Home
OCI Lab

OCI - Creating a User with Administrator permissions to use one compartment only (for daily Use)

Creating a User with full Administrator permissions to use one compartment only (for daily Use).
Disclaimer:

There are lots of wrong and right articles in internet, when you try to execute Hands-on Labs by yourself, there is chance that you could get drifted away or get severely confused, We strictly adhere to Official Oracle Cloud Documentation, offering you reliable and precise information without personal interpretations. This means you can trust our content 100% Genuine.

Prerequisites

Before you start the Lab kindly ensure that you have the following:
  • An active OCI account.
  • you must have Cloud Administrator permissions to complete this task, Thus you make sure to Login with your default tenancy account or with any Cloud Account Administrator (if Available).

Lab Task :

Creating a User with full Administrator permissions to use one compartment only (for daily Use).

There are two basic types of users:

  • A user with full administrator permissions (Previous Lab)
  • A user with permissions to use one compartment only (This Lab)

By default, any OCI tenancy has a default root compartment, named after the tenancy itself. The tenancy administrator (default root compartment administrator) is any user who is a member of the default Administrators group. Once compartments are created, they can be assigned their own administrators who can then create sub-compartments and assign delegated administrators to each of them. OCI supports up to a 6-level deep compartment hierarchy and the administrator of a parent compartment has full powers over its children compartments.

Lab Task Flow

    Task 1: Create a Plan

    Task 2: Consider Who Should Have Access to Which Resources

    Task 3: Choose compartments to align with your company projects

    • (OCI doc.) Choose compartments to align with your company projects

      • Consider this approach if your company has multiple departments that you want to manage separately or if your company has several distinct projects that would be easier to manage separately.

      In this approach, you can add a dedicated administrators group for each compartment (project) who can set the access policies for just that project. (Users and groups still must be added at the tenancy level.) You can give one group control over all their resources, while not allowing them administrator rights to the root compartment or any other projects. In this way, you can enable different groups at your company to set up their own "sub-clouds" for their own resources and administer them independently.

      Following is the Compartment Structure we are trying to Create

      Daytoday Compartment

    Task 4: Create Compartment

    (OCI doc.) Create Compartments
    1. Open the navigation menu and click Identity & Security. Under Identity, click Compartments.
    2. Click Create Compartment.
    3. Enter the following:
      • Name: Enter "DemoComp1".
      • Description: Enter a description (required), for example: "DemoComp1" compartment for users to try out OCI.
      • Accept the default Parent Compartment as the root compartment (or tenancy).
    4. Click Create Compartment.
    5. Your compartment is displayed in the list.

    Task 5: Create a Group

    Note:

    By default, any OCI tenancy has a default root compartment, named after the tenancy itself. The tenancy administrator (default root compartment administrator) is any user who is a member of the default Administrators group.


    (OCI doc.) Create Group
    1. Open the navigation menu and click Identity Security. Under Identity, click Domains.
    2. Click Default to open the Default identity domain.
    3. Under the Identity domain resources on the left, click Groups.
    4. Click Create group.
    5. In the Create group dialog:
      • Name: Enter a unique name for your group, for example, "Demo1group" Group. (Note: the name cannot contain spaces)
      • Description: Enter a description (required).
    6. Click Create.

    Task 6: Create a Policy

    (OCI doc.) Create a Policy
    Create the policy to give the DemoComp1Group permissions in the Sandbox compartment.
    1. Open the navigation menu and click Identity & Security. Under Identity, click Policies.
    2. Under List Scope, ensure that you are in your root compartment.
    3. Click Create Policy.
    4. Enter a unique Name for your policy, for example, Demo1policy. (Note that the name cannot contain spaces)
    5. Enter a Description (required), for example, Grants users full permissions on the "DemoComp1" compartment.

      6. Enter the following Statement:
      Allow group Demo1group to manage all-resources in compartment DemoComp1
      This statement grants members of the Demo1group full access to the DemoComp1 compartment.
    6. Click Create.

    Task 7: Create a User

    (OCI doc.) Create a User
    1. Open the navigation menu and click Identity Security. Under Identity, click Domains.
    2. Click Default to open the Default identity domain.
    3. Under the Identity domain resources on the left, click Users.
    4. Click Create user.
    5. In the First name and Last name fields of the Create user window, enter the user's first and last name.
      6. To have the user log in with their email address:
      • Leave the Use the email address as the username check box selected.
      • In the Username / Email field, enter the email address for the user account.
      OR To have the user log in with their user name:
      • Clear the Use the email address as the username check box.
      • In the Username field, enter the user name that the user is to use to log in to the Console.
      • In the Email field, enter the email address for the user account.
    6. Under Select groups to assign this user to, select the check box for the group you created, Demo1group.
    7. Click Create.
Note:

A "welcome email" is sent to the address provided for the new user. The new user can follow the account activation instructions in the email to sign in and start using the tenancy.

Detailed Video Explanation of this Lab:

Required concept knowledge

    The best Tenancy Advice

    OCI suggest, "Don’t use the default domain admin group and user with the identity domain admin role for day-to-day activities. Instead, create a separate admin for managing specific resources in OCI".

    Conclusion

    Creating a user with full Administrator permissions for daytoday Operations will help your organization to stay secured operate.

Reference

Post a Comment