Details for the Core Services

This topic covers details for writing policies to control access to the Core Services (Networking, Compute, and Block Volume).

Resource-Types

Networking

Aggregate Resource-Type

virtual-network-family

Individual Resource-Types

vcns

subnets

route-tables

network-security-groups

security-lists

dhcp-options

private-ips

public-ips

ipv6s

internet-gateways

nat-gateways

service-gateways

local-peering-gateways (which includes local-peering-from, and local-peering-to) remote-peering-connections (which includes remote-peering-from, and remote-peering-to)

drgs

drg-attachments

cpes

ipsec-connections

cross-connects

cross-connect-groups

virtual-circuits

vnics

vnic-attachments

vlans

Comments

A policy that uses <verb> virtual-network-family is equivalent to writing one with a separate <verb> <individual resource-type> statement for each of the individual resource-types.

See the table in Details for Verb + Resource-Type Combinations for a detailed breakout of the API operations covered by each verb, for each individual resource-type included in virtual-network-family.

Compute

instance-family Aggregate Resource-Type

The instance-family aggregate resource-type covers these individual resource-types:

app-catalog-listing

console-histories

instances

instance-console-connection

instance-images

volume-attachments (includes only the permissions required for attaching volumes to instances)

compute-management-family Aggregate Resource-Type

The compute-management-family aggregate resource-type covers these individual resource-types:

instance-configurations

instance-pools

cluster-networks

Additional Individual Resource-Types

auto-scaling-configurations

work-requests

dedicated-vm-hosts

Comments

A policy that uses <verb> instance-family or <verb> compute-management-family is equivalent to writing one with a separate <verb> <individual resource-type> statement for each of the individual resource-types in the family.

See the table in Details for Verb + Resource-Type Combinations for a detailed breakout of the API operations covered by each verb, for each individual resource-type.

Block Volume

Aggregate Resource-Type

volume-family

Individual Resource-Types

volumes

volume-attachments

volume-backups

boot-volume-backups

backup-policies

backup-policy-assignments

volume-groups

volume-group-backups

Comments

A policy that uses <verb> volume-family is equivalent to writing one with a separate <verb> <individual resource-type> statement for each of the individual resource-types.

See the table in Details for Verb + Resource-Type Combinations for a detailed breakout of the API operations covered by each verb, for each individual resource-type included in volume-family.

Supported Variables

The Core Services support all the general variables, plus the ones listed here. For more information about general variables supported by Oracle Cloud Infrastructure services, see General Variables for All Requests.

Variable Variable Type Comments
target.boot-volume.kms-key.id String Use this variable to control whether Compute instances can be launched with boot volumes that were created without a Vault service master encryption key.

Details for Verb + Resource-Type Combinations

The following tables show the permissions and API operations covered by each verb. The level of access is cumulative as you go from inspect > read > use > manage. A plus sign (+) in a table cell indicates incremental access compared to the cell directly above it, whereas "no extra" indicates no incremental access.

For example, the read and use verbs for the vcns resource-type cover no extra permissions or API operations compared to the inspect verb. However, the manage verb includes several extra permissions and API operations.

For virtual-network-family Resource Types

vcns
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VCN_READ

ListVcns

GetVcn

CreateNatGateway, DeleteNatGateway (both also need manage nat-gateways and manage vcns)

Note: The above operations in this cell are totally covered with just manage virtual-network-family.

read

no extra

no extra

no extra

use

no extra

no extra

no extra

manage

USE +

VCN_ATTACH

VCN_DETACH

VCN_UPDATE

VCN_CREATE

VCN_DELETE

VCN_MOVE

USE +

CreateVcn

UpdateVcn

DeleteVcn

ChangeVcnCompartment

USE +

CreateSubnet, DeleteSubnet (both also need manage route-tables and manage-security-lists and manage-dhcp-options)

CreateInternetGateway, DeleteInternetGateway (also need manage internet-gateways)

CreateLocalPeeringGateway (also need manage local-peering-gateways, and need manage route-tables if you associate a route table during creation)

DeleteLocalPeeringGateway (also need manage local-peering-gateways)

CreateNatGateway, DeleteNatGateway (also need manage nat-gateways)

CreateNetworkSecurityGroup, DeleteNetworkSecurityGroup (also need manage network-security-groups)

CreateRouteTable, DeleteRouteTable (also need manage route-tables, manage internet-gateways, manage drgs, manage private-ips, manage local-peering-gateways, use nat-gateways, use service-gateways)

CreateServiceGateway, DeleteServiceGateway (also need manage service-gateways)

CreateSecurityList, DeleteSecurityList (also need manage security-lists)

CreateDhcpOptions, DeleteDhcpOptions (also need manage dhcp-options)

CreateDrgAttachment (also need manage drgs, and need manage route-tables if you associate a route table during creation)

DeleteDrgAttachment (also need manage drgs)

Note: The operations above are totally covered with just manage virtual-network-family.

subnets
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

SUBNET_READ

ListSubnets

GetSubnet

none

read

no extra

no extra

none

use

READ +

SUBNET_ATTACH

SUBNET_DETACH

no extra

LaunchInstance (also need use vnics, use network-security-groups, and manage instance-family)

TerminateInstance (also need manage instance-family, and use volumes if a volume is attached)

AttachVnic (also need manage instances, use network-security-groups, and either use vnics or use instance-family)

DetachVnic (also need manage instances and either use vnics or use instance-family)

CreatePrivateIp, DeletePrivateIp (both also need use private-ips and use vnics)

manage

USE +

SUBNET_CREATE

SUBNET_UPDATE

SUBNET_DELETE

SUBNET_MOVE

no extra

ChangeSubnetCompartment

USE +

CreateSubnet, DeleteSubnet (both also need manage vcns, manage route-tables, manage security-lists, manage dhcp-options)

UpdateSubnet (also need manage route-tables if changing which route table is associated with the subnet, manage security-lists if changing which security lists are associated with the subnet, and manage dhcp-options if changing which set of DHCP options is associated with the subnet)

Note: The above operations in this cell are covered with just manage virtual-network-family.

route-tables
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

ROUTE_TABLE_READ

ListRouteTables

GetRouteTable

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

USE +

ROUTE_TABLE_ATTACH

ROUTE_TABLE_DETACH

ROUTE_TABLE_UPDATE

ROUTE_TABLE_CREATE

ROUTE_TABLE_DELETE

ROUTE_TABLE_MOVE

no extra

ChangeRouteTableCompartment

CreateRouteTable, DeleteRouteTable (both also need manage vcns, manage internet-gateways, manage drgs, manage private-ips, manage local-peering-gateways, use nat-gateways, use service-gateways)

UpdateRouteTable (also need manage internet-gateways, manage drgs, manage private-ips, manage local-peering-gateways, use nat-gateways, use service-gateways)

CreateSubnet, DeleteSubnet (both also need manage vcns, manage subnets, manage security-lists, manage dhcp-options)

UpdateSubnet (if changing which route table is associated with the subnet, also need manage subnets)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

network-security-groups
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

NETWORK_SECURITY_GROUP_INSPECT

none

AddNetworkSecurityGroupSecurityRules and UpdateNetworkSecurityGroupSecurityRules (both also need manage network-security-groups)
read

INSPECT +

NETWORK_SECURITY_GROUP_READ

INSPECT +

GetNetworkSecurityGroup

ListNetworkSecurityGroups

no extra

use

READ +

NETWORK_SECURITY_GROUP_LIST_SECURITY_RULES

NETWORK_SECURITY_GROUP_LIST_MEMBERS

NETWORK_SECURITY_GROUP_UPDATE_MEMBERS

READ +

ListNetworkSecurityGroupSecurityRules

ListNetworkSecurityGroupVnics

READ +

LaunchInstance (also need manage instances, read instance-images, use vnics, use subnets, and read app-catalog-listing)

AttachVnic (also need manage instances, and use subnets)

UpdateVnic (also need use vnics)

manage

USE +

NETWORK_SECURITY_GROUP_UPDATE

NETWORK_SECURITY_GROUP_CREATE

NETWORK_SECURITY_GROUP_DELETE

NETWORK_SECURITY_GROUP_MOVE

NETWORK_SECURITY_GROUP_UPDATE_SECURITY_RULES

USE +

UpdateNetworkSecurityGroup

ChangeNetworkSecurityGroupCompartment

AddNetworkSecurityGroupSecurityRules

UpdateNetworkSecurityGroupSecurityRules

RemoveNetworkSecurityGroupSecurityRules

USE +

CreateNetworkSecurityGroup, DeleteNetworkSecurityGroup (both also need manage vcns)

Note: Both of the above operations in this cell are totally covered with just manage virtual-network-family.

security-lists
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

SECURITY_LIST_READ

ListSecurityLists

GetSecurityList

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

USE +

SECURITY_LIST_ATTACH

SECURITY_LIST_DETACH

SECURITY_LIST_UPDATE

SECURITY_LIST_CREATE

SECURITY_LIST_DELETE

SECURITY_LIST_MOVE

USE +

UpdateSecurityList

Note: Ability to update a security list is available only with the manage verb, not the use verb.

ChangeSecurityListCompartment

CreateSecurityList, DeleteSecurityList (both also need manage vcns)

CreateSubnet, DeleteSubnet (both also need manage vcns, manage subnets, manage route-tables, manage dhcp-options)

UpdateSubnet (if changing which security lists are associated with the subnet, also need manage subnets)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

dhcp-options
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

DHCP_READ

ListDhcpOptions

GetDhcpOptions

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

USE +

DHCP_ATTACH

DHCP_DETACH

DHCP_UPDATE

DHCP_CREATE

DHCP_DELETE

DHCP_MOVE

USE +

UpdateDhcpOptions

Note: Ability to update a set of DHCP options is available only with the manage verb, not the use verb.

ChangeDhcpOptionsCompartment

USE +

CreateDhcpOptions, DeleteDhcpOptions (both also need manage vcns)

CreateSubnet, DeleteSubnet (also need manage vcns, manage subnets, manage route-tables, manage security-lists)

UpdateSubnet (if changing which set of DHCP options is associated with the subnet, also need manage subnets)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

private-ips
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

PRIVATE_IP_READ

ListPrivateIps

GetPrivateIp

For ephemeral public IPs only: ListPublicIps,GetPublicIpByPrivateIpId, GetPublicIpByIpAddress

none

read

no extra

no extra

none

use

READ +

PRIVATE_IP_UPDATE

PRIVATE_IP_ASSIGN

PRIVATE_IP_UNASSIGN

PRIVATE_IP_CREATE

PRIVATE_IP_DELETE

PRIVATE_IP_ASSIGN_PUBLIC_IP

PRIVATE_IP_UNASSIGN_PUBLIC_IP

READ +

For ephemeral public IPs: UpdatePublicIp, CreatePublicIp, DeletePublicIp

CreatePrivateIp, DeletePrivateIp (both also need use subnets and use vnics)

UpdatePrivateIp (also needs use vnics)

For reserved public IPs: UpdatePublicIp, CreatePublicIp, DeletePublicIp (all also need manage public-ips)

Note: The above operations in this cell are totally covered with just use virtual-network-family.

manage

USE +

PRIVATE_IP_ROUTE_TABLE_ATTACH

PRIVATE_IP_ROUTE_TABLE_DETACH

no extra

USE +

CreateRouteTable, DeleteRouteTable (both also need manage vcns, manage internet-gateways, manage drgs, and manage route-tables, manage local-peering-gateways, use nat-gateways, use service-gateways)

UpdateRouteTable (also need manage internet-gateways, manage drgs, manage route-tables, manage local-peering-gateways, use nat-gateways, use service-gateways)

Note: The above operations in this cell are totally covered with just manage virtual-network-family.

public-ips
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

none

none

none

read

PUBLIC_IP_READ

For reserved public IPs only: ListPublicIps,GetPublicIpByPrivateIpId, GetPublicIpByIpAddress

Permissions for listing/getting ephemeral public IPs are part of the private-ip permissions.

none

use

READ +

PUBLIC_IP_ASSIGN_PRIVATE_IP

PUBLIC_IP_UNASSIGN_PRIVATE_IP

no extra

For reserved public IPs: UpdatePublicIp, CreatePublicIp, DeletePublicIp (all of these also need use private-ips and manage public-ips).

Note: The above operations in this cell are totally covered with just manage virtual-network-family.

manage

USE +

PUBLIC_IP_UPDATE

PUBLIC_IP_CREATE

PUBLIC_IP_DELETE

no extra

USE +

For reserved public IPs: UpdatePublicIp, CreatePublicIp, DeletePublicIp (all of these also need use private-ips).

Note: The above operations in this cell are totally covered with just manage virtual-network-family.

ipv6s
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

none

none

none

read

IPV6_READ

GetIpv6

ListIpv6s (also need inspect vnics and inspect subnets to list IPv6s by VNIC and subnets)

Note: The above operation in this cell is totally covered with just use virtual-network-family.

use

no extra

no extra

no extra

manage

USE +

IPV6_UPDATE

IPV6_CREATE

IPV6_DELETE

no extra

USE +

UpdateIpv6 (also need use vnics)

CreateIpv6, DeleteIpv6 (both also need use vnics and use subnets)

Note: The above operations in this cell are totally covered with just manage virtual-network-family.

internet-gateways
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

INTERNET_GATEWAY_READ

ListInternetGateways

GetInternetGateway

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

USE +

INTERNET_GATEWAY_ATTACH

INTERNET_GATEWAY_DETACH

INTERNET_GATEWAY_UPDATE

INTERNET_GATEWAY_CREATE

INTERNET_GATEWAY_DELETE

INTERNET_GATEWAY_MOVE

USE +

UpdateInternetGateway

Note: Ability to update a an internet gateway is available only with the manage verb, not the use verb.

ChangeInternetGatewayCompartment

CreateInternetGateway, DeleteInternetGateway (both also need manage vcns)

CreateRouteTable, DeleteRouteTable (both also need manage route-tables, manage vcns, manage drgs, manage private-ips, manage local-peering-gateways, use nat-gateways, use nat-gateways, use service-gateways)

UpdateRouteTable (also need manage route-tables, manage drgs, manage private-ips, manage local-peering-gateways, use nat-gateways, use service-gateways)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

nat-gateways
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

none

none

none

read

NAT_GATEWAY_READ

ListNatGateways

GetNatGateway

none

use

READ +

NAT_GATEWAY_ATTACH

NAT_GATEWAY_DETACH

no extra

READ +

CreateRouteTable, DeleteRouteTable (both also need manage route-tables, manage vcns, manage drgs, manage private-ips, manage internet-gateways, manage local-peering-gateways, use service-gateways)

UpdateRouteTable (also need manage route-tables, manage drgs, manage private-ips, manage internet-gateways, manage local-peering-gateways, use service-gateways)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

manage

USE +

NAT_GATEWAY_UPDATE

NAT_GATEWAY_CREATE

NAT_GATEWAY_DELETE

NAT_GATEWAY_MOVE

USE +

UpdateNatGateway

ChangeNatGatewayCompartment

Note: Ability to update a NAT gateway is available only with the manage verb, not the use verb.

CreateNatGateway, DeleteNatGateway (both also need manage vcns)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

service-gateways
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

SERVICE_GATEWAY_READ

ListServiceGateways

GetServiceGateway

none

read

no extra

no extra

no extra

use

READ +

SERVICE_GATEWAY_ATTACH

SERVICE_GATEWAY_DETACH

no extra

READ +

CreateRouteTable, DeleteRouteTable (both also need manage route-tables, manage vcns, manage internet-gateways, manage drgs, manage private-ips, manage local-peering-gateways)

UpdateRouteTable (also need manage route-tables, manage drgs, manage internet-gateways, manage private-ips, manage local-peering-gateways)

manage

USE +

SERVICE_GATEWAY_UPDATE

SERVICE_GATEWAY_CREATE

SERVICE_GATEWAY_DELETE

SERVICE_GATEWAY_ADD_SERVICE

SERVICE_GATEWAY_DELETE_SERVICE

SERVICE_GATEWAY_MOVE

USE +

ChangeServiceGatewayCompartment

AttachServiceId

DetachServiceId

Note: Ability to update a service gateway is available only with the manage verb, not the use verb.

CreateServiceGateway (also need manage vcns, and need manage route-tables if you associate a route table during creation)

UpdateServiceGateway (also need manage route-tables if you associate a route table during the update)

DeleteServiceGateway (also need manage vcns)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

local-peering-gateways
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

LOCAL_PEERING_GATEWAY_READ

ListLocalPeeringGateways

GetLocalPeeringGateway

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

USE +

LOCAL_PEERING_GATEWAY_UPDATE

LOCAL_PEERING_GATEWAY_ATTACH

LOCAL_PEERING_GATEWAY_DETACH

LOCAL_PEERING_GATEWAY_CREATE

LOCAL_PEERING_GATEWAY_DELETE

LOCAL_PEERING_GATEWAY_MOVE

no extra

CreateLocalPeeringGateway (also need manage vcns, and need manage route-tables if you associate a route table during creation)

UpdateLocalPeeringGateway (also need manage route-tables if you associate a route table during the update)

DeleteLocalPeeringGateway (also need manage vcns)

CreateRouteTable, DeleteRouteTable (both also need manage route-tables, manage vcns, manage internet-gateways, manage drgs, manage private-ips, use nat-gateways, use service-gateways)

UpdateRouteTable (also need manage route-tables, manage internet-gateways, manage drgs, manage private-ips, use nat-gateways, use service-gateways)

ChangeLocalPeeringGatewayCompartment

Note: The above operations in this cell are totally covered with just manage virtual-network-family.

local-peering-from
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

LOCAL_PEERING_GATEWAY_READ

none

none

read

no extra

none

none

use

no extra

none

none

manage

USE +

LOCAL_PEERING_GATEWAY_CONNECT_FROM

no extra

ConnectLocalPeeringGateways (acceptor in the peering relationship must also grant the requestor manage local-peering-to in the compartment where the acceptor's LPG resides. See Local VCN Peering (Within Region).)

Note: The above operation in this cell is totally covered with just manage virtual-network-family.

local-peering-to
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

LOCAL_PEERING_GATEWAY_READ

none

none

read

no extra

none

none

use

no extra

none

none

manage

USE +

LOCAL_PEERING_GATEWAY_CONNECT_TO

no extra

ConnectLocalPeeringGateways (requestor in the peering relationship must also have manage local-peering-from in the compartment where the requestor's LPG resides. See Local VCN Peering (Within Region).)

Note: The above operation in this cell is totally covered with just manage virtual-network-family.

remote-peering-connections
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

REMOTE_PEERING_CONNECTION_READ

ListRemotePeeringConnections

GetRemotePeeringConnection

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

USE +

REMOTE_PEERING_CONNECTION_UPDATE

REMOTE_PEERING_CONNECTION_CREATE

REMOTE_PEERING_CONNECTION_DELETE

REMOTE_PEERING_CONNECTION_RESOURCE_MOVE

UpdateRemotePeeringConnection

CreateRemotePeeringConnection, DeleteRemotePeeringConnection (both also need manage drgs)

ChangeRemotePeeringConnectionCompartment

Note: The above operations in this cell are totally covered with just manage virtual-network-family.

remote-peering-from
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

REMOTE_PEERING_CONNECTION_READ

none

none

read

no extra

none

none

use

no extra

none

none

manage

USE +

REMOTE_PEERING_CONNECTION_CONNECT_FROM

no extra

ConnectRemotePeeringConnections (acceptor in the peering relationship must also grant the requestor manage remote-peering-to in the compartment where the acceptor's RPC resides. See Remote VCN Peering (Across Regions).)

Note: The above operation in this cell is totally covered with just manage virtual-network-family.

remote-peering-to
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

REMOTE_PEERING_CONNECTION_READ

none

none

read

no extra

none

none

use

no extra

none

none

manage

USE +

REMOTE_PEERING_CONNECTION_CONNECT_TO

no extra

ConnectRemotePeeringConnections (requestor in the peering relationship must also have manage remote-peering-from in the compartment where the requestor's RPC resides. See Remote VCN Peering (Across Regions).)

Note: The above operation in this cell is totally covered with just manage virtual-network-family.

drgs
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

DRG_READ

DRG_ATTACHMENT_READ

ListDrgs

GetDrg

ListDrgAttachments

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

USE +

DRG_ATTACH

DRG_DETACH

DRG_UPDATE

DRG_ATTACHMENT_UPDATE

DRG_CREATE

DRG_DELETE

DRG_MOVE

USE +

CreateDrg

UpdateDrg

DeleteDrg

ChangeDrgCompartment

CreateDrgAttachment (also need manage vcns, and need manage route-tables if you associate a route table during creation)

UpdateDrgAttachment (also need manage route-tables if you associate a route table during the update)

DeleteDrgAttachment (also need manage vcns)

CreateRouteTable, DeleteRouteTable (both also need manage route-tables, manage vcns, manage internet-gateways, manage private-ips, manage local-peering-gateways, use nat-gateways, use service-gateways)

UpdateRouteTable (also need manage route-tables, manage internet-gateways, manage private-ips, manage local-peering-gateways, use nat-gateways, use service-gateways)

UpdateVirtualCircuit (also need use virtual-circuits, and if you're also changing which cross-connect or cross-connect group the virtual circuit uses, also need manage cross-connects)

CreateVirtualCircuit, DeleteVirtualCircuit (also need manage virtual-circuits, and if you're also adding or removing the virtual circuit to/from a cross-connect or cross-connect group, also need manage cross-connects)

CreateRemotePeeringConnection, DeleteRemotePeeringConnection (both also need manage remote-peering-connections)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

cpes
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

CPE_READ

ListCpes

GetCpe

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

USE +

CPE_ATTACH

CPE_DETACH

CPE_UPDATE

CPE_CREATE

CPE_DELETE

CPE_RESOURCE_MOVE

USE +

CreateCpe

UpdateCpe

DeleteCpe

ChangeCpeCompartment

CreateIPSecConnection, DeleteIPSecConnection (both also need manage ipsec-connections and manage drgs)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

ipsec
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

IPSEC_CONNECTION_READ

ListIPSecConnections

GetIPSecConnection

GetIPSecConnectionStatus

ListIPSecConnectionTunnels

GetIPSecConnectionTunnel

GetTunnelCpeDeviceConfig

GetTunnelCpeDeviceTemplateContent

GetCpeDeviceTemplateContent

GetIpsecCpeDeviceTemplateContent

none

read

INSPECT +

IPSEC_CONNECTION_DEVICE_CONFIG_READ

INSPECT +

GetIPSecConnectionDeviceConfig

GetIPSecConnectionTunnelSharedSecret

none

use

no extra

no extra

none

manage

USE +

IPSEC_CONNECTION_CREATE

IPSEC_CONNECTION_UPDATE

IPSEC_CONNECTION_DELETE

IPSEC_CONNECTION_DEVICE_CONFIG_UPDATE

USE +

UpdateIPSecConnection

UpdateTunnelCpeDeviceConfig

UpdateIPSecConnectionTunnel

CreateIPSecConnection, DeleteIPSecConnection (both also need manage cpes and manage drgs)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

cross-connects
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

CROSS_CONNECT_READ

ListCrossConnects

GetCrossConnect

none

read

no extra

no extra

none

use

no extra

no extra

no extra

manage

USE +

CROSS_CONNECT_UPDATE

CROSS_CONNECT_CREATE

CROSS_CONNECT_DELETE

CROSS_CONNECT_RESOURCE_MOVE

CROSS_CONNECT_ATTACH

CROSS_CONNECT_DETACH

UpdateCrossConnect

CreateCrossConnect

DeleteCrossConnect

ChangeCrossConnectCompartment

UpdateVirtualCircuit (also need use virtual-circuits)

CreateVirtualCircuit, DeleteVirtualCircuit (also need manage virtual-circuits)

cross-connect-groups
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

CROSS_CONNECT_GROUP_READ

ListCrossConnectGroups

GetCrossConnectGroup

none

read

no extra

no extra

none

use

no extra

no extra

no extra

manage

USE +

CROSS_CONNECT_GROUP_UPDATE

CROSS_CONNECT_GROUP_CREATE

CROSS_CONNECT_GROUP_DELETE

CROSS_CONNECT_GROUP_RESOURCE_MOVE

UpdateCrossConnectGroup

CreateCrossConnectGroup

DeleteCrossConnectGroup

ChangeCrossConnectGroupCompartment

no extra

virtual-circuits
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VIRTUAL_CIRCUIT_READ

ListVirtualCircuits

GetVirtualCircuit

none

read

no extra

no extra

none

use

READ +

VIRTUAL_CIRCUIT_UPDATE

no extra

UpdateVirtualCircuit (also need manage drgs,and if you're also changing which cross-connect or cross-connect group the virtual circuit uses, also need manage cross-connects)
manage

USE +

VIRTUAL_CIRCUIT_CREATE

VIRTUAL_CIRCUIT_DELETE

VIRTUAL_CIRCUIT_RESOURCE_MOVE

ChangeVirtualCircuitCompartment

USE +

CreateVirtualCircuit, DeleteVirtualCircuit (both also need manage drgs, and if you're also creating/deleting the virtual circuit with a mapping to a specific cross-connect or cross-connect group, also need manage cross-connects)

Note: All of the above operations in this cell are totally covered with just manage virtual-network-family.

vnics
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VNIC_READ

GetVnic CreateInstanceConfiguration (if using the CreateInstanceConfigurationFromInstanceDetails subtype. Also need read instances, inspect vnic-attachments, inspect volumes, and inspect volume-attachments.)
read

no extra

no extra

none

use

READ +

VNIC_ATTACH

VNIC_DETACH

VNIC_CREATE

VNIC_DELETE

VNIC_UPDATE

VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP

VNIC_DISASSOCIATE_NETWORK_SECURITY_GROUP

no extra

READ +

LaunchInstance (also need use subnets, use network-security-groups, and manage instance-family)

AttachVnic (also need manage instances, use subnets, and use network-security-groups)

UpdateVnic (also need use network-security-groups)

DetachVnic (also need manage instances and use subnets)

CreatePrivateIp, DeletePrivateIp (both also need use subnets and use private-ips)

manage

no extra

no extra

no extra

vnic-attachments
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VNIC_ATTACHMENT_READ

GetVnicAttachment

ListVnicAttachments (also need inspect instances)

CreateInstanceConfiguration (if using the CreateInstanceConfigurationFromInstanceDetails subtype. Also need read instances, inspect vnics, inspect volumes, and inspect volume-attachments.)

read

no extra

none

no extra

use

no extra

none

no extra

manage

no extra

none

no extra

vlans
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VLAN_READ

ListVlans

GetVlan

none

read

no extra

no extra

none

use

READ +

no extra

UpdateVlan

none

manage

USE +

VLAN_CREATE

VLAN_DELETE

VLAN_ASSOCIATE_NETWORK_SECURITY_GROUP

VLAN_DISASSOCIATE_NETWORK_SECURITY_GROUP

VLAN_MOVE

no extra

ChangeVlanCompartment

USE +

CreateVlan, DeleteVlan (both also need manage vcns, manage route-tables, manage security-lists)

Note: The above operations in this cell are covered with just manage virtual-network-family.

For instance-family Resource Types

The instance-family aggregate resource-type includes extra permissions beyond the sum of the permissions for the individual resource-types included in instance-family. For example: It includes a few permissions for vnics and volumes, even though those resource-types aren't generally considered part of the instance-family. Why are there extras included? So you can write fewer policy statements to cover general use cases, like working with an instance that has an attached block volume. You can write one statement for instance-family instead of multiple statements covering instances, vnics, and volumes.

Here's a list of the extra permissions:

For inspect instance-family:

  • VNIC_READ
  • VNIC_ATTACHMENT_READ
  • VOLUME_ATTACHMENT_INSPECT

For read instance-family:

  • VOLUME_ATTACHMENT_READ

For use instance-family:

  • VNIC_ATTACH
  • VNIC_DETACH
  • VOLUME_ATTACHMENT_UPDATE

For manage instance-family:

  • VOLUME_ATTACHMENT_CREATE
  • VOLUME_ATTACHMENT_DELETE

The following tables list the permissions and API operations covered by each of the individual resource-types included in instance-family.

instances
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

INSTANCE_INSPECT

none

GetConsoleHistory, ListConsoleHistories (both also need inspect console-histories)

ListVnicAttachments (also need inspect vnic-attachments)

ListVolumeAttachments (also need inspect volumes and inspect volume-attachments)

GetVolumeAttachments (also need inspect volumes and inspect volume-attachments)

read

INSPECT +

INSTANCE_READ

ListInstances

GetInstance

Note: ListInstances and GetInstance include any user-provided metadata added to the instance

INSPECT +

CaptureConsoleHistory (also need manage console-histories and read instance-images)

ShowConsoleHistoryData (also need read console-histories and read instance-images)

CreateInstanceConfiguration (if using the CreateInstanceConfigurationFromInstanceDetails subtype. Also need inspect vnics, inspect vnic-attachments, inspect volumes, and inspect volume-attachments.)

use

READ +

INSTANCE_UPDATE

INSTANCE_CREATE_IMAGE

INSTANCE_POWER_ACTIONS

INSTANCE_ATTACH_VOLUME

INSTANCE_DETACH_VOLUME

READ +

UpdateInstance

InstanceAction

READ +

CreateImage (also need manage instance-images)

AttachVolume (also need manage volume-attachments and use volumes)

DetachVolume (also need manage volume-attachments and use volumes)

manage

USE +

INSTANCE_CREATE

INSTANCE_DELETE

INSTANCE_ATTACH_SECONDARY_VNIC

INSTANCE_DETACH_SECONDARY_VNIC

INSTANCE_MOVE

ChangeInstanceCompartment

USE +

LaunchInstance (also need read instance-images, use vnics, use subnets, use network-security-groups, and read app-catalog-listing. To launch instances using the Console, also need inspect vcns.)

TerminateInstance (also need use vnics and use subnets; also need manage volume-attachments and use volumes if a volume is attached)

AttachVnic (also need use subnets, use network-security-groups, and either use vnics or use instance-family)

DetachVnic (also need use subnets and either use vnics or use instance-family)

GetWorkRequest, ListWorkRequestErrors, and ListWorkRequestLogs (for work requests related to instances resource types. All also need the permissions for LaunchInstance)

console-histories
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

CONSOLE_HISTORY_INSPECT

none

ListConsoleHistories, GetConsoleHistory (both also need inspect instances)
read

INSPECT +

CONSOLE_HISTORY_READ

none

INSPECT +

ShowConsoleHistoryData (also need read instances and read instance-images)

use

no extra

none

no extra

manage

USE +

CONSOLE_HISTORY_CREATE

CONSOLE_HISTORY_DELETE

DeleteConsoleHistory

USE +

CaptureConsoleHistory (also need read instances and read instance-images)

instance-console-connection
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

INSTANCE_CONSOLE_CONNECTION_INSPECT

none

ListInstanceConsoleConnections (also need inspect instances and read instances)
read

INSPECT +

INSTANCE_CONSOLE_CONNECTION_READ

none

INSPECT +

GetInstanceConsoleConnection (also need read instances)

use

READ +

none

no extra

manage

USE +

INSTANCE_CONSOLE_CONNECTION_CREATE

INSTANCE_CONSOLE_CONNECTION_DELETE

DeleteInstanceConsoleConnection CreateInstanceConsoleConnection (also need read instances)
instance-images
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

INSTANCE_IMAGE_INSPECT

ListImages

GetImage

none

read

INSPECT +

INSTANCE_IMAGE_READ

no extra

INSPECT +

LaunchInstance (also need manage instances, use vnics, use subnets, and use network-security-groups)

CaptureConsoleHistory (also need read instances and manage console-histories)

ShowConsoleHistoryData (also need read instances and read console-histories)

use

READ +

INSTANCE_IMAGE_UPDATE

UpdateImage

no extra

manage

USE +

INSTANCE_IMAGE_CREATE

INSTANCE_IMAGE_DELETE

INSTANCE_IMAGE_MOVE

DeleteImage

ChangeImageCompartment

USE +

CreateImage (also need use instances)

GetWorkRequest, ListWorkRequestErrors, and ListWorkRequestLogs (for work requests related to instance-images resource types. All also need the permissions for CreateImage)

app-catalog-listing
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

APP_CATALOG_LISTING_INSPECT

ListAppCatalogSubscriptions

none

read

INSPECT +

APP_CATALOG_LISTING_READ

no extra

INSPECT +

LaunchInstance (Also need use instances, read instance-images, use vnics, use subnets, and use network-security-groups)

manage

READ +

APP_CATALOG_LISTING_SUBSCRIBE

READ +

CreateAppCatalogSubscription

DeleteAppCatalogSubscription

none

For compute-management-family Resource Types

The following tables list the permissions and API operations covered by each of the individual resource-types included in compute-management-family.

instance-configurations
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

INSTANCE_CONFIGURATION_INSPECT

ListInstanceConfigurations

none

read

INSPECT +

INSTANCE_CONFIGURATION_READ

INSPECT +

GetInstanceConfiguration

none

use

no extra

no extra

none

manage

USE +

INSTANCE_CONFIGURATION_CREATE

INSTANCE_CONFIGURATION_UPDATE

INSTANCE_CONFIGURATION_LAUNCH

INSTANCE_CONFIGURATION_DELETE

INSTANCE_CONFIGURATION_MOVE

USE +

CreateInstanceConfiguration (if using the CreateInstanceConfigurationDetails subtype)

UpdateInstanceConfiguration

LaunchInstanceConfiguration

DeleteInstanceConfiguration

ChangeInstanceConfigurationCompartment

none

instance-pools
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

INSTANCE_POOL_INSPECT

ListInstancePools

none

read

INSPECT +

INSTANCE_POOL_READ

INSPECT +

GetInstancePool

ListInstancePoolInstances

none

use

READ +

INSTANCE_POOL_POWER_ACTIONS

no extra

ResetInstancePool

SoftresetInstancePool

StartInstancePool

StopInstancePool

All also need use instances.

manage

USE +

INSTANCE_POOL_CREATE

INSTANCE_POOL_UPDATE

INSTANCE_POOL_DELETE

INSTANCE_POOL_MOVE

USE +

UpdateInstancePool

ChangeInstancePoolCompartment

USE +

CreateInstancePool (also need manage instances, read instance-images, use vnics, and use subnets)

TerminateInstancePool (also need manage instances, use vnics, use subnets, manage volume-attachments, and use volumes)

GetWorkRequest, ListWorkRequestErrors, and ListWorkRequestLogs (for work requests related to instance-pools resource types. All also need the permissions for CreateInstancePool or TerminateInstancePool, depending on the operation that spawns the work request)

cluster-networks
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

CLUSTER_NETWORK_INSPECT

ListClusterNetworks

none

read

INSPECT +

CLUSTER_NETWORK_READ

INSPECT +

GetClusterNetwork

ListClusterNetworkInstances (also need read instance-pools)
use

no extra

no extra

no extra

manage

USE +

CLUSTER_NETWORK_CREATE

CLUSTER_NETWORK_UPDATE

CLUSTER_NETWORK_DELETE

CLUSTER_NETWORK_MOVE

USE +

UpdateClusterNetwork

ChangeClusterNetworkCompartment

USE +

CreateClusterNetwork (also need manage instances, manage instance-pools, read instance-images, use vnics, and use subnets)

TerminateClusterNetwork (also need manage instances, manage instance-pools, use vnics, use subnets, manage volume-attachments, and use volumes)

GetWorkRequest, ListWorkRequestErrors, and ListWorkRequestLogs (for work requests related to cluster-networks resource types. All also need the permissions for CreateClusterNetwork or TerminateClusterNetwork, depending on the operation that spawns the work request)

For Additional Compute Individual Resource Types

The following tables list the permissions and API operations covered by other Compute resource-types that aren't included in any aggregate resource-types.

auto-scaling-configurations
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

AUTO_SCALING_CONFIGURATION_INSPECT

ListAutoScalingConfigurations

ListAutoScalingPolicies

none

read

INSPECT +

AUTO_SCALING_CONFIGURATION_READ

INSPECT +

GetAutoScalingConfiguration

GetAutoScalingPolicy

none

use

no extra

no extra

none

manage

USE +

AUTO_SCALING_CONFIGURATION_CREATE

AUTO_SCALING_CONFIGURATION_UPDATE

AUTO_SCALING_CONFIGURATION_DELETE

AUTO_SCALING_CONFIGURATION_MOVE

USE +

ChangeAutoScalingConfigurationCompartment

USE +

CreateAutoScalingConfiguration

UpdateAutoScalingConfiguration

DeleteAutoScalingConfiguration

CreateAutoScalingPolicy

UpdateAutoScalingPolicy

DeleteAutoScalingPolicy

All also need manage instance-pools.

dedicated-vm-hosts
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

DEDICATED_VM_HOST_INSPECT

ListDedicatedVmHosts

none

read

INSPECT +

DEDICATED_VM_HOST_READ

INSPECT +

GetDedicatedVmHost

ListDedicatedVmHostInstances

none

use

INSPECT +

DEDICATED_VM_HOST_LAUNCH_INSTANCE

DEDICATED_VM_HOST_UPDATE

INSPECT +

UpdateDedicatedVmHost

INSPECT +

LaunchInstance

All also need create instance in the compartment to launch the instance in and dedicated vm host launch instance in the comparment for the dedicated virtual machine host.

manage

USE +

DEDICATED_VM_HOST_CREATE

DEDICATED_VM_HOST_MOVE

DEDICATED_VM_HOST_DELETE

USE +

CreateDedicatedVmHost

DeleteDedicatedVmHost

ChangeDedicatedVmHostCompartment

USE +

none

work-requests
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

WORKREQUEST_INSPECT

ListWorkRequests

none

read

no extra

no extra

none

use

no extra

no extra

none

manage

no extra

no extra

none

For volume-family Resource Types

The following tables list the permissions and API operations covered by each of the individual resource-types included in volume-family.

volumes
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VOLUME_INSPECT

ListVolumes

GetVolume

ListVolumeBackups, GetVolumeBackup (these also need inspect volume-backups)

UpdateVolumeBackup (also need read volume-backups)

DeleteVolumeBackup (also need manage volume-backups)

GetVolumeAttachment (also need inspect instances and inspect volume-attachments). If you need to get the CHAP secret if it exists, read volume-attachments is required.

CreateInstanceConfiguration (if using the CreateInstanceConfigurationFromInstanceDetails subtype. Also need read instances, inspect vnics, inspect vnic-attachments, and inspect volume-attachments.)

read

no extra

no extra

no extra

use

READ +

VOLUME_UPDATE

VOLUME_WRITE

no extra

READ +

AttachVolume and DetachVolume (both also need manage volume-attachments, use instances)

CreateVolumeBackup (also need manage volume-backups)

manage

USE +

VOLUME_CREATE

VOLUME_DELETE

VOLUME_MOVE

USE +

CreateVolume

DeleteVolume

ChangeVolumeCompartment

When moving volumes between compartments, the move volume permission is needed for both source and destination compartments.

USE +

If creating a volume from a backup, also need read volume-backups.

If creating a volume encrypted with a Vault service master encryption key, also need use key-delegate (for the caller) and read keys (for the service principal). For more information, see Details for the Vault Service.

volume-attachments
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VOLUME_ATTACHMENT_INSPECT

ListVolumeAttachments

GetVolumeAttachment (also need inspect volumes and inspect instances)

Note: The CHAP secret (if it exists) is NOT included with inspect volume-attachments.

CreateInstanceConfiguration (if using the CreateInstanceConfigurationFromInstanceDetails subtype. Also need read instances, inspect vnics, inspect vnic-attachments, and inspect volumes.)

read

INSPECT +

VOLUME_ATTACHMENT_READ

no extra

Same as for inspect volume-attachments, except that GetVolumeAttachment also includes the CHAP secret, if it exists.

use

READ +

VOLUME_ATTACHMENT_UPDATE

no extra

no extra

manage

USE +

VOLUME_ATTACHMENT_CREATE

VOLUME_ATTACHMENT_DELETE

no extra

USE +

AttachVolume, DetachVolume (both also need use volumes and use instances)

volume-backups
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VOLUME_BACKUP_INSPECT

none

ListVolumeBackups, GetVolumeBackup (both also need inspect volumes)
read

INSPECT +

VOLUME_BACKUP_READ

none

INSPECT +

CreateVolume when creating volume from an backup (also need manage volumes)

use

READ +

VOLUME_BACKUP_COPY

VOLUME_BACKUP_UPDATE

none

READ +

UpdateVolumeBackup (also need inspect volumes)

CopyVolumeBackup (also need create volume backups in destination region)

manage

USE +

VOLUME_BACKUP_CREATE

VOLUME_BACKUP_DELETE

VOLUME_BACKUP_MOVE

ChangeVolumeBackupCompartment

When moving volume backups between compartments, the move volume backup permission is needed for both source and destination compartments.

USE +

CreateVolumeBackup (also need use volumes)

DeleteVolumeBackup (also need inspect volumes)

boot-volume-backups
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

BOOT_VOLUME_BACKUP_INSPECT

none

ListBootVolumeBackups, GetBootVolumeBackup (both also need inspect volumes)
read

INSPECT +

BOOT_VOLUME_BACKUP_READ

none

INSPECT +

CreateBootVolume when creating volume from an backup (also need manage volumes)

use

READ +

BOOT_VOLUME_BACKUP_UPDATE

BOOT_VOLUME_BACKUP_COPY

none

READ +

UpdateBootVolumeBackup (also need inspect volumes)

CopyBootVolumeBackup (also need create boot volume backups in destination region)

manage

USE +

BOOT_VOLUME_BACKUP_CREATE

BOOT_VOLUME_BACKUP_DELETE

BOOT_VOLUME_BACKUP_MOVE

ChangeVolumeBackupCompartment

When moving boot volume backups between compartments, the move boot volume backup permission is needed for both source and destination compartments.

USE +

CreateBootVolumeBackup (also need use volumes)

DeleteBootVolumeBackup (also need inspect volumes)

backup-policies
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

BACKUP_POLICY_INSPECT

ListVolumeBackupPolicies

GetVolumeBackupPolicy

none

read

no extra

no extra

no extra

use

READ +

BACKUP_POLICIES_UPDATE

READ +

UpdateVolumeBackupPolicy

none

manage

USE +

BACKUP_POLICIES_CREATE

BACKUP_POLICIES_DELETE

USE +

CreateVolumeBackupPolicy

DeleteVolumeBackupPolicy

none

backup-policy-assignments
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

BACKUP_POLICY_ASSIGNMENT_INSPECT

GetVolumeBackupPolicyAssignment GetVolumeBackupPolicyAssetAssignment (also need inspect volumes)
read

no extra

no extra

no extra

use

no extra

no extra

no extra

manage

USE +

BACKUP_POLICY_ASSIGNMENT_CREATE

BACKUP_POLICY_ASSIGNMENT_DELETE

USE +

CreateVolumeBackupPolicyAssignment

DeleteVolumeBackupPolicyAssignment

none

volume-groups
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VOLUME_GROUP_INSPECT

ListVolumeGroups

GetVolumeGroup

no extra

read

no extra

no extra

no extra

use

no extra

no extra

no extra

manage

USE +

VOLUME_GROUP_UPDATE

VOLUME_GROUP_CREATE

VOLUME_GROUP_DELETE

VOLUME_GROUP_MOVE

USE +

DeleteVolumeGroup

USE +

UpdateVolumeGroup (also need inspect volume for the volumes in the request)

CreateVolumeGroup

If creating a volume group from a list of volumes, also need inspect volume for the volumes to include in the group

If creating a volume group from another volume group, also need the following:
  • inspect volume group for the source volume group
  • create volume group for the destination volume group
  • write volume for the source volumes
  • create volume for the destination volumes
  • write volume for the destination volumes
If creating a volume group from a volume group backup, also need the following:
  • inspect volume group backup for the source volume group
  • create volume group for the destination volume group
  • read volume backup or read boot volume backup for the source volumes
  • create volume for the destination volumes
  • write volume for the destination volumes

ChangeVolumeGroupCompartment (also need move volume or move boot volume for the volumes in the request)

When moving volume groups between compartments, the move volume group and move volume permissions are needed for both source and destination compartments.

volume-group-backups
Verbs Permissions APIs Fully Covered APIs Partially Covered
inspect

VOLUME_GROUP_BACKUP_INSPECT

ListVolumeGroupBackups

GetVolumeGroupBackup

no extra

read

no extra

no extra

no extra

use

no extra

no extra

no extra

manage

USE +

VOLUME_GROUP_BACKUP_UPDATE

VOLUME_GROUP_BACKUP_CREATE

VOLUME_GROUP_BACKUP_DELETE

VOLUME_GROUP_BACKUP_MOVE

USE +

UpdateVolumeGroupBackup

USE +

CreateVolumeGroupBackup also need the following:

DeleteVolumeGroupBackup also need delete volume backup or delete boot volume backup

ChangeVolumeGroupBackupCompartment (also need move volume backup or move boot volume backup for the volumes in the request)

When moving volume group backups between compartments, the move volume group backup and move volume backup permissions are needed for both source and destination compartments.

Permissions Required for Each API Operation

The following tables list the API operations grouped by resource type. The resource types are listed in alphabetical order.

For information about permissions, see Permissions.

Core Services API Operations

API Operation Permissions Required to Use the Operation
CreateVolumeBackupPolicy BACKUP_POLICIES_CREATE
DeleteVolumeBackupPolicy BACKUP_POLICIES_DELETE
GetVolumeBackupPolicy BACKUP_POLICIES_INSPECT
ListVolumeBackupPolicies BACKUP_POLICIES_INSPECT
CreateVolumeBackupPolicyAssignment BACKUP_POLICY_ASSIGNMENT_CREATE
DeleteVolumeBackupPolicyAssignment BACKUP_POLICY_ASSIGNMENT_DELETE
GetVolumeBackupPolicyAssetAssignment BACKUP_POLICY_ASSIGNMENT_INSPECT and VOLUME_INSPECT
GetVolumeBackupPolicyAssignment BACKUP_POLICY_ASSIGNMENT_INSPECT
ListClusterNetworks CLUSTER_NETWORK_INSPECT and INSTANCE_POOL_INSPECT
ListClusterNetworkInstances CLUSTER_NETWORK_READ and INSTANCE_POOL_READ
GetClusterNetwork CLUSTER_NETWORK_READ and INSTANCE_POOL_READ
UpdateClusterNetwork CLUSTER_NETWORK_UPDATE
CreateClusterNetwork

CLUSTER_NETWORK_CREATE and INSTANCE_POOL_CREATE

ChangeClusterNetworkCompartment CLUSTER_NETWORK_MOVE
TerminateClusterNetwork

CLUSTER_NETWORK_DELETE and INSTANCE_POOL_DELETE

ListConsoleHistories CONSOLE_HISTORY_READ and INSTANCE_INSPECT
GetConsoleHistory CONSOLE_HISTORY_READ and INSTANCE_INSPECT
ShowConsoleHistoryData CONSOLE_HISTORY_READ and INSTANCE_READ and INSTANCE_IMAGE_READ
CaptureConsoleHistory CONSOLE_HISTORY_CREATE and INSTANCE_READ and INSTANCE_IMAGE_READ
DeleteConsoleHistory CONSOLE_HISTORY_DELETE
ListCpes CPE_READ
GetCpe CPE_READ
UpdateCpe CPE_UPDATE
CreateCpe CPE_CREATE
DeleteCpe CPE_DELETE
ChangeCpeCompartment CPE_RESOURCE_MOVE
UpdateTunnelCpeDeviceConfig IPSEC_CONNECTION_UPDATE
GetTunnelCpeDeviceConfig IPSEC_CONNECTION_READ
GetTunnelCpeDeviceTemplateContent IPSEC_CONNECTION_READ
GetCpeDeviceTemplateContent IPSEC_CONNECTION_READ
GetIpsecCpeDeviceTemplateContent IPSEC_CONNECTION_READ
ListCrossConnects CROSS_CONNECT_READ
GetCrossConnect CROSS_CONNECT_READ
UpdateCrossConnect

CROSS_CONNECT_UPDATE

CreateCrossConnect

CROSS_CONNECT_CREATE if not creating cross-connect in a cross-connect group.

If creating the cross-connect in a cross-connect group, also need CROSS_CONNECT_CREATE and CROSS_CONNECT_ATTACH

DeleteCrossConnect

CROSS_CONNECT_DELETE if cross-connect is not in a cross-connect group.

If the cross-connect is in a cross-connect group, also need CROSS_CONNECT_DELETE and CROSS_CONNECT_DETACH

ChangeCrossConnectCompartment CROSS_CONNECT_RESOURCE_MOVE
ListCrossConnectGroups CROSS_CONNECT_GROUP_READ
GetCrossConnectGroup CROSS_CONNECT_GROUP_READ
UpdateCrossConnectGroup CROSS_CONNECT_GROUP_UPDATE
CreateCrossConnectGroup CROSS_CONNECT_GROUP_CREATE
DeleteCrossConnectGroup CROSS_CONNECT_GROUP_DELETE
ChangeCrossConnectGroupCompartment CROSS_CONNECT_GROUP_RESOURCE_MOVE
ListDhcpOptions DHCP_READ
GetDhcpOptions DHCP_READ
UpdateDhcpOptions DHCP_UPDATE
CreateDhcpOptions DHCP_CREATE and VCN_ATTACH
DeleteDhcpOptions DHCP_DELETE and VCN_DETACH
ChangeDhcpOptionsCompartment DHCP_MOVE
ListDrgs DRG_READ
GetDrg DRG_READ
UpdateDrg DRG_UPDATE
CreateDrg DRG_CREATE
DeleteDrg DRG_DELETE
ChangeDrgCompartment DRG_MOVE
ListDrgAttachments DRG_ATTACHMENT_READ
GetDrgAttachment DRG_ATTACHMENT_READ
UpdateDrgAttachment

DRG_ATTACHMENT_UPDATE

ROUTE_TABLE_ATTACH is necessary to associate a route table with the DRG attachment during the update.

CreateDrgAttachment

DRG_ATTACH and VCN_ATTACH

ROUTE_TABLE_ATTACH is necessary to associate a route table with the DRG attachment during creation.

DeleteDrgAttachment DRG_DETACH and VCN_DETACH
CreateInstanceConsoleConnection INSTANCE_CONSOLE_CONNECTION_CREATE and INSTANCE_READ
DeleteInstanceConsoleConnection INSTANCE_CONSOLE_CONNECTION_DELETE
GetInstanceConsoleConnection INSTANCE_CONSOLE_CONNECTION_READ and INSTANCE_READ
ListInstanceConsoleConnections INSTANCE_CONSOLE_CONNECTION_INSPECT and INSTANCE_INSPECT and INSTANCE_READ
ListImages INSTANCE_IMAGE_READ
GetImage INSTANCE_IMAGE_READ
UpdateImage INSTANCE_IMAGE_UPDATE
CreateImage

INSTANCE_IMAGE_CREATE and INSTANCE_CREATE_IMAGE

The first permission is related to the instance-image; the second is related to the instance.

ChangeImageCompartment INSTANCE_IMAGE_MOVE
DeleteImage INSTANCE_IMAGE_DELETE
ListInstances INSTANCE_READ
GetInstance INSTANCE_READ
LaunchInstance

INSTANCE_CREATE and INSTANCE_IMAGE_READ and VNIC_CREATE and VNIC_ATTACH and SUBNET_ATTACH

If putting the instance in a network security group during instance creation, also need NETWORK_SECURITY_GROUP_UPDATE_MEMBERS and VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP

UpdateInstance INSTANCE_UPDATE
InstanceAction INSTANCE_POWER_ACTIONS
ChangeInstanceCompartment INSTANCE_MOVE
TerminateInstance INSTANCE_DELETE and VNIC_DELETE and SUBNET_DETACH
ListInstanceConfigurations INSTANCE_CONFIGURATION_INSPECT
GetInstanceConfiguration INSTANCE_CONFIGURATION_READ
LaunchInstanceConfiguration INSTANCE_CONFIGURATION_LAUNCH
UpdateInstanceConfiguration INSTANCE_CONFIGURATION_UPDATE
CreateInstanceConfiguration

INSTANCE_CONFIGURATION_CREATE (if using the CreateInstanceConfigurationDetails subtype)

INSTANCE_READ and VNIC_READ and VNIC_ATTACHMENT_READ and VOLUME_INSPECT and VOLUME_ATTACHMENT_INSPECT (if using the CreateInstanceConfigurationFromInstanceDetails subtype)

ChangeInstanceConfigurationCompartment INSTANCE_CONFIGURATION_MOVE
DeleteInstanceConfiguration INSTANCE_CONFIGURATION_DELETE
ListInstancePools INSTANCE_POOL_INSPECT
ListInstancePoolInstances INSTANCE_POOL_READ
GetInstancePool INSTANCE_POOL_READ
UpdateInstancePool INSTANCE_POOL_UPDATE
ResetInstancePool INSTANCE_POOL_POWER_ACTIONS
SoftresetInstancePool INSTANCE_POOL_POWER_ACTIONS
StartInstancePool INSTANCE_POOL_POWER_ACTIONS
StopInstancePool INSTANCE_POOL_POWER_ACTIONS
CreateInstancePool INSTANCE_POOL_CREATE and INSTANCE_CREATE and IMAGE_READ and VNIC_CREATE and SUBNET_ATTACH
ChangeInstancePoolCompartment INSTANCE_POOL_MOVE
TerminateInstancePool

INSTANCE_POOL_DELETE and INSTANCE_DELETE and VNIC_DELETE and SUBNET_DETACH and VOLUME_ATTACHMENT_DELETE and VOLUME_WRITE

ListInternetGateways INTERNET_GATEWAY_READ
GetInternetGateway INTERNET_GATEWAY_READ
UpdateInternetGateway INTERNET_GATEWAY_UPDATE
CreateInternetGateway INTERNET_GATEWAY_CREATE and VCN_ATTACH
DeleteInternetGateway INTERNET_GATEWAY_DELETE and VCN_DETACH
ChangeInternetGatewayCompartment INTERNET_GATEWAY_MOVE
ListIPSecConnections IPSEC_CONNECTION_READ
GetIPSecConnection IPSEC_CONNECTION_READ
UpdateIpSecConnection IPSEC_CONNECTION_UPDATE
CreateIPSecConnection DRG_ATTACH and CPE_ATTACH and IPSEC_CONNECTION_CREATE
DeleteIPSecConnection DRG_DETACH and CPE_DETACH and IPSEC_CONNECTION_DELETE
GetIPSecConnectionDeviceConfig IPSEC_CONNECTION_DEVICE_CONFIG_READ
GetIPSecConnectionDeviceStatus IPSEC_CONNECTION_READ
ListIPSecConnectionTunnels IPSEC_CONNECTION_READ
GetIPSecConnectionTunnel IPSEC_CONNECTION_READ
UpdateIPSecConnectionTunnel IPSEC_CONNECTION_UPDATE
GetIPSecConnectionTunnelSharedSecret IPSEC_CONNECTION_DEVICE_CONFIG_READ
UpdateIPSecConnectionTunnelSharedSecret IPSEC_CONNECTION_DEVICE_CONFIG_UPDATE
ListIpv6s

IPV6_READ and SUBNET_READ (if listing by subnet) and VNIC_READ (if listing by VNIC)

GetIpv6 IPV6_READ
UpdateIpv6

IPV6_UPDATE and

VNIC_UNASSIGN and VNIC_ASSIGN (if moving IPv6 to a different VNIC)

CreateIpv6 IPV6_CREATE and SUBNET_ATTACH and VNIC_ASSIGN
DeleteIpv6 IPV6_DELETE and SUBNET_DETACH and VNIC_UNASSIGN
ListLocalPeeringGateways LOCAL_PEERING_GATEWAY_READ
GetLocalPeeringGateway LOCAL_PEERING_GATEWAY_READ
UpdateLocalPeeringGateway

LOCAL_PEERING_GATEWAY_UPDATE

ROUTE_TABLE_ATTACH is necessary to associate a route table with the LPG during the update.

CreateLocalPeeringGateway

LOCAL_PEERING_GATEWAY_CREATE and VCN_ATTACH

ROUTE_TABLE_ATTACH is necessary to associate a route table with the LPG during creation.

DeleteLocalPeeringGateway LOCAL_PEERING_GATEWAY_DELETE and VCN_DETACH
ConnectLocalPeeringGateway

LOCAL_PEERING_GATEWAY_CONNECT_FROM and

LOCAL_PEERING_GATEWAY_CONNECT_TO

ChangeLocalPeeringGatewayCompartment LOCAL_PEERING_GATEWAY_MOVE
ListNatGateways NAT_GATEWAY_READ
GetNatGateway NAT_GATEWAY_READ
UpdateNatGateway NAT_GATEWAY_UPDATE
CreateNatGateway NAT_GATEWAY_CREATE and VCN_READ and VCN_ATTACH
DeleteNatGateway NAT_GATEWAY_DELETE and VCN_READ and VCN_DETACH
ChangeNatGatewayCompartment NAT_GATEWAY_MOVE
ListNetworkSecurityGroups NETWORK_SECURITY_GROUP_READ
GetNetworkSecurityGroup NETWORK_SECURITY_GROUP_READ
UpdateNetworkSecurityGroup NETWORK_SECURITY_GROUP_UPDATE
CreateNetworkSecurityGroup

NETWORK_SECURITY_GROUP_CREATE and VCN_ATTACH

DeleteNetworkSecurityGroup NETWORK_SECURITY_GROUP_DELETE and VCN_DETACH
ChangeNetworkSecurityGroupCompartment NETWORK_SECURITY_GROUP_MOVE
ListNetworkSecurityGroupSecurityRules NETWORK_SECURITY_GROUP_LIST_SECURITY_RULES
UpdateNetworkSecurityGroupSecurityRules

NETWORK_SECURITY_GROUP_UPDATE_SECURITY_RULES and

NETWORK_SECURITY_GROUP_INSPECT if writing a rule that specifies a network security group as the source (for ingress rules) or destination (for egress rules)

AddNetworkSecurityGroupSecurityRules

NETWORK_SECURITY_GROUP_UPDATE_SECURITY_RULES and

NETWORK_SECURITY_GROUP_INSPECT if writing a rule that specifies a network security group as the source (for ingress rules) or destination (for egress rules)

RemoveNetworkSecurityGroupSecurityRules NETWORK_SECURITY_GROUP_UPDATE_SECURITY_RULES
ListPrivateIps PRIVATE_IP_READ
GetPrivateIp PRIVATE_IP_READ
UpdatePrivateIp PRIVATE_IP_UPDATE and VNIC_ASSIGN and VNIC_UNASSIGN
CreatePrivateIp

PRIVATE_IP_CREATE and PRIVATE_IP_ASSIGN and VNIC_ASSIGN and SUBNET_ATTACH

DeletePrivateIp PRIVATE_IP_DELETE and PRIVATE_IP_UNASSIGN and VNIC_UNASSIGN and SUBNET_DETACH
ListRemotePeeringConnections REMOTE_PEERING_CONNECTION_READ
GetRemotePeeringConnection REMOTE_PEERING_CONNECTION_READ
UpdateRemotePeeringConnection REMOTE_PEERING_CONNECTION_UPDATE
CreateRemotePeeringConnection REMOTE_PEERING_CONNECTION_CREATE and DRG_ATTACH
DeleteRemotePeeringConnection REMOTE_PEERING_CONNECTION_DELETE and DRG_DETACH
ChangeRemotePeeringConnectionCompartment REMOTE_PEERING_CONNECTION_RESOURCE_MOVE
ConnectRemotePeeringConnections

REMOTE_PEERING_CONNECTION_CONNECT_FROM and

REMOTE_PEERING_CONNECTION_CONNECT_TO

ListPublicIps

For ephemeral public IPs: PRIVATE_IP_READ

For reserved public IPs: PUBLIC_IP_READ

GetPublicIp

For ephemeral public IPs: PRIVATE_IP_READ

For reserved public IPs: PUBLIC_IP_READ

GetPublicIpByPrivateIpId

For ephemeral public IPs: PRIVATE_IP_READ

For reserved public IPs: PUBLIC_IP_READ

GetPublicIpByIpAddress

For ephemeral public IPs: PRIVATE_IP_READ

For reserved public IPs: PUBLIC_IP_READ

UpdatePublicIP

For ephemeral public IPs: PRIVATE_IP_UPDATE

For reserved public IPs: PUBLIC_IP_UPDATE and PRIVATE_IP_ASSIGN_PUBLIC_IP and PUBLIC_IP_ASSIGN_PRIVATE_IP and PRIVATE_IP_UNASSIGN_PUBLIC_IP and PUBLIC_IP_UNASSIGN_PRIVATE_IP

CreatePublicIp

For ephemeral public IPs: PRIVATE_IP_ASSIGN_PUBLIC_IP

For reserved public IPs: PUBLIC_IP_CREATE and PUBLIC_IP_ASSIGN_PRIVATE_IP and PRIVATE_IP_ASSIGN_PUBLIC_IP

DeletePublicIp

For ephemeral public IPs: PRIVATE_IP_UNASSIGN_PUBLIC_IP

For reserved public IPs: PUBLIC_IP_DELETE and PUBLIC_IP_UNASSIGN_PRIVATE_IP and PRIVATE_IP_UNASSIGN_PUBLIC_IP

ChangePublicIpCompartment

PUBLIC_IP_MOVE

Note: This operation applies only to reserved public IPs.

ListRouteTables ROUTE_TABLE_READ
GetRouteTable ROUTE_TABLE_READ
UpdateRouteTable

ROUTE_TABLE_UPDATE and

INTERNET_GATEWAY_ATTACH (if creating a route rule that uses an internet gateway as a target) and

INTERNET_GATEWAY_DETACH (if deleting a route rule that uses an internet gateway as a target) and

DRG_ATTACH (if creating a route rule that uses a DRG as a target) and

DRG_DETACH (if deleting a route rule that uses a DRG as a target) and

PRIVATE_IP_ROUTE_TABLE_ATTACH (if creating a route rule that uses a private IP as a target) and

PRIVATE_IP_ROUTE_TABLE_DETACH (if deleting a route rule that uses a private IP as a target) and

LOCAL_PEERING_GATEWAY_ATTACH (if creating a route rule that uses an LPG as a target) and

LOCAL_PEERING_GATEWAY_DETACH (if deleting a route rule that uses an LPG as a target) and

NAT_GATEWAY_ATTACH (if creating a route rule that uses a NAT gateway as a target) and

NAT_GATEWAY_DETACH (if deleting a route rule that uses a NAT gateway as a target) and

SERVICE_GATEWAY_ATTACH (if creating a route rule that uses a service gateway as a target) and

SERVICE_GATEWAY_DETACH (if deleting a route rule that uses a service gateway as a target)

CreateRouteTable

ROUTE_TABLE_CREATE and VCN_ATTACH and

INTERNET_GATEWAY_ATTACH (if creating a route rule that uses an internet gateway as a target) and

DRG_ATTACH (if creating a route rule that uses a DRG as a target) and

PRIVATE_IP_ROUTE_TABLE_ATTACH (if creating a route rule that uses a private IP as a target) and

LOCAL_PEERING_GATEWAY_ATTACH (if creating a route rule that uses an LPG as a target) and

NAT_GATEWAY_ATTACH (if creating a route rule that uses a NAT gateway as a target) and

SERVICE_GATEWAY_ATTACH (if creating a route rule that uses a service gateway as a target)

DeleteRouteTable

ROUTE_TABLE_DELETE and VCN_DETACH and

INTERNET_GATEWAY_DETACH (if deleting a route rule that uses an internet gateway as a target) and

DRG_DETACH (if deleting a route rule that uses a DRG as a target) and

PRIVATE_IP_ROUTE_TABLE_DETACH (if deleting a route rule that uses a private IP as a target) and

LOCAL_PEERING_GATEWAY_DETACH (if deleting a route rule that uses an LPG as a target) and

NAT_GATEWAY_DETACH (if deleting a route rule that uses a NAT gateway as a target) and

SERVICE_GATEWAY_DETACH (if deleting a route rule that uses a service gateway as a target)

ChangeRouteTableCompartment ROUTE_TABLE_MOVE
ListSecurityLists SECURITY_LIST_READ
GetSecurityList SECURITY_LIST_READ
UpdateSecurityList SECURITY_LIST_UPDATE
ChangeSecurityListCompartment SECURITY_LIST_MOVE
CreateSecurityList SECURITY_LIST_CREATE and VCN_ATTACH
DeleteSecurityList SECURITY_LIST_DELETE and VCN_DETACH
ListServiceGateways SERVICE_GATEWAY_READ
GetServiceGateway SERVICE_GATEWAY_READ
UpdateServiceGateway

SERVICE_GATEWAY_UPDATE

ROUTE_TABLE_ATTACH is necessary to associate a route table with the service gateway during the update.

ChangeServiceGatewayCompartment SERVICE_GATEWAY_MOVE
CreateServiceGateway

SERVICE_GATEWAY_CREATE and VCN_READ and VCN_ATTACH

ROUTE_TABLE_ATTACH is necessary to associate a route table with the service gateway during creation.

DeleteServiceGateway SERVICE_GATEWAY_DELETE and VCN_READ and VCN_DETACH
AttachServiceId SERVICE_GATEWAY_ADD_SERVICE
DetachServiceId SERVICE_GATEWAY_DELETE_SERVICE
ListShapes INSTANCE_INSPECT
ListSubnets SUBNET_READ
GetSubnet SUBNET_READ
UpdateSubnet

SUBNET_UPDATE

If changing which route table is associated with the subnet, also need ROUTE_TABLE_ATTACH and ROUTE_TABLE_DETACH

If changing which security lists are associated with the subnet, also need SECURITY_LIST_ATTACH and SECURITY_LIST_DETACH

If changing which set of DHCP options are associated with the subnet, also need DHCP_ATTACH and DHCP_DETACH

CreateSubnet SUBNET_CREATE and VCN_ATTACH and ROUTE_TABLE_ATTACH and SECURITY_LIST_ATTACH and DHCP_ATTACH
DeleteSubnet SUBNET_DELETE and VCN_DETACH and ROUTE_TABLE_DETACH and SECURITY_LIST_DETACH and DHCP_DETACH
ChangeSubnetCompartment SUBNET_MOVE
ListVcns VCN_READ
GetVcn VCN_READ
UpdateVcn VCN_UPDATE
CreateVcn VCN_CREATE
DeleteVcn VCN_DELETE
ChangeVcnCompartment VCN_MOVE
ListVirtualCircuits VIRTUAL_CIRCUIT_READ
GetVirtualCircuit VIRTUAL_CIRCUIT_READ
UpdateVirtualCircuit

VIRTUAL_CIRCUIT_UPDATE and DRG_ATTACH and DRG_DETACH

If updating which cross-connect or cross-connect group the virtual circuit is using, also need CROSS_CONNECT_DETACH and CROSS_CONNECT_ATTACH

CreateVirtualCircuit

VIRTUAL_CIRCUIT_CREATE and DRG_ATTACH

If creating the virtual circuit with a mapping to a specific cross-connect or cross-connect group, also need CROSS_CONNECT_ATTACH

DeleteVirtualCircuit

VIRTUAL_CIRCUIT_DELETE and DRG_DETACH

If deleting a virtual circuit that's currently using a cross-connect or cross-connect group, also need CROSS_CONNECT_DETACH

changeVirtualCircuitCompartment VIRTUAL_CIRCUIT_RESOURCE_MOVE
ListVlans VLAN_READ
GetVlan VLAN_READ
CreateVlan

VLAN_CREATE and VCN_ATTACH and ROUTE_TABLE_ATTACH and SECURITY_LIST_ATTACH and VLAN_ASSOCIATE_NETWORK_SECURITY_GROUP

UpdateVlan VLAN_UPDATE
DeleteVlan

VLAN_DELETE and VCN_DETACH and ROUTE_TABLE_DETACH and SECURITY_LIST_DETACH and VLAN_DISASSOCIATE_NETWORK_SECURITY_GROUP

ChangeVlanCompartment VLAN_MOVE
GetVnic VNIC_READ
AttachVnic

INSTANCE_ATTACH_SECONDARY_VNIC and VNIC_ATTACH and VNIC_CREATE and SUBNET_ATTACH

If putting the secondary VNIC in a network security group during VNIC creation, also need NETWORK_SECURITY_GROUP_UPDATE_MEMBERS and VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP

DetachVnic INSTANCE_DETACH_SECONDARY_VNIC and VNIC_DETACH and VNIC_DELETE and SUBNET_DETACH
UpdateVnic

VNIC_UPDATE

If adding or removing the VNIC from a network security group, also need NETWORK_SECURITY_GROUP_UPDATE_MEMBERS and VNIC_ASSOCIATE_NETWORK_SECURITY_GROUP

ListVnicAttachments VNIC_ATTACHMENT_READ and INSTANCE_INSPECT
GetVnicAttachment VNIC_ATTACHMENT_READ
ListVolumes VOLUME_INSPECT
GetVolume VOLUME_INSPECT
UpdateVolume VOLUME_UPDATE
CreateVolume VOLUME_CREATE (and VOLUME_BACKUP_READ if creating volume from a backup)
DeleteVolume VOLUME_DELETE
ChangeVolumeCompartment VOLUME_MOVE
ListVolumeAttachments VOLUME_ATTACHMENT_INSPECT and VOLUME_INSPECT and INSTANCE_INSPECT
GetVolumeAttachment

VOLUME_ATTACHMENT_INSPECT and VOLUME_INSPECT and INSTANCE_INSPECT

Note: To also get the CHAP secret for the volume, then VOLUME_ATTACHMENT_READ is required instead of VOLUME_ATTACHMENT_INSPECT

AttachVolume VOLUME_ATTACHMENT_CREATE and VOLUME_WRITE and INSTANCE_ATTACH_VOLUME
DetachVolume VOLUME_ATTACHMENT_DELETE and VOLUME_WRITE and INSTANCE_DETACH_VOLUME
ListVolumeBackups VOLUME_BACKUP_INSPECT and VOLUME_INSPECT
GetVolumeBackup VOLUME_BACKUP_INSPECT and VOLUME_INSPECT
UpdateVolumeBackup VOLUME_BACKUP_UPDATE and VOLUME_INSPECT
CreateVolumeBackup VOLUME_BACKUP_CREATE and VOLUME_WRITE
DeleteVolumeBackup VOLUME_BACKUP_DELETE and VOLUME_INSPECT
ChangeVolumeBackupCompartment VOLUME_BACKUP_MOVE
GetBootVolume VOLUME_INSPECT
ListBootVolumes VOLUME_INSPECT
UpdateBootVolume VOLUME_UPDATE
DeleteBootVolume VOLUME_DELETE
ChangeBootVolumeCompartment BOOT_VOLUME_MOVE
CreateBootVolumeBackup BOOT_VOLUME_BACKUP_CREATE, VOLUME_WRITE
ListBootVolumeBackups BOOT_VOLUME_BACKUP_INSPECT, VOLUME_INSPECT
GetBootVolumeBackup BOOT_VOLUME_BACKUP_INSPECT, VOLUME_INSPECT
UpdateBootVolumeBackup BOOT_VOLUME_BACKUP_UPDATE, VOLUME_INSPECT
DeleteBootVolumeBackup BOOT_VOLUME_BACKUP_DELETE, VOLUME_INSPECT
ChangeBootVolumeBackupCompartment BOOT_VOLUME_BACKUP_MOVE
CreateVolumeGroup

VOLUME_GROUP_CREATE, VOLUME_INSPECT if creating the volume group from a list of volumes.

VOLUME_GROUP_CREATE, VOLUME_GROUP_INSPECT, VOLUME_CREATE, VOLUME_WRITE if cloning a volume group.

VOLUME_GROUP_CREATE, VOLUME_GROUP_BACKUP_INSPECT, VOLUME_BACKUP_READ/BOOT_VOLUME_BACKUP_READ, VOLUME_CREATE, VOLUME_WRITE if restoring from a volume group backup.

DeleteVolumeGroup VOLUME_GROUP_DELETE
GetVolumeGroup VOLUME_GROUP_INSPECT
ListVolumeGroups VOLUME_GROUP_INSPECT
UpdateVolumeGroup VOLUME_GROUP_UPDATE, VOLUME_INSPECT
ChangeVolumegGroupCompartment VOLUME_GROUP_MOVE, VOLUME_MOVE/BOOT_VOLUME_MOVE
CreateVolumeGroupBackup

VOLUME_GROUP_BACKUP_CREATE, VOLUME_GROUP_INSPECT, VOLUME_WRITE, VOLUME_BACKUP_CREATE/BOOT_VOLUME_BACKUP_CREATE

DeleteVolumeGroupBackup VOLUME_GROUP_BACKUP_DELETE, VOLUME_BACKUP_DELETE/BOOT_VOLUME_BACKUP_DELETE
GetVolumeGroupBackup VOLUME_GROUP_BACKUP_INSPECT
ListVolumeGroupBackups VOLUME_GROUP_BACKUP_INSPECT
UpdateVolumeGroupBackup VOLUME_GROUP_BACKUP_UPDATE
ChangeVolumegGroupBackupCompartment VOLUME_GROUP_BACKUP_MOVE, VOLUME_BACKUP_MOVE/BOOT_VOLUME_BACKUP_MOVE

Dedicated Virtual Machine Host API Operations

API Operation Permissions Required to Use the Operation
CreateDedicatedVmHost DEDICATED_VM_HOST_CREATE
ChangeDedicatedVmHostCompartment DEDICATED_VM_HOST_MOVE
DeleteDedicatedVmHost DEDICATED_VM_HOST_DELETE
GetDedicatedVmHost DEDICATED_VM_HOST_READ
ListDedicatedVmHosts DEDICATED_VM_HOST_INSPECT
ListDedicatedVmHostInstances DEDICATED_VM_HOST_READ
ListDedicatedVmHostInstanceShapes None
ListDedicatedVmHostShapes None
LaunchInstance

DEDICATED_VM_HOST_LAUNCH_INSTANCE in dedicated virtual machine host compartment

INSTANCE_CREATE in compartment for the instance launched on the dedicated virtual machine host

UpdateDedicatedVmHost AUTO_SCALING_CONFIGURATION_CREATE and INSTANCE_POOL_UPDATE

Autoscaling API Operations

API Operation Permissions Required to Use the Operation
ListAutoScalingConfigurations AUTO_SCALING_CONFIGURATION_INSPECT
GetAutoScalingConfiguration AUTO_SCALING_CONFIGURATION_READ
UpdateAutoScalingConfiguration AUTO_SCALING_CONFIGURATION_UPDATE and INSTANCE_POOL_UPDATE
CreateAutoScalingConfiguration AUTO_SCALING_CONFIGURATION_CREATE and INSTANCE_POOL_UPDATE
ChangeAutoScalingConfigurationCompartment AUTO_SCALING_CONFIGURATION_MOVE
DeleteAutoScalingConfiguration AUTO_SCALING_CONFIGURATION_DELETE and INSTANCE_POOL_UPDATE
ListAutoScalingPolicies AUTO_SCALING_CONFIGURATION_READ
GetAutoScalingPolicy AUTO_SCALING_CONFIGURATION_READ
UpdateAutoScalingPolicy AUTO_SCALING_CONFIGURATION_UPDATE and INSTANCE_POOL_UPDATE
CreateAutoScalingPolicy AUTO_SCALING_CONFIGURATION_CREATE and INSTANCE_POOL_UPDATE
DeleteAutoScalingPolicy AUTO_SCALING_CONFIGURATION_DELETE and INSTANCE_POOL_UPDATE

Work Requests API Operations

API Operation Permissions Required to Use the Operation
ListWorkRequests

WORKREQUEST_INSPECT

GetWorkRequests Work requests inherit the permissions of the operation that spawns the work request. Generally, <RESOURCE>_CREATE permissions for the associated resource are required.
ListWorkRequestLogs

Work requests inherit the permissions of the operation that spawns the work request. Generally, <RESOURCE>_CREATE permissions for the associated resource are required.

ListWorkRequestErrors

Work requests inherit the permissions of the operation that spawns the work request. Generally, <RESOURCE>_CREATE permissions for the associated resource are required.