You have an instance running in a development compartment that needs to make API calls against other OCI services, but you do not want to configure user credentials or a store a configuration file…

Question

Options

• ACreate a dynamic group with matching rules to include your instance
• BInstances can automatically make calls to other OCI services
• CInstances are secure and cannot make calls to other OCI services
• DCreate a dynamic group with matching rules to include your instance and write a policy for this

• A
  5% (3)
• B
  2% (1)
• C
  9% (5)
• D
  84% (48)

Explanation

Dynamic groups allow you to group Oracle Cloud Infrastructure computer instances as "principal" actors (similar to user groups). When you create a dynamic group, rather than adding members explicitly to the group, you instead define a set of matching rules to define the group members. For example, a rule could specify that all instances in a particular compartment are members of the dynamic group. The members can change dynamically as instances are launched and terminated in that compartment. A dynamic group has no permissions until you write at least one policy that gives that dynamic group permission to either the tenancy or a compartment. When writing the policy, you can specify the dynamic group by using either the unique name or the dynamic group's OCID. Per the preceding note, even if you specify the dynamic group name in the policy, IAM internally uses the OCID to determine the dynamic group.

No community discussion yet for this question.