IAM Policies
************

Oracle Cloud Infrastructure Identity and Access Management (IAM)
lets you specify policies to control the access to your cloud resources.
This section describe the policies you might need for running Data Science Jobs.

.. warning::

    The policies presented in this page are intended to show the ``resource_type`` used by the job and job runs.
    You should further restrict the access to the resources base on your needs.

.. admonition:: Policy subject
    :class: note

    In the following example, ``group <your_data_science_users>`` is the subject of the policy
    when using OCI API keys for authentication. For resource principal authentication,
    the subject should be a ``dynamic-group``, for example, ``dynamic-group <your_dynamic_group>``

Here is an example defining a dynamic group for all job runs in a compartment:

.. code-block::

    all { resource.type='datasciencejobrun', resource.compartment.id='<job_run_compartment_ocid>' }

The following policies are for creating and managing Data Science Jobs and Job Runs:

.. code-block::

    Allow group <your_data_science_users> to manage data-science-jobs in compartment <your_compartment_name>
    Allow group <your_data_science_users> to manage data-science-job-runs in compartment <your_compartment_name>
    Allow group <your_data_science_users> to use virtual-network-family in compartment <your_compartment_name>
    Allow group <your_data_science_users> to manage log-groups in compartment <your_compartment_name>
    Allow group <your_data_science_users> to use logging-family in compartment <your_compartment_name>
    Allow group <your_data_science_users> to use read metrics in compartment <your_compartment_name>

The following policies are for job runs to access other OCI resources:

.. code-block::

    Allow dynamic-group <your_dynamic_group> to read repos in compartment <your_compartment_name>
    Allow dynamic-group <your_dynamic_group> to use data-science-family in compartment <your_compartment_name>
    Allow dynamic-group <your_dynamic_group> to use virtual-network-family in compartment <your_compartment_name>
    Allow dynamic-group <your_dynamic_group> to use log-groups in compartment <your_compartment_name>
    Allow dynamic-group <your_dynamic_group> to use logging-family in compartment <your_compartment_name>
    Allow dynamic-group <your_dynamic_group> to manage objects in compartment <your_compartment_name> where all {target.bucket.name=<your_bucket_name>}
    Allow dynamic-group <your_dynamic_group> to use buckets in compartment <your_compartment_name> where all {target.bucket.name=<your_bucket_name>}

The following policy is needed for running a container job:

.. code-block::

    Allow dynamic-group <your_dynamic_group> to read repos in compartment <your_compartment_name>

See also:

* `Learn Best Practices for Setting Up Your Tenancy <https://docs.oracle.com/en-us/iaas/Content/GSG/Concepts/settinguptenancy.htm#Setting_Up_Your_Tenancy>`_
* `IAM with Identity Domains <https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm>`_
* `IAM without Identity Domains <https://docs.oracle.com/en-us/iaas/Content/Identity/home1.htm>`_
* `Dynamic Group <https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingdynamicgroups.htm>`_
* `Data Science Policies <https://docs.oracle.com/en-us/iaas/data-science/using/policies.htm>`_
* `Object Storage <https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/objectstoragepolicyreference.htm#Details_for_Object_Storage_Archive_Storage_and_Data_Transfer>`_
* `Container Registry <https://docs.oracle.com/en-us/iaas/Content/Identity/policyreference/registrypolicyreference.htm#Details_for_Registry>`_