Oracle Cloud Infrastructure Documentation

Details for Resource Manager

This topic covers details for writing policies to control access to the Resource Manager service.

Aggregate Resource-Type

orm-family

Individual Resource-Types

orm-stacks

orm-jobs

orm-work-requests

Supported Variables

Resource Manager supports all the general variables (see General Variables for All Requests), plus the ones listed here.

The orm-jobs resource type can use the following variables.

Variable Variable Type Comments
target.job.operation String

Use this variable to control access for running specified job types. For example, to limit access to PLAN and APPLY jobs, use the following phrase: where any {target.job.operation = 'PLAN', target.job.operation = 'APPLY'}

Details for Verb + Resource-Type Combinations

The following tables show the permissions and API operations covered by each verb. The level of access is cumulative as you go from inspect > read > use > manage. A plus sign (+) in a table cell indicates incremental access compared to the cell directly above it, whereas "no extra" indicates no incremental access..

orm-stacks
orm-jobs
orm-work-requests

Permissions Required for Each API Operation

The following table lists the API operations in a logical order, grouped by resource type.

For information about permissions, see Permissions.

API Operation Permissions Required to Use the Operation
ListStacks ORM_STACK_INSPECT
CreateStack ORM_STACK_CREATE
GetStack ORM_STACK_READ
UpdateStack ORM_STACK_UPDATE
ChangeStackCompartment ORM_STACK_MOVE
DeleteStack ORM_STACK_DELETE
GetStackTfConfig ORM_STACK_READ
ListTerraformVersions ORM_STACK_INSPECT
ListJobs ORM_JOB_INSPECT
CreateJob ORM_JOB_MANAGE and ORM_STACK_USE
GetJob ORM_JOB_READ
UpdateJob ORM_JOB_MANAGE
CancelJob ORM_JOB_MANAGE
GetJobTfState ORM_JOB_READ
GetJobTfConfig ORM_JOB_READ
GetJobTfExecutionPlan ORM_JOB_READ
GetJobLogs ORM_JOB_READ
GetJobLogsContent ORM_JOB_READ
ListWorkRequestErrors ORM_WORK_REQUEST_READ
ListWorkRequestLogs ORM_WORK_REQUEST_READ
ListWorkRequests ORM_WORK_REQUEST_INSPECT
GetWorkRequest ORM_WORK_REQUEST_READ