Which Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) policy is invalid?

The Oracle Cloud Infrastructure (OCI) IAM policy Allow any-user to inspect users in tenancy is invalid. The special principal any-user is exclusively designated for granting unauthenticated access to public Object Storage buckets. The IAM service explicitly prohibits using any-user to grant permissions on any other type of OCI resource, especially sensitive resources like IAM users, groups, or policies. This restriction is a fundamental security measure to prevent unauthorized access to tenancy information. Therefore, this policy statement is semantically and functionally invalid.

A. This is a valid policy. It uses a dynamic group, which allows an instance principal to manage other instances (via the instance-family resource type) within a specified compartment.

B. This is a common and valid administrative policy. It grants a specific group (A-Admins) full management permissions over all resources within a designated compartment (Project-A).

D. While the verb create is not a standard IAM aggregate verb (inspect, read, use, manage), making the policy syntactically questionable, the policy in option C is fundamentally invalid due to a core security rule violation.

1. Oracle Cloud Infrastructure Documentation - Policy Syntax: Under the "Subject" section, the documentation states: "any-user: A user from the internet without authentication. This user can only access public Object Storage buckets." This directly invalidates option C.

Source: Oracle Cloud Infrastructure Documentation, "Identity and Access Management," Section: "Policies," Subsection: "Policy Syntax."

2. Oracle Cloud Infrastructure Documentation - Common Policies: This document provides numerous examples of valid policies, including patterns similar to options A and B, which grant permissions to groups and dynamic groups to manage resources within a compartment. For instance, the policy "Let a group manage a compartment" follows the exact structure of option B.

Source: Oracle Cloud Infrastructure Documentation, "Identity and Access Management," Section: "Policies," Subsection: "Common Policies."

3. Oracle Cloud Infrastructure Documentation - Verbs: The documentation lists the four primary aggregate verbs: inspect, read, use, and manage. While it notes that some services have additional verbs, create is not a standard verb, which makes option D syntactically incorrect, but option C violates a more fundamental principal-resource binding rule.

Source: Oracle Cloud Infrastructure Documentation, "Identity and Access Management," Section: "Policies," Subsection: "Verbs."