Which policy would you write to provide admin access to all three of your existing admin groups for a shared Test compartment?

This policy correctly grants administrative permissions to users based on the tags applied to the groups they belong to. The subject any-user specifies that the policy applies to any user in the tenancy who initiates a request. The where clause then filters these requests, allowing only those from users who are members of a group with the defined free-form tag EmployeeGroup.Role = 'Admin'. This is a scalable method to manage access for multiple groups sharing a common role without listing each group individually in the policy.

A: The subject all-group is not a valid keyword in OCI IAM policy syntax. Policies grant permissions to principals like users or instances, not abstract collections of groups.

B: The subject dynamic-group is used to grant permissions to OCI resources, such as compute instances, not to human users based on their group memberships.

D: The subject group any-group is syntactically incorrect. The group keyword must be followed by a specific, named group, not the placeholder any-group.

1. Oracle Cloud Infrastructure Documentation, "How Policies Work - Policy Syntax": This document outlines the valid syntax for an IAM policy statement. It specifies that the valid subjects are group , dynamic-group , and any-user. This confirms that all-group and any-group are invalid subjects.

Reference: Oracle Cloud Infrastructure Documentation > Identity and Access Management > Policies > How Policies Work > Policy Syntax.

2. Oracle Cloud Infrastructure Documentation, "Using Tags to Manage Access": This section provides examples of policies that use tags for access control. A specific example demonstrates the exact pattern used in the correct answer: Allow any-user to manage instances in compartment Projects where request.principal.group.tag.Operations.Project = 'A'. This directly validates using any-user with a request.principal.group.tag condition.

Reference: Oracle Cloud Infrastructure Documentation > Identity and Access Management > Policies > Common Policies > Using Tags to Manage Access.

3. Oracle Cloud Infrastructure Documentation, "Variables and Tags": This reference details the variables available for policy conditions. It explains that request.principal.group refers to the group(s) the user making the request belongs to, and its tags can be used for evaluation, which is the mechanism employed in the correct answer.

Reference: Oracle Cloud Infrastructure Documentation > Identity and Access Management > Policies > Policy Reference > Variables and Tags.