Identity and access Management - OCI

-
 OCI -IAM 

OCI IAM deals with more secured and interesting features or entities when compared to other cloud competitors. I would like to share some brief information about OCI IAM.

  •  IAM enables you to control what type of access a group of users have and to which specific resources resource is a cloud object that you create and use it in OCI 
  • Each OCI has unique Oracle-assigned Identifier called as OCID
  • IAM uses traditional identity concepts such as principals, users, Groups, AuthN, AuthZ and introduces new capability called Compartment
  • Principal -> it is an IAM entity that is allowed to interact with OCI resources , infact it is a kind of permission
  • users -> it is a persistent identity setup through IAM service to represent individual people 
  • Group -> it is a collection of users 
  • Instance principals -> It will allow OCI instances to make API calls against other OCI services removing the need to configure user credentials or a configuration file.
  • Authentication-> username/password , API signing key,Auth tokens 
  • Authorization-> Authorization specifies varius actions an authenticated principal can perform
  • Policies -> are comprised of group of statements which specify what groups can access what resources and at what level of access 
  • Policies are written in human-readable format 
Allow group <grp-name> to <verb> <resource-type> in tenancy
Allow group <grp-name> to <verb> <resource-type> in compartment <compartment_name> [where <condition>]

verb -> [inspect/read/use/manage]
resource type -> [all-resources/database-family/instance-family/object-family/virtual-network-family/volume-family/cluster-family/file-family/dns]

Allow group <grp-name> to <verb> <resource-type> in tenancy

Resource Locations:
=================== 
Global(IAM/Key vaults,keys/DNS)
Availability Domains(subnet/compute instances/block volumes/DB systems/File Systems(& mount targets)/Ephimeral public ips)
Regional : everything else 

Moving a compartment :
you can move a compartment to different parent compartment with in same tenancy , but make sure the name of the compartment should be unique 

tag Namespace:
============== 
A tag namespace is a container for set of tag keys with tag key definitions.
tag key definitions specifies its key and what types of values are allowed (string,number,text,date,enumerations,etc) 
Tag key definition cannot be deleted but rather retired and if required we can reactivate 











Comments

Post a Comment

Popular posts from this blog

How to make CRS and ASM not to restart after server reboot

-
I have noticed that server rebooting is taking lot of time on a VM machine for every reboot, so I have decided to auto start of the crs and ASM service During this phase I have noticed an attribute called auto_start when I try to execute the below command crsctl stat res -p This AUTO_START attribute is there for several resources like ora.ASM ,ora.crs,ora.DATA_DG it has got 2 options restore(0) , never(2) and always (1) always (1)  Causes the resource to restart when the node restarts regardless of the resource’s state when the node stopped -restore (0)  Does not start the resource at restart time if it was in an offline state, such as STATE=OFFLINE, TARGET=OFFLINE, when the node stopped. The resource is restored to its state when the node went down. The resource is started only if it was online before and not otherwise. -never (2)  Oracle Clusterware never restarts the resource regardless of the resource’s state when the node is stopped. So I have dec...
Read more

Understanding Terraform

-
 Terraform is a tool used  for building, changing, and versioning infrastructure safely and efficiently. A Terraform can manage multiple cloud services using a provider plugin  Terraform work flow? Terraform work flow will be comprised of validate -> plan -> apply and finally destroy. what is the important file of terraform which records the actions of Terraform apply? For every Terraform execution the action will be recorded in a file called Terraform state file .  The terraform init command is used to initialise a working directory containing Terraform configuration files. During init, the configuration is searched for module blocks, and the source code for referenced modules is retrieved from the locations given in  their source arguments. The terraform plan command is used to create an execution plan. It will not modify things in infrastructure. The terraform apply command is used to apply the changes required to reach the desired state of the configur...
Read more

How to repair ASM disk header

-
Image
What is ASM disk header corruption? ASM disk header corruption is a loss or damage to the disk header which contains the metadata essential for the operation and availability of an ASM disk group in Oracle. Imagine that you have an ASM disk corruption in any of the ASM diskgroups that have critical business data and the diskgroup has been configured as "EXTERNAL" redundancy, meaning that if one disk is inaccessible the whole diskgroup will be unavailable. Now what? Is your only option to restore it from backup by recreating the diskgroup or are there any other faster ways to recover the data? Here you need to find out whether it’s a complete loss of data in the ASM disk or is it just a header corruption. Hopefully for you, this is just a header corruption. Because, yes, there is a way out!  Below find the steps to restore from the ASM header corruption. Most of the data in the ASM disk header is of interest to that disk only. However, some information in the ASM disk header ...
Read more