Description

Ensure that compute instances, cloud databases, and functions that call OCI APIs authenticate as instance or resource principals, using dynamic groups and policies, instead of user API keys or passwords stored on the resource. Each dynamic group should match only the resources that need access.

Rationale

Storing user API keys or passwords on servers and functions means anyone who gets access to the resource, its disk, or its image can steal long-lived credentials. Instance and resource principals give each resource short-lived, automatically rotated credentials, with permissions controlled by policy. This removes stored secrets and limits what each resource can do.

Impact

  • Removes long-lived credentials from instances and functions

  • Credentials are rotated automatically by OCI

  • Code and CLI settings must switch to instance or resource principal authentication

Default Value

By default, no dynamic groups exist, and resources have no OCI API permissions until a dynamic group and policy are created.

Pre-Requisites

  • Identity domain administrator role and permission to create policies

  • The OCIDs or compartments of the resources that need API access

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Open the Dynamic groups tab (under User management on some consoles) and review the dynamic groups and their matching rules.

  4. Verify that dynamic groups exist for the instances, databases, and functions that call OCI APIs, and that policies grant them only the access they need.

  5. Check those resources for stored user API keys or OCI CLI configuration files with user credentials.

  6. If resources use stored user credentials instead of principals, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Open the Dynamic groups tab and select Create dynamic group.

  4. Enter a name and a matching rule, for example: ALL {instance.compartment.id = '<compartment-ocid>'} for instances, or ALL {resource.type = 'fnfunc', resource.compartment.id = '<compartment-ocid>'} for functions, and select Create.

  5. Under Identity & Security > Policies, create a policy that grants the dynamic group only the permissions it needs, for example: Allow dynamic-group AppInstances to read buckets in compartment AppCompartment

  6. Update the code or CLI to use instance principal or resource principal authentication (for example, oci --auth instance_principal).

  7. Remove the stored user API keys and credentials from the resources, and delete the old keys.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Restore the previous credentials on the resource if needed.

  4. Delete the dynamic group and its policy.

Reference