Cross-Tenancy Policies

Your organization might want to share resources with another organization that has its own tenancy. It could be another business unit in your company, a customer of your company, a company that provides services to your company, and so on. In cases like these, you need cross-tenancy policies in addition to the required user and service policies described previously.

To access and share resources, the administrators of both tenancies need to create special policy statements that explicitly state the resources that can be accessed and shared. These special statements use the words Define, Endorse ,and Admit.

Endorse, Admit, and Define Statements

Here's an overview of the special verbs used in cross-tenancy statements:

Endorse: States the general set of abilities that a group in your own tenancy can perform in other tenancies. The Endorse statement always belongs in the tenancy with the group of users crossing the boundaries into the other tenancy to work with that tenancy's resources. In the examples, you refer to this tenancy as the source.

Admit: States the kind of ability in your own tenancy that you want to grant a group from the other tenancy. The Admit statement belongs in the tenancy who is granting "admittance" to the tenancy. The Admit statement identifies the group of users that requires resource access from the source tenancy and identified with a corresponding Endorse statement. In the examples, you refer to this tenancy as the destination.

Define: Assigns an alias to a tenancy OCID for Endorse and Admit policy statements. A Define statement is also required in the destination tenancy to assign an alias to the source IAM group OCID for Admit statements.

Source tenancy policy statements

Endorse group NoSQLAdmins to manage nosql-family in any-tenancy

Define tenancy DestinationTenancy as ocid1.tenancy.oc1..<destination_tenancy_OCID>
Endorse group NoSQLAdmins to manage nosql-family in tenancy DestinationTenancy

Destination tenancy policy statements

Define tenancy SourceTenancy as ocid1.tenancy.oc1..<source_tenancy_OCID>
Define group NoSQLAdmins as ocid1.group.oc1..<group_OCID>
Admit group NoSQLAdmins of tenancy SourceTenancy to manage nosql-family in tenancy

Define tenancy SourceTenancy as ocid1.tenancy.oc1..<source_tenancy_OCID>
Define group NoSQLAdmins as ocid1.group.oc1..<group_OCID>
Admit group NoSQLAdmins of tenancy SourceTenancy to manage nosql-family in compartment Develop

When you activate your order for Oracle NoSQL Database Cloud Service, you (the first user) are in the Administrators group by default. Being in the Administrators group gives you full administration privileges in Oracle Cloud Infrastructure so you can manage Oracle NoSQL Database Cloud Service tables and much more. There's no need to delegate this responsibility but, if you want to, you can give someone else privileges to create and manage Oracle NoSQL Database Cloud Service tables through the manage nosql-tables permission.

In Oracle Cloud Infrastructure you use IAM security policies to grant permissions. First, you must add the user to a group, and then you create a security policy that grants the group the manage nosql-tables permission on a specific compartment or the tenancy (any compartment in the tenancy). For example, you might create a policy statement that looks like one of these:

allow group MyAdminGroup to manage nosql-tables in tenancy

allow group MyAdminGroup to manage nosql-tables in compartment MyOracleNoSQL

To find out how to create security policy statements specifically for Oracle NoSQL Database Cloud Service, see Setting Up Users, Groups, and Policies Using Identity and Access Management.