A digital marketing company is planning to host a website on Oracle Cloud Infrastructure (OCI) and leverage OCI Container Engine for Kubernetes (OKE). The web server will make API calls to access…

Question

Options

• ACreate a policy to automatically tag a resource with the user name.
• BCreate a policy using 1AM requiring users to tag specific resources.
• CCreate tag variables to automatically tag a resource with the user name.
• DCreate a default tag for each compartment, which ensure that appropriate tags are applied at resource creation
• ECreate tag variables for each compartment to automatically tag a resource with the user name.

• A
  3% (1)
• B
  9% (3)
• D
  82% (28)
• E
  6% (2)

Explanation

Explanation/Reference: INSTANCE PRINCIPALS The IAM service feature that enables instances to be authorized actors (or principals) to perform actions on service resources. Each compute instance has its own identity, and it authenticates using the certificates that are added to it. These certificates are automatically created, assigned to instances and rotated, preventing the need for you to distribute credentials to your hosts and rotate them. Dynamic groups A special type of group that contains resources (such as compute instances) that match rules that you define (thus the membership can change dynamically as matching resources are created or deleted). These instances act as "principal" actors and can make API calls to services according to policies that you write for the dynamic group. The following steps summarize the process flow for setting up and using instances as principals. The subsequent sections provide more details. 1. Create a dynamic group. In the dynamic group definition, you provide the matching rules to specify which instances you want to allow to make API calls against 2. Create a policy granting permissions to the dynamic group to access services in your tenancy (or compartment). 3. A developer in your organization configures the application built using the Oracle Cloud Infrastructure SDK to authenticate using the instance principals provider. The developer deploys the application and the SDK to all the instances that belong to the dynamic group. 4. The deployed SDK makes calls to Oracle Cloud Infrastructure APIs as allowed by the policy (without needing to configure API credentials). 5. For each API call made by an instance, the Audit service logs the event, recording the OCID of the instance as the value of principalId in the event log. Therefore, It is difficult to pinpoint the owner of these resources verify if they are safe to terminate. Because of this, your company has issued a new mandate, which requires adding compute instances. Which option is the simplest way to implement this new requirement? This will allow a user to launch compute instances on\y if certain tags were defined. Explanation/Reference: You can use a variable to set the value of a defined tag. When you add the tag to a resource, the variable resolves to the data it represents. You can use tag variables in defined tags and default tags. Supported Tag Variables The following tag variables are supported. ${iam.principal.name} The name of the principal that tagged the resource ${iam.principal.type} The type of principal that tagged the resource. ${oci.datetime} The date and time that the tag was created. Consider the following example: Operations.CostCenter=" ${iam.principal.name} at ${oci.datetime} " Operations is the namespace, CostCenter is the tag key, and the tag value contains two tag variables ${iam.principal.name} and ${oci.datetime} . When you add this tag to a resource, the variable resolves to your user name (the name of the principal that applied the tag) and a time date stamp for when you added the tag. user_name at 2019-06-18T18:00:57.604Z The variable is replaced with data at the time you apply the tag. If you later edit the tag, the variable is gone and only the data remains. You can edit the tag value in all the ways you would edit any other tag value. To create a tag variable, you must use a specific format. ${<variable>} Type a dollar sign followed by open and close curly brackets. The tag variable goes between the curly brackets. You can use tag variables with other tag variables and with string values. Tag defaults let you specify tags to be applied automatically to all resources, at the time of creation, in a specific compartment. This feature allows you to ensure that appropriate tags are applied at resource creation without requiring the user who is creating the resource to have access to the tag namespaces. https://docs.cloud.oracle.com/ en-us/iaas/Content/Tagging/Tasks/managingtagdefaults.htm

No community discussion yet for this question.