create

Description

You must specify a name for the policy, which must be unique across all policies in your tenancy and cannot be changed.

You must also specify a description for the policy (although it can be an empty string). It does not have to be unique, and you can change it anytime with UpdatePolicy <https://docs.cloud.oracle.com/api/#/en/identity/20160918/Policy/UpdatePolicy>.

You must specify one or more policy statements in the statements array. For information about writing policies, see How Policies Work <https://docs.cloud.oracle.com/Content/Identity/policieshow/how-policies-work.htm> and Common Policies <https://docs.cloud.oracle.com/Content/Identity/policiescommon/commonpolicies.htm>.

After you send your request, the new object’s lifecycleState will temporarily be CREATING. Before using the object, first make sure its lifecycleState has changed to ACTIVE.

New policies take effect typically within 10 seconds.

Usage

oci iam policy create [OPTIONS]

Required Parameters

The OCID of the compartment containing the policy (either the tenancy or another compartment).

The description you assign to the policy during creation. Does not have to be unique, and it’s changeable.

The name you assign to the policy during creation. The name must be unique across all policies in the tenancy and cannot be changed.

An array of policy statements written in the policy language. See How Policies Work <https://docs.cloud.oracle.com/Content/Identity/policieshow/how-policies-work.htm> and Common Policies <https://docs.cloud.oracle.com/Content/Identity/policiescommon/commonpolicies.htm>. This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

Example:

'["statement 1","statement 2"]'

Optional Parameters

Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see Resource Tags <https://docs.cloud.oracle.com/Content/General/Concepts/resourcetags.htm>. Example: {“Operations”: {“CostCenter”: “42”}} This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see Resource Tags <https://docs.cloud.oracle.com/Content/General/Concepts/resourcetags.htm>. Example: {“Department”: “Finance”} This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

The maximum time to wait for the resource to reach the lifecycle state defined by --wait-for-state. Defaults to 1200 seconds.

The version of the policy. If null or set to an empty string, when a request comes in for authorization, the policy will be evaluated according to the current behavior of the services at that moment. If set to a particular date (YYYY-MM-DD), the policy will be evaluated according to the behavior of the services on that date.

UTC with microseconds

Format: YYYY-MM-DDTHH:mm:ss.ssssssTZD
Example: 2017-09-15T20:30:00.123456Z
UTC with milliseconds
***********************
.. code::
    Format: YYYY-MM-DDTHH:mm:ss.sssTZD
    Example: 2017-09-15T20:30:00.123Z
UTC without milliseconds
**************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T20:30:00Z
UTC with minute precision
**************************
.. code::
    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T20:30Z

Timezone with microseconds

Format: YYYY-MM-DDTHH:mm:ssTZD
Example: 2017-09-15T12:30:00.456789-08:00, 2017-09-15T12:30:00.456789-0800
Timezone with milliseconds
***************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00.456-08:00, 2017-09-15T12:30:00.456-0800
Timezone without milliseconds
*******************************
.. code::
    Format: YYYY-MM-DDTHH:mm:ssTZD
    Example: 2017-09-15T12:30:00-08:00, 2017-09-15T12:30:00-0800
Timezone with minute precision
*******************************
.. code::
    Format: YYYY-MM-DDTHH:mmTZD
    Example: 2017-09-15T12:30-08:00, 2017-09-15T12:30-0800
Short date and time
********************
The timezone for this date and time will be taken as UTC (Needs to be surrounded by single or double quotes)
.. code::
    Format: 'YYYY-MM-DD HH:mm' or "YYYY-MM-DD HH:mm"
    Example: '2017-09-15 17:25'
Date Only
**********
This date will be taken as midnight UTC of that day
.. code::
    Format: YYYY-MM-DD
    Example: 2017-09-15
Epoch seconds
**************
.. code::
    Example: 1412195400

This operation creates, modifies or deletes a resource that has a defined lifecycle state. Specify this option to perform the action and then wait until the resource reaches a given lifecycle state. Multiple states can be specified, returning on the first state. For example, --wait-for-state SUCCEEDED --wait-for-state FAILED would return on whichever lifecycle state is reached first. If timeout is reached, a return code of 2 is returned. For any other error, a return code of 1 is returned.

Accepted values are:

ACTIVE, CREATING, DELETED, DELETING, INACTIVE

Check every --wait-interval-seconds to see whether the resource to see if it has reached the lifecycle state defined by --wait-for-state. Defaults to 30 seconds.

Global Parameters

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

Examples

    oci iam policy create --generate-param-json-input statements > statements.json

Copy the following CLI commands into a file named example.sh. Run the command by typing “bash example.sh” and replacing the example parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration <https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile> and appropriate security policies <https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm> before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-compartment-id
    export description=<substitute-value-of-description> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-description
    export name=<substitute-value-of-name> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-name
    oci iam policy create --compartment-id $compartment_id --description $description --name $name --statements file://statements.json

delete

Description

Usage

oci iam policy delete [OPTIONS]

Required Parameters

The OCID of the policy.

Optional Parameters

Perform deletion without prompting for confirmation.

Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.

The maximum time to wait for the resource to reach the lifecycle state defined by --wait-for-state. Defaults to 1200 seconds.

This operation creates, modifies or deletes a resource that has a defined lifecycle state. Specify this option to perform the action and then wait until the resource reaches a given lifecycle state. Multiple states can be specified, returning on the first state. For example, --wait-for-state SUCCEEDED --wait-for-state FAILED would return on whichever lifecycle state is reached first. If timeout is reached, a return code of 2 is returned. For any other error, a return code of 1 is returned.

Accepted values are:

ACTIVE, CREATING, DELETED, DELETING, INACTIVE

Check every --wait-interval-seconds to see whether the resource to see if it has reached the lifecycle state defined by --wait-for-state. Defaults to 30 seconds.

Global Parameters

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

Examples

    oci iam policy create --generate-param-json-input statements > statements.json

Copy the following CLI commands into a file named example.sh. Run the command by typing “bash example.sh” and replacing the example parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration <https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile> and appropriate security policies <https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm> before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-compartment-id
    export description=<substitute-value-of-description> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-description
    export name=<substitute-value-of-name> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-name
    policy_id=$(oci iam policy create --compartment-id $compartment_id --description $description --name $name --statements file://statements.json --query data.id --raw-output)
    oci iam policy delete --policy-id $policy_id

get

Description

Usage

oci iam policy get [OPTIONS]

Required Parameters

The OCID of the policy.

Optional Parameters

Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

Global Parameters

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

Examples

    oci iam policy create --generate-param-json-input statements > statements.json

Copy the following CLI commands into a file named example.sh. Run the command by typing “bash example.sh” and replacing the example parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration <https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile> and appropriate security policies <https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm> before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-compartment-id
    export description=<substitute-value-of-description> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-description
    export name=<substitute-value-of-name> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-name
    policy_id=$(oci iam policy create --compartment-id $compartment_id --description $description --name $name --statements file://statements.json --query data.id --raw-output)
    oci iam policy get --policy-id $policy_id

list

Description

To determine which policies apply to a particular group or compartment, you must view the individual statements inside all your policies. There isn’t a way to automatically obtain that information via the API.

Usage

oci iam policy list [OPTIONS]

Required Parameters

The OCID of the compartment (remember that the tenancy is simply the root compartment).

Optional Parameters

Fetches all pages of results. If you provide this option, then you cannot provide the --limit option.

Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

A filter to only return resources that match the given lifecycle state. The state value is case-insensitive.

Accepted values are:

ACTIVE, CREATING, DELETED, DELETING, INACTIVE

The maximum number of items to return in a paginated “List” call.

A filter to only return resources that match the given name exactly.

The value of the opc-next-page response header from the previous “List” call.

When fetching results, the number of results to fetch per call. Only valid when used with --all or --limit, and ignored otherwise.

The field to sort by. You can provide one sort order (sortOrder). Default order for TIMECREATED is descending. Default order for NAME is ascending. The NAME sort order is case sensitive.

Note: In general, some “List” operations (for example, ListInstances) let you optionally filter by Availability Domain if the scope of the resource type is within a single Availability Domain. If you call one of these “List” operations without specifying an Availability Domain, the resources are grouped by Availability Domain, then sorted.

Accepted values are:

NAME, TIMECREATED

The sort order to use, either ascending (ASC) or descending (DESC). The NAME sort order is case sensitive.

Accepted values are:

ASC, DESC

Global Parameters

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

Examples

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration <https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile> and appropriate security policies <https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm> before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/list.html#cmdoption-compartment-id
    oci iam policy list --compartment-id $compartment_id

update

Description

Policy changes take effect typically within 10 seconds.

Usage

oci iam policy update [OPTIONS]

Required Parameters

The OCID of the policy.

Optional Parameters

Usage of predefined tag keys. These predefined keys are scoped to namespaces. Example: {“foo-namespace”: {“bar-key”: “foo-value”}} This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

The description you assign to the policy. Does not have to be unique, and it’s changeable.

Perform update without prompting for confirmation.

Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only. Example: {“bar-key”: “value”} This is a complex type whose value must be valid JSON. The value can be provided as a string on the command line or passed in as a file using the file://path/to/file syntax.

The --generate-param-json-input option can be used to generate an example of the JSON which must be provided. We recommend storing this example in a file, modifying it as needed and then passing it back in via the file:// syntax.

Provide input to this command as a JSON document from a file using the file://path-to/file syntax.

The --generate-full-command-json-input option can be used to generate a sample json file to be used with this command option. The key names are pre-populated and match the command option names (converted to camelCase format, e.g. compartment-id –> compartmentId), while the values of the keys need to be populated by the user before using the sample file as an input to this command. For any command option that accepts multiple values, the value of the key can be a JSON array.

Options can still be provided on the command line. If an option exists in both the JSON document and the command line then the command line specified value will be used.

For examples on usage of this option, please see our “using CLI with advanced JSON options” link: https://docs.cloud.oracle.com/iaas/Content/API/SDKDocs/cliusing.htm#AdvancedJSONOptions

For optimistic concurrency control. In the PUT or DELETE call for a resource, set the if-match parameter to the value of the etag from a previous GET or POST response for that resource. The resource will be updated or deleted only if the etag you provide matches the resource’s current etag value.

A JSON array of policy statements written in the policy language. See How Policies Work <https://docs.cloud.oracle.com/Content/Identity/policieshow/how-policies-work.htm> and Common Policies <https://docs.cloud.oracle.com/Content/Identity/policiescommon/commonpolicies.htm>. Example: ‘[“statement 1”,”statement 2”]’ (The single quotes are required.)

The version of the policy. If set to an empty string, when a request comes in for authorization, the policy will be evaluated according to the current behavior of the services at that moment. If set to a particular date (YYYY-MM-DD), the policy will be evaluated according to the behavior of the services on that date.

Global Parameters

--auth-purpose, --auth, --cert-bundle, --cli-auto-prompt, --cli-rc-file, --config-file, --debug, --defaults-file, --endpoint, --generate-full-command-json-input, --generate-param-json-input, --help, --latest-version, --max-retries, --no-retry, --opc-client-request-id, --opc-request-id, --output, --profile, --query, --raw-output, --region, --release-info, --request-id, --version, -?, -d, -h, -i, -v

Examples

Description

Command

 oci iam policy update --policy-id ocid1.policy.oc1..<POLICY OCID> --statements "[\"Allow group Administrators to manage all-resources on compartment policy-test \"]" --version-date

Output

{
 "data": [
      {
           "compartment-id": "ocid1.compartment.oc1...........",
           "defined-tags": {},
           "description": "test-policy",
           "freeform-tags": {},
           "id": "ocid1.policy.oc1..........",
           "inactive-status": "null",
           "lifecycle-state": "ACTIVE",
           "name": "test-policy",
           "statements": [
                "Allow group Administrators to manage all-resources on compartment policy-test "
           ],
           "time-created": "2020-09-29T18:21:39.356000+00:00",
           "version-date": "null"
      }
 ]
}

Copy and paste the following example into a JSON file, replacing the example parameters with your own.

    oci iam policy create --generate-param-json-input statements > statements.json

Copy the following CLI commands into a file named example.sh. Run the command by typing “bash example.sh” and replacing the example parameters with your own.

Please note this sample will only work in the POSIX-compliant bash-like shell. You need to set up the OCI configuration <https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#configfile> and appropriate security policies <https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policygetstarted.htm> before trying the examples.

    export compartment_id=<substitute-value-of-compartment_id> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-compartment-id
    export description=<substitute-value-of-description> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-description
    export name=<substitute-value-of-name> # https://docs.cloud.oracle.com/en-us/iaas/tools/oci-cli/latest/oci_cli_docs/cmdref/iam/policy/create.html#cmdoption-name
    policy_id=$(oci iam policy create --compartment-id $compartment_id --description $description --name $name --statements file://statements.json --query data.id --raw-output)
    oci iam policy update --policy-id $policy_id