{"id":3798,"date":"2018-09-17T18:47:43","date_gmt":"2018-09-17T21:47:43","guid":{"rendered":"https:\/\/www.dbarj.com.br\/?p=3798"},"modified":"2018-09-18T10:35:45","modified_gmt":"2018-09-18T13:35:45","slug":"creating-a-read-only-user-in-oracle-cloud-infrastructure","status":"publish","type":"post","link":"https:\/\/www.dbarj.com.br\/en\/2018\/09\/creating-a-read-only-user-in-oracle-cloud-infrastructure\/","title":{"rendered":"Creating a read-only user in Oracle Cloud Infrastructure"},"content":{"rendered":"

Creating a read-only user for OCI access is useful if you want to give your auditors or external providers only read privileges on all your Infrastructure resources or if you want to run oci-cli tool in a secure mode, with guarantee that no changes will happen in your Oracle Cloud Infrastructure.<\/p>\n

In this article I will show how to create a user with read-only minimum privileges and assign it to oci-cli<\/strong> tool.<\/p>\n

Let’s start. Connect in you Oracle Cloud Infrastructure web console with a administrator user.<\/p>\n

1. Create User.<\/h4>\n

First step is to create a new read-only user. Go to Menu -> Identity -> Users<\/strong> and click “Create User<\/strong>“.<\/p>\n

\"\"<\/p>\n

Give the user a Name<\/strong> and a Description<\/strong>.<\/p>\n

\"\"<\/p>\n

2. Create Group.<\/h4>\n

In OCI, privileges are given to a group, not an user. So you must create a new group to place this account and later we will give the list accesses to the group.<\/p>\n

Go to Menu -> Identity -> Group<\/strong> and click “Create Group<\/strong>“.<\/p>\n

Give the group a Name<\/strong> and a Description<\/strong>.<\/p>\n

\"\"<\/p>\n

3. Create Policy.<\/h4>\n

Now let’s create the policies (or permissions) and assign it to the group.<\/p>\n

Go to Menu -> Identity -> Policies<\/strong>.<\/p>\n

Before clicking in “Create Policy”, ensure you are in the root compartment (right panel).<\/span><\/strong><\/p>\n

\"\"<\/p>\n

Click “Create Policy<\/strong>” and give the policy\u00a0a Name,<\/strong>\u00a0Description.<\/strong><\/p>\n

Now it’s time to assign policies to the rule. You have 2 ways to go here:<\/p>\n

A.<\/strong> <\/span>If you want to give read<\/strong><\/span> access to ALL resources, you can simply add the statement:<\/p>\n

\u2022 Allow group group_name<\/strong> to read all-resources in tenancy
\n* Change\u00a0group_name to the one assigned in step 2.<\/em><\/span><\/p>\n

B.<\/span> <\/strong>However, if you want to be more restrictive, you can give only inspect\u00a0<\/strong><\/span>access on ALL resources and give the read<\/strong><\/span> on very specific ones. “Inspect<\/strong>” don’t give the\u00a0ability to get user-specified metadata\u00a0and the actual resource itself.<\/p>\n

\u2022 Allow group group_name<\/strong> to inspect all-resources in tenancy
\n\u2022 Allow group group_name<\/strong> to read instances in tenancy
\n\u2022 Allow group group_name<\/strong> to read audit-events in tenancy
\n* Change\u00a0group_name to the one assigned in step 2.<\/em><\/span><\/p>\n

\"\"<\/p>\n

For more information, please check\u00a0https:\/\/docs.cloud.oracle.com\/iaas\/Content\/Identity\/Reference\/policyreference.htm<\/a><\/p>\n

4. Add User to Group.<\/h4>\n

Go again in Menu -> Identity -> Users<\/strong>, click on the created user. Go to the “Group<\/strong>” resource on the left panel and select “Add User to Group<\/strong>“.<\/p>\n

\"\"<\/p>\n

Perfect. Now you have your new user ready. Now let’s configure oci-cli to make use of it.<\/p>\n

5. Setup oci-cli with new created user.<\/h4>\n

Now let’s configure oci-cli.\u00a0 Before starting,\u00a0note down the values of the information below:<\/p>\n