Earlier today I was given a challenge by my colleagues. Recently Oracle released the Autonomous Data Warehouse and we have a lot of excitement from customers, partners and internal folk alike. This excitement is driving a lot of innovation right now, but that also brings some challenges. The last thing we want is the Marketing team to mess with Finance resources. How do we make sure different teams don’t step on each other’s toes?
Oracle Cloud Infrastructure provides two powerful capabilities, Compartments and Policies, to help make sure that different teams can play safe without stepping on each other’s toes.
Compartments give us the ability to isolate one collection of resources from another collection while Policies allow us to specify who can access which resources and how. Typically, access is granted at the group and compartment level, which means you can write a policy that gives a group a specific type of access to a specific compartment.
In this example, I’ll explain how to isolate a set of resources for the Marketing Department. To set the scene, let’s suppose that Finance needs a data warehouse for analysis and projections. Here’s the high level set of tasks needed to get the data warehouse available:
- Create a compartment – this isolates my resources from other teams and projects in the organisation
-
Create two groups –
- Marketing Users who simply use the data warehouse
- Marketing Admins who manage the data
- Create a set of tags so that Marketing Admins can associate data with Marketing Events and Campaigns
-
Create a policy that determines who can do what in the compartment
- Campaign ID
- Event
- Marketing Contact
So let’s get started. Firstly login to the Oracle Cloud Infrastructure console with credentials provided by your administrator or from Oracle Cloud if you’re the super user. Note that your Cloud Infrastructure console URL may be different depending on which region you want to use.
Create a Compartment.
Click Menu –> Identity -> Compartments
Create a compartment called Marketing
Click create Compartment
Create Marketing tags
Tags are a great way to attach information about resources (e.g. ADW Instances). In my example I want to allow administrators to tag resources with Event Names, Campaign IDs and Owners.
Click on Menu -> Governance -> Tag Namespaces -> Create Namespace Definition
Select the Marketing compartment from the drop down on the left side of the screen.
Click on Create Namespace Definition
Select Marketing compartment
Enter Marketing as the NAMESPACE DEFINITION NAME
Select the Marketing namespace
Click on the Create Tag Key Definition
Create the following Tag Keys:
CampaignID
Event
Owner
It should look like this:
Create Marketing groups
Marketing users and administrators are managed by Groups.
Click on Menu -> Identity -> Groups ->
Click on Create Group
Name: Marketing-Admins
Description: Administrators of resources in the Marketing compartment
You might also want to add a marketing tag like Owner
Click on Submit
Click on Create Group
Name: Marketing-Users
Description: Users of resources in the Marketing compartment
You might also want to add a marketing tag like Owner
Click on Submit
Here’s a screenshot of the Marketing-Admins group:
Create the Policy
Objective
So basically, I want Marketing users to be able to use any resources that have been created in the Marketing compartment. I also want to prevent Marketing users from using resources outside the Marketing compartment.
More importantly, I want to make sure Marketing Admins can only manage resources that belong to the Marketing compartment. I also want Marketing Admins to be able to add any user in the organisation to the Marketing group.
This allows the Marketing Department to create resources quickly, use them and get rid of the resources when they’re done. All of this can happen very quickly safe in the knowledge that they can’t mess up corporate resources owned by other departments.
Steps
Click on Menu -> Identity -> Policies
Select the Root compartment from the drop down on the left side of the screen. The Root compartment will appear as the Tennancy ID followed by Policies are best left in the Root compartment so that they can be applied to objects like users and groups.
Click on Create Policy
Name: Marketing
Description: Restrict Marketing administrators and users to the Marketing compartment.
Policy Versioning: KEEP POLICY CURRENT
Statement: (Click on the + to add each statement below)
Allow group Marketing-Admins to inspect users in tenancy
Allow group Marketing-Admins to inspect groups in tenancy
Allow group Marketing-Admins to use users in tenancy where target.group.name=’Marketing-Users’
Allow group Marketing-Admins to use groups in tenancy where target.group.name=’Marketing-Users’
Allow group Marketing-Admins to manage all-resources in compartment Marketing
Allow group Marketing-Admins to manage tagdefinitions in tenancy
Allow group Marketing-Admins to manage tag-namespaces in tenancy
Allow group Marketing-Admins to use tagdefinitions in tenancy
Allow group Marketing-Admins to use tag-namespaces in tenancy
Allow group Marketing-Users to use all-resources in compartment Marketing
Try it out!
Create a new user in Oracle Cloud Infrastructure
Click on Menu -> Identity -> User
Create a user
Create a password for the user
Assign the Marketing-Admins group to the new user
Sign Out
Login as your new user
Reset your password
Now we shouldn’t be able to see any Autonomous Data Warehouse instances in the Root compartment because the Marketing policy doesn’t allow it:
Click on Menu -> Autonomous Data Warehouse
Marketing Administrators Can’t See Non Marketing Resources
We should see a Forbidden message
Marketing Administrators Can See Resources in the Marketing Compartment
Now select the Marketing compartment from the drop down on the left
We should see a different message now: “There are no Autonomous Data Warehouses in Marketing that match the filter criteria.”
This is because the Marketing Policy allows us to see objects in the Marketing Compartment, however, we haven’t created any warehouses in the Marketing Compartment yet.
Conclusion
Policies, compartments and tags are really powerful capabilities that allow organisations to move to the cloud with much greater agility. Policies can restrict and enable access to resources across your organisation.
