Oracle Cloud Infrastructure Documentation

Oracle Cloud Migrations User Policies

Oracle Cloud Migrations user policies are required for users to access the Oracle Cloud Migrations resources.

A policy syntax is as follows: 

allow <subject> to <verb>
                    <resource-type> in <location> where <conditions>

For complete details, see Policy Syntax. For more information on creating policies, see how policies work, Policy Reference, and policy details for Object Storage .

See the instructions for creating policies using the Console.

Create policies for specific users or groups to give permission for a user group to manage migration resources in a compartment. The policies can be defined for specific users or groups as indicated in the following examples.

For applying the permissions at a tenancy level, replace compartment <compartment name> with the tenancy. If you use more than one compartment, add multiple policies, one for each compartment.

Migration Administrator Policy Examples

Create policies to allow user groups to access Oracle Cloud Migrations resources. The following examples provide policies for administrator and operator roles.

Replace <ADMINISTRATORS-GROUP> and <OPERATORS-GROUP> with your user group names. Replace <MIGRATION-COMPARTMENT-OCID> with the OCID of the migration compartment where Oracle Cloud Migrations resources reside. Replace <MIGRATION-SECRETS-COMPARTMENT-OCID> with the OCID of the compartment where vault, key, and secret resources reside.

Create policies to allow administrator user groups to set up and manage Oracle Cloud Migrations resources:
Allow group <ADMINISTRATORS-GROUP> to manage ocb-environment in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to manage ocb-agent in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to use object-family in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to manage objects in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to manage ocb-agent-dependency in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to manage ocb-asset-sources in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to manage ocb-discovery-schedules in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to read ocb-workrequests in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to use vaults in compartment id <MIGRATION-SECRETS-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to use key-family in compartment id <MIGRATION-SECRETS-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to manage secret-family in compartment id <MIGRATION-SECRETS-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to manage ocb-inventory in tenancy
Allow group <ADMINISTRATORS-GROUP> to manage ocb-inventory-asset in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <ADMINISTRATORS-GROUP> to {OCB_INVENTORY_ASSET_READ} in tenancy
Allow group <ADMINISTRATORS-GROUP> to {COMPARTMENT_INSPECT, COMPARTMENT_READ} in tenancy

Migration Operator Policy Examples

Create policies to allow operator user groups to manage day-to-day migration resources:

Allow group <OPERATORS-GROUP> to manage ocm-migration-family in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <OPERATORS-GROUP> to read ocb-inventory in tenancy
Allow group <OPERATORS-GROUP> to manage ocb-inventory-asset in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <OPERATORS-GROUP> to read ocb-asset-sources in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <OPERATORS-GROUP> to read object-family in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <OPERATORS-GROUP> to manage volume-family in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <OPERATORS-GROUP> to manage orm-stacks in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <OPERATORS-GROUP> to manage orm-jobs in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <OPERATORS-GROUP> to read metrics in compartment id <MIGRATION-COMPARTMENT-OCID> where target.metrics.namespace='ocb_asset'
Allow group <OPERATORS-GROUP> to {COMPARTMENT_INSPECT, COMPARTMENT_READ} in tenancy
Allow group <OPERATORS-GROUP> to read instance-family in compartment id <MIGRATION-COMPARTMENT-OCID>
Allow group <OPERATORS-GROUP> to read tag-namespaces in tenancy
Allow group <OPERATORS-GROUP> to use tag-namespaces in tenancy where target.tag-namespace.name='CloudMigrations'