](#blueprints-app-stack-creation-policies)
8+
- [Blueprints Feature Policies](#blueprints-feature-policies)
9+
10+
## Quickstart
11+
12+
### Step 1: Create Dynamic Group in Identity Domain
613

714
Inside the OCI console:
815

@@ -23,86 +30,195 @@ All {instance.compartment.id = '<oci-ai-blueprints_compartment_ocid>'}
2330

2431
More info on dynamic groups can be found here: https://docs.oracle.com/en-us/iaas/Content/Identity/dynamicgroups/To_create_a_dynamic_group.htm
2532

26-
## Step 2: Add IAM Policies To Root Compartment
33+
### Step 2: Add IAM Policies To Root Compartment
2734

28-
- **Note:** `'IdentityDomainName'/'DynamicGroupName'` -> please modify this to match the dynamic group that you created in Step 1 above
35+
The Quickstart takes the approach of giving Blueprints full admin policies. If you would like to narrow the policies down, visit the [detailed policy breakdown](#detailed-policy-breakdown) section below.
36+
37+
- **Note:** `'Default'/'DynamicGroupName'` -> please modify this to match the dynamic group that you created in Step 1 above
2938
- **Note:** All these policies will be in the root compartment of your tenancy (NOT in the OCI AI Blueprints compartment itself)
3039
- **Note:** If you are not an admin of your tenancy, then you will need to have an admin add the following policies for the dynamic group AND the user group that your user belongs if you are the one that will be deploying OCI AI Blueprints (aka you will have the admin create the policies below twice - once for the dynamic group you created in Step 1 and once for the user group that your user belongs to)
3140

32-
**Option #1: Full Admin Access:**
33-
3441
```
35-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to inspect all-resources in tenancy
36-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage all-resources in compartment {comparment_name}
37-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to {CLUSTER_JOIN} in compartment {compartment_name}
38-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage volumes in TENANCY where request.principal.type = 'cluster'
39-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage volume-attachments in TENANCY where request.principal.type = 'cluster'
42+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect all-resources in tenancy
43+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage all-resources in compartment My-Compartment
44+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volumes in TENANCY where request.principal.type = 'cluster'
45+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volume-attachments in TENANCY where request.principal.type = 'cluster'
4046
```
4147

42-
**Option #2: Fine-Grain Access:**
48+
----
49+
## Detailed Policy Breakdown
50+
51+
The detailed policy breakdown takes the approach of enabling you to provide exactly the policies you need for both stack creation and feature usage. Therefore, this section is split into two parts:
52+
- [Stack Creation Policies](#stack-creation-policies)
53+
- [OKE Stack Policies](#oke-cluster-creation-policies)
54+
- [Blueprints Stack Policies](#blueprints-app-stack-creation-policies)
55+
56+
- [Blueprints Feature Policies](#blueprints-feature-policies)
57+
58+
### Stack Creation Policies
59+
The below policies are related to the terraform deployments to create each stack for the OKE cluster and the Blueprints platform.
60+
61+
#### OKE Cluster Creation Policies
62+
63+
OKE Cluster creation allows for two modes:
64+
- Install OKE Cluster into existing Virtual Network
65+
- Create Virtual Network and Install OKE Cluster
66+
67+
Because of this, different policy requirements exist for each mode. For specific details about the OKE verbs and virtual network verbs, visit:
68+
- [OKE Verbs](https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/contengpolicyreference.htm#Details_for_Container_Engine_for_Kubernetes)
69+
- [Virtual Network Verbs](https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/corepolicyreference.htm#For2)
70+
- `GetNodePoolOptions/all` - API used to determine images available for nodes, requires `inspect all-resources in tenancy`.
71+
72+
#### Bring your own network policies
73+
Because we are not creating the virtual network, policy usage can be minimized to "read" permissions on several of the virtual network family members compared to the create policies. The required policies are:
74+
75+
**Note**: 'Default' is the "default" identity domain, and 'DynamicGroupName' is the name of your dynamic group. 'Dennis-Compartment' is an example compartment name. If using nested compartments, the syntax is: Dennis-Compartment:Dennis-ChildA:Dennis-ChildB
4376

4477
```
45-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to inspect all-resources in tenancy
78+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect all-resources in tenancy
79+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage clusters in compartment Dennis-Compartment
80+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-node-pools in compartment Dennis-Compartment
81+
Allow dynamic-group 'Default'/'DynamicGroupName' to read virtual-network-family in compartment Dennis-Compartment
82+
Allow dynamic-group 'Default'/'DynamicGroupName' to use subnets in compartment Dennis-Compartment
83+
Allow dynamic-group 'Default'/'DynamicGroupName' to use vnics in compartment Dennis-Compartment
84+
Allow dynamic-group 'Default'/'DynamicGroupName' to use network-security-groups in compartment Dennis-Compartment
85+
Allow dynamic-group 'Default'/'DynamicGroupName' to use private-ips in compartment Dennis-Compartment
86+
Allow dynamic-group 'Default'/'DynamicGroupName' to read cluster-work-requests in compartment Dennis-Compartment
87+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-family in compartment Dennis-Compartment
88+
```
4689

47-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage compute-capacity-reports in tenancy
90+
#### Create your network policies
91+
To additionally create the virtual network the policies become a bit more open as the `manage` verb encompasses all of the `use` policies above, plus a few more permissions:
92+
```
93+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect all-resources in tenancy
94+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage clusters in compartment Dennis-Compartment
95+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-node-pools in compartment Dennis-Compartment
96+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage virtual-network-family in compartment Dennis-Compartment
97+
Allow dynamic-group 'Default'/'DynamicGroupName' to read cluster-work-requests in compartment Dennis-Compartment
98+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-family in compartment Dennis-Compartment
99+
```
48100

49-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage instance-family in compartment {compartment_name}
101+
### Blueprints App Stack Creation Policies
50102

51-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use subnets in compartment {compartment_name}
103+
Blueprints needs to use the cluster, the virtual network, inspect node pools, create and attachvolumes, and create a load balancer.
104+
```
105+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect all-resources in tenancy
106+
Allow dynamic-group 'Default'/'DynamicGroupName' to use virtual-network-family in compartment Dennis-Compartment
107+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volumes in compartment Dennis-Compartment
108+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volume-attachments in compartment Dennis-Compartment
109+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage load-balancers in compartment Dennis-Compartment
110+
Allow dynamic-group 'Default'/'DynamicGroupName' to use clusters in compartment Dennis-Compartment
111+
```
52112

53-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage virtual-network-family in compartment {compartment_name}
113+
### Blueprints Feature Policies
54114

55-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use vnics in compartment {compartment_name}
115+
Feature policies describe the policies required to enable all of the Blueprints platform features. Combined policies will be shown first which are the minimum required policies to use all Blueprints features, and then feature specific policies follow with links to documentation. This way, users can selectively opt in or opt out of certain features if policies are prohibitive.
56116

57-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use network-security-groups in compartment {compartment_name}
117+
**Full Feature Policies**
58118

59-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage public-ips in compartment {compartment_name}
119+
```
120+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage clusters in compartment Dennis-Compartment
121+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-node-pools in compartment Dennis-Compartment
122+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-family in compartment Dennis-Compartment
123+
Allow dynamic-group 'Default'/'DynamicGroupName' to use vnics in compartment Dennis-Compartment
124+
Allow dynamic-group 'Default'/'DynamicGroupName' to use subnets in compartment Dennis-Compartment
125+
Allow dynamic-group 'Default'/'DynamicGroupName' to read instance-images in compartment Dennis-Compartment
126+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage compute-capacity-reports in compartment Dennis-Compartment
127+
Allow dynamic-group 'Default'/'DynamicGroupName' to read cluster-work-requests in compartment Dennis-Compartment
128+
Allow dynamic-group 'Default'/'DynamicGroupName' to read file-systems in compartment Dennis-Compartment
129+
Allow dynamic-group 'Default'/'DynamicGroupName' to read mount-targets in compartment Dennis-Compartment
130+
Allow dynamic-group 'Default'/'DynamicGroupName' to read export-sets in compartment Dennis-Compartment
131+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect private-ips in compartment Dennis-Compartment
132+
Allow dynamic-group 'Default'/'DynamicGroupName' to read buckets in compartment Dennis-Compartment
133+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage objects in compartment Dennis-Compartment
134+
Allow dynamic-group 'Default'/'DynamicGroupName' to use volumes in compartment Dennis-Compartment
135+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-configurations in compartment Dennis-Compartment
136+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-pools in compartment Dennis-Compartment
137+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-networks in compartment Dennis-Compartment
138+
```
60139

61-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage cluster-family in compartment {compartment_name}
140+
**Minimum policies for RDMA Enabled Cluster Networks**
62141

63-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage orm-stacks in compartment {compartment_name}
142+
https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/corepolicyreference.htm#compute-management-family
64143

65-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage orm-jobs in compartment {compartment_name}
144+
```
145+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instances in compartment Dennis-Compartment
146+
Allow dynamic-group 'Default'/'DynamicGroupName' to use vnics in compartment Dennis-Compartment
147+
Allow dynamic-group 'Default'/'DynamicGroupName' to use subnets in compartment Dennis-Compartment
148+
Allow dynamic-group 'Default'/'DynamicGroupName' to use network-security-groups in compartment Dennis-Compartment
149+
Allow dynamic-group 'Default'/'DynamicGroupName' to read instance-images in tenancy
150+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volume-attachments in compartment Dennis-Compartment
151+
Allow dynamic-group 'Default'/'DynamicGroupName' to use volumes in compartment Dennis-Compartment
152+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-configurations in compartment Dennis-Compartment
153+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-pools in compartment Dennis-Compartment
154+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-networks in compartment Dennis-Compartment
155+
Allow dynamic-group 'Default'/'DynamicGroupName' to use clusters in compartment Dennis-Compartment
156+
Allow dynamic-group 'Default'/'DynamicGroupName' to {CLUSTER_JOIN} in compartment Dennis-Compartment
157+
```
66158

67-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage vcns in compartment {compartment_name}
159+
**Minimum policies for shared node pool creation**
68160

69-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage subnets in compartment {compartment_name}
161+
https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/contengpolicyreference.htm
70162

71-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage internet-gateways in compartment {compartment_name}
163+
```
164+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage cluster-node-pools in compartment Dennis-Compartment
165+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage instance-family in compartment Dennis-Compartment
166+
Allow dynamic-group 'Default'/'DynamicGroupName' to use subnets in compartment Dennis-Compartment
167+
Allow dynamic-group 'Default'/'DynamicGroupName' to use vnics in compartment Dennis-Compartment
168+
Allow dynamic-group 'Default'/'DynamicGroupName' to read instance-images in compartment Dennis-Compartment
169+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage compute-capacity-reports in compartment Dennis-Compartment
170+
Allow dynamic-group 'Default'/'DynamicGroupName' to read clusters in compartment Dennis-Compartment
171+
Allow dynamic-group 'Default'/'DynamicGroupName' to read cluster-work-requests in compartment Dennis-Compartment
172+
```
72173

73-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage nat-gateways in compartment {compartment_name}
174+
**Any blueprint read from object storage**
74175

75-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage route-tables in compartment {compartment_name}
176+
https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/objectstoragepolicyreference.htm
76177

77-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage security-lists in compartment {compartment_name}
178+
```
179+
Allow dynamic-group 'Default'/'DynamicGroupName' to read buckets in compartment Dennis-Compartment
180+
Allow dynamic-group 'Default'/'DynamicGroupName' to read objects in compartment Dennis-Compartment
181+
```
78182

79-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to inspect clusters in compartment {compartment_name}
183+
**Any blueprint to read from and write to object storage**
80184

81-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use cluster-node-pools in compartment {compartment_name}
185+
https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/objectstoragepolicyreference.htm
82186

83-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to read cluster-work-requests in compartment {compartment_name}
187+
```
188+
Allow dynamic-group 'Default'/'DynamicGroupName' to read buckets in compartment Dennis-Compartment
189+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage objects in compartment Dennis-Compartment
190+
```
84191

85-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage service-gateways in compartment {compartment_name}
192+
**Any blueprint to provision in subcompartment. Also requires addition of subcompartment to dynamic group**
86193

87-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use cloud-shell in compartment {compartment_name}
194+
https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengcreatingpersistentvolumeclaim_topic-Provisioning_PVCs_on_BV.htm#Provisioning_Persistent_Volume_Claims_on_the_Block_Volume_Service
88195

89-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to read vaults in compartment {compartment_name}
196+
```
197+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volumes in TENANCY where request.principal.type = 'cluster'
198+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage volume-attachments in TENANCY where request.principal.type = 'cluster'
199+
```
90200

91-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to read keys in compartment {compartment_name}
201+
**Any blueprint to read from or write to OCI file storage (also requires appropriate security rules)**
92202

93-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to use compute-capacity-reservations in compartment {compartment_name}
203+
https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/filestoragepolicyreference.htm
94204

95-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to read metrics in compartment {compartment_name}
205+
https://docs.oracle.com/en-us/iaas/Content/File/Tasks/securitylistsfilestorage.htm#Configuring_VCN_Security_Rules_for_File_Storage
96206

97-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to read virtual-network-family in compartment {compartment_name}
207+
```
208+
Allow dynamic-group 'Default'/'DynamicGroupName' to read file-systems in compartment Dennis-Compartment
209+
Allow dynamic-group 'Default'/'DynamicGroupName' to read mount-targets in compartment Dennis-Compartment
210+
Allow dynamic-group 'Default'/'DynamicGroupName' to read export-sets in compartment Dennis-Compartment
211+
Allow dynamic-group 'Default'/'DynamicGroupName' to inspect private-ips in compartment Dennis-Compartment
212+
```
98213

99-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to inspect compartments in compartment {compartment_name}
214+
**Any blueprint to autoscale nodes (not pods)**
100215

101-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage cluster-node-pools in compartment {compartment_name}
216+
To reiterate, if you only want to autoscale pods and not nodes, and full cluster `manage` is not required. `use cluster` with `{CLUSTER_JOIN}` can be used instead.
102217

103-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to {CLUSTER_JOIN} in compartment {compartment_name}
218+
InstallAddon, UpdateAddon, DeleteAddon APIs require `manage cluster`
104219

105-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage volumes in TENANCY where request.principal.type = 'cluster'
220+
https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/contengpolicyreference.htm#Details_for_Container_Engine_for_Kubernetes
106221

107-
Allow dynamic-group 'IdentityDomainName'/'DynamicGroupName' to manage volume-attachments in TENANCY where request.principal.type = 'cluster'
108222
```
223+
Allow dynamic-group 'Default'/'DynamicGroupName' to manage clusters in compartment Dennis-Compartment
224+
```

0 commit comments

Comments
 (0)