Policy Details for Exadata Fleet Update

Learn to write policies to control access to Exadata Fleet Update resources.

Note:

For more information on Policies, see How Policies Work.

Parent topic: References

About Resource-Types and Fleet Update Policies

Learn about resource types that you can use in your policies.

An aggregate resource type covers the list of individual resource types that directly follow. For example, writing one policy to allow a group to have access to thefleet-software-update-family is equivalent to writing separate policies for the group that would grant access to the fleet-software-update-discoveries, fleet-software-update-collections, fleet-software-update-cycles, and the rest of the individual resource types. For more information, see Resource-Types.

Example Policies

  • Allow tenancyAdmins group to manage everything in Fleet Software Update service:
    Allow group tenancyAdmin to manage fleet-software-update-family in tenancy
  • Allow hrAdmin group to manage Fleet Software Update resources in a specific compartment:
    Allow group hrAdmin to manage fleet-software-update-family in compartment hr-resoures
  • Allow opsTeam to see action and job details and output for triaging in the HR compartment:
    Allow group hrOps to read fleet-software-update-actions in compartment hr-resoures
    Allow group hrOps to read fleet-software-update-jobs in compartment hr-resoures
  • Allow a specific user access to an action result output in hr-resources for triaging:
    Allow user triageUser to {FSU_ACTION_READ_OUTPUT} in compartment hr-resources
  • Allow the on-call group to use jobs and actions to retry, resume or cancel operations during a patching cycle:
    Allow group onCallDev to use fleet-software-update-actions in tenancy
    Allow group onCallDev to use fleet-software-update-jobs in tenancy

Parent topic: Policy Details for Exadata Fleet Update

Resource-Types for Fleet Update

Review the list of resource-types specific to Fleet Update.

Aggregate Resource-Type

  • fleet-software-update-family
Individual Resource-Types
  • fleet-software-update-discoveries
  • fleet-software-update-collections
  • fleet-software-update-cycles
  • fleet-software-update-actions
  • fleet-software-update-jobs
  • fleet-software-update-work-requests
  • fleet-software-update-images
  • fleet-software-update-homes

Parent topic: Policy Details for Exadata Fleet Update

Supported Variables for Fleet Update

Use variables when adding conditions to a policy.

Fleet Update supports only the general variables. For more information, see General Variables for All Requests.

Parent topic: Policy Details for Exadata Fleet Update

Details for Verb + Resource-Type Combinations

Review the list of permissions and API operations covered by each verb for Fleet Update.

For more information, see Permissions, Verbs, and Resource-Types.

Parent topic: Policy Details for Exadata Fleet Update

Fleet Update Family Resource Types

Each Fleet Update resource-type verb grants different levels of access.

The level of access is cumulative as you go from inspect to read, to use, and to manage. A plus sign (+) in a table cell indicates incremental access compared to the cell directly above it, whereas "no extra" indicates no incremental access.

For example, the read verb for the fleet-software-update-discoveries resource-type covers no extra permissions or API operations compared to the inspect verb. However, the use verb includes one more permission, fully covers one more operation, and partially covers another additional operation.

Parent topic: Details for Verb + Resource-Type Combinations

fleet-software-update-discoveries

Review the list of permissions and API operations for fleet-software-update-discoveries resource-type.

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

FSU_DISCOVERY_INSPECT

ListFsuDiscoveries

none

read

 INSPECT +

FSU_DISCOVERY_READ

FSU_DISCOVERY_INSPECT_MEMBERS

GetFsuDiscovery

ListFsuDiscoveryTargets

none

use

 READ +

FSU_DISCOVERY_ABORT

AbortFsuDiscovery

none

manage

 USE+

FSU_DISCOVERY_CREATE

FSU_DISCOVERY_UPDATE

FSU_DISCOVERY_DELETE

FSU_DISCOVERY_MOVE

CreateFsuDiscovery

UpdateFsuDiscovery

DeleteFsuDiscovery

ChangeFsuDiscoveryCompartment

none

Parent topic: Details for Verb + Resource-Type Combinations

fleet-software-update-collections

Review the list of permissions and API operations for fleet-software-update-collections resource-type.

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

FSU_DISCOVERY_INSPECT

ListFsuDiscoveries

none

read

 INSPECT +

FSU_DISCOVERY_READ

FSU_DISCOVERY_INSPECT_MEMBERS

GetFsuCollection

ListFsuCollectionTargets

CreateFsuCollection

use

 READ +

no extra

ListFsuCollections

GetFsuCollection

ListFsuCollectionTargets

none

manage

 USE+

FSU_COLLECTION_CREATE

FSU_COLLECTION_UPDATE

FSU_COLLECTION_DELETE

FSU_COLLECTION_MOVE

FSU_COLLECTION_ADD_TARGETS

FSU_COLLECTION_REMOVE_TARGETS

CreateFsuCollection

UpdateFsuCollection

DeleteFsuCollection

ChangeFsuCollectionCompartment

AddFsuCollectionTargets

RemoveFsuCollectionTargets

none

Parent topic: Details for Verb + Resource-Type Combinations

fleet-software-update-cycles

Review the list of permissions and API operations for fleet-software-update-cycles resource-type.

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

FSU_CYCLE_INSPECT

ListFsuCycles

none

read

 INSPECT +

FSU_CYCLE_READ

GetFsuCycle

none

use

 READ +

no extra

ListFsuCycles

GetFsuCycle

none

manage

 USE+

FSU_CYCLE_CREATE

FSU_CYCLE_CLONE

FSU_CYCLE_UPDATE

FSU_CYCLE_DELETE

FSU_CYCLE_MOVE

FSU_COLLECTION_REMOVE_TARGETS

CreateFsuCycle

CloneFsuCycle

UpdateFsuCycle

DeleteFsuCycle

ChangeFsuCycleCompartment

RemoveFsuCollectionTargets

none

Parent topic: Details for Verb + Resource-Type Combinations

fleet-software-update-actions

Review the list of permissions and API operations for fleet-software-update-actions resource-type.

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

FSU_ACTION_INSPECT

ListFsuActions

none

read

 INSPECT +

FSU_ACTION_READ

FSU_ACTION_READ_OUTPUT

GetFsuAction

GetFsuActionOutputContent

none

use

 READ +

FSU_ACTION_RESUME

FSU_ACTION_CANCEL

ResumeFsuAction

CancelFsuAction

none

manage

 USE+

FSU_ACTION_CREATE

FSU_ACTION_UPDATE

FSU_ACTION_DELETE

FSU_ACTION_MOVE

CreateFsuAction

UpdateFsuAction

DeleteFsuAction

ChangeFsuActionCompartment

none

Parent topic: Details for Verb + Resource-Type Combinations

fleet-software-update-jobs

Review the list of permissions and API operations for fleet-software-update-jobs resource-type.

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

FSU_JOB_INSPECT

ListFsuJobs

none

read

 INSPECT +

FSU_JOB_READ

FSU_JOB_READ_OUTPUT

GetFsuJob

ListFsuJobOutputs

GetFsuJobOutputContent

use

 READ +

FSU_JOB_RETRY

RetryFsuJob

none

manage

 USE+

FSU_JOB_DELETE

FSU_JOB_UPDATE

DeleteFsuJob

UpdateFsuJob

none

Parent topic: Details for Verb + Resource-Type Combinations

fleet-software-update-work-requests

Review the list of permissions and API operations for fleet-software-update-work-requests resource-type.

Verbs Permissions APIs Fully Covered APIs Partially Covered

inspect

FSU_WORK_REQUEST_INSPECT

ListWorkRequests

none

read

 INSPECT +

FSU_WORK_REQUEST_READ

GetWorkRequest

ListWorkRequestErrors

ListWorkRequestLogs

none

use

 READ +

no extra

GetWorkRequest

ListWorkRequestErrors

ListWorkRequestLogs

none

manage

 USE+

no extra

GetWorkRequest

ListWorkRequestErrors

ListWorkRequestLogs

none

Parent topic: Details for Verb + Resource-Type Combinations