Which statement accurately describes ephemeral principals?

Ephemeral principals refer to the temporary identity and credentials granted to OCI resources, such as compute instances, enabling them to securely access other OCI services. This is implemented through the "instance principals" feature. Instead of storing long-lived credentials on a resource, the resource is authorized as a principal and is issued short-lived, automatically rotated security tokens. This mechanism enhances security by eliminating the need to manage and protect static credentials on the instance itself.

B. Dynamic groups are collections of resources (like instances) defined by matching rules. They are used in policies to grant permissions to principals but are not the principals or their credentials.

C. Ephemeral principals are associated with resources (e.g., compute instances), not human user accounts. User accounts represent individual people or administrators.

D. The term "ephemeral" explicitly means temporary or short-lived. This is the direct opposite of long-lived service accounts, which rely on static, persistent credentials.

1. Oracle Cloud Infrastructure Documentation, "Calling Services from an Instance."

Section: Overview of Instance Principals

Content: "Instance principals is a feature in Oracle Cloud Infrastructure Identity and Access Management (IAM) that lets you make service calls from an instance... Instead of creating a user for the instance or configuring the instance with a user's credentials, you can... make the instance itself a principal actor (or principal)... The instance gets its credentials from a temporary, short-lived security token." This directly supports that ephemeral principals are temporary credentials for resources.

2. Oracle Cloud Infrastructure Documentation, "Managing Dynamic Groups."

Section: Overview of Dynamic Groups

Content: "A dynamic group is a group that includes instances that match rules that you define... You can then create policies to permit instances in the dynamic group to make API calls against Oracle Cloud Infrastructure services." This clarifies that dynamic groups are a grouping mechanism, distinct from the concept of a principal's credentials.

3. Oracle Cloud Infrastructure Documentation, "Managing Users."

Section: Overview of Users

Content: "Users are individuals in your organization who need to manage or use your Oracle Cloud Infrastructure resources." This distinguishes IAM users from resource-based principals like instance principals.