# Permissions: OCI Live Resource Manager Stack Guard # OCI IAM policy guidance for Resource Manager stack guard ## Identity model preference 1. Named group in target compartment — never `any-user` or `any-group` 2. Dynamic group matching the CI/CD runner instance by compartment and tag 3. Short-lived session token via Instance Principal for automation 4. Never grant `manage all-resources in tenancy` ## OCI IAM verb hierarchy reminder `inspect` ⊂ `read` ⊂ `use` ⊂ `manage` - `inspect` — list-only (no content details) - `read` — get + list (read details, no mutation) - `use` — limited mutation (no create/terminate) - `manage` — full CRUD (create, update, delete) ## Baseline read policy (auditors — no mutation rights) ``` Allow group to inspect orm-stacks in compartment Allow group to read orm-stacks in compartment Allow group to inspect orm-jobs in compartment Allow group to read orm-jobs in compartment ``` ## Plan-only policy (can create plan jobs, cannot apply or destroy) ``` Allow group to use orm-stacks in compartment Allow group to use orm-jobs in compartment ``` ## Full operator policy (apply + destroy — gate with approval workflow) ``` Allow group to manage orm-stacks in compartment Allow group to manage orm-jobs in compartment ``` ## Dynamic group for CI/CD instance principal ``` Any {instance.compartment.id = '', tag.Operations.Role.value = 'rms-runner'} Allow dynamic-group to manage orm-stacks in compartment Allow dynamic-group to manage orm-jobs in compartment ``` ## Service-principal policies (Resource Manager service itself) OCI is policy-based IAM: managed services must hold explicit `Allow service ...` grants to act on your tenancy. Without these, stack jobs fail with `NotAuthorized` even when the human operator is correctly scoped. ``` Allow service ResourceManager to manage orm-stacks in compartment Allow service ResourceManager to read secret-family in compartment Allow service ResourceManager to use tag-namespaces in tenancy ``` Add resource-type rights for whatever the stack provisions, e.g. `Allow service ResourceManager to manage instance-family in compartment ` for stacks that create compute. Do not grant `manage all-resources` even to the service principal — scope by resource family. ## Do not use ``` # FORBIDDEN # Allow any-user to manage all-resources in tenancy ← FORBIDDEN Allow group to manage all-resources in compartment prod ``` Stack auto-lock: Resource Manager allows **only one running job at a time per stack**. This is platform-enforced — no additional concurrency control needed.