AWS odb medium security documentation change
Summary
Expanded IAM policy examples with granular permissions for ODB networks, peering connections, resource policies, VPC Lattice integration, and tagging operations
Security assessment
Changed from wildcard 'odb:*' permission to specific least-privilege actions, added explicit security controls for resource tagging and VPC Lattice integration. This demonstrates concrete security hardening of IAM policies.
Diff
diff --git a/odb/latest/UserGuide/security_iam_id-based-policy-examples.md b/odb/latest/UserGuide/security_iam_id-based-policy-examples.md index 61c62fbac..71ac72cc7 100644 --- a//odb/latest/UserGuide/security_iam_id-based-policy-examples.md +++ b//odb/latest/UserGuide/security_iam_id-based-policy-examples.md @@ -57 +57 @@ You don't need to allow minimum console permissions for users that are making ca -This policy allows users full access to provision Oracle Database@AWS resources. To setup DNS resolution from your VPC, you need to create an outbound Route 53 resolver and add rules to forward DNS traffic with the OCI domain name to OCI DNS listener IP. +This policy allows users full access to provision Oracle Database@AWS resources. To set up DNS resolution from your VPC, create an outbound Route 53 resolver and add rules to forward DNS traffic with the OCI domain name to OCI DNS listener IP. @@ -64,0 +65 @@ This policy allows users full access to provision Oracle Database@AWS resources. + "Effect": "Allow", @@ -66 +67,13 @@ This policy allows users full access to provision Oracle Database@AWS resources. - "odb:*", + "odb:GetOciOnboardingStatus", + "odb:CreateOdbNetwork", + "odb:DeleteOdbNetwork", + "odb:GetOdbNetwork", + "odb:ListOdbNetworks", + "odb:UpdateOdbNetwork", + "odb:CreateOdbPeeringConnection", + "odb:DeleteOdbPeeringConnection", + "odb:GetOdbPeeringConnection", + "odb:ListOdbPeeringConnection", + "odb:PutResourcePolicy", + "odb:GetResourcePolicy", + "odb:DeleteResourcePolicy", @@ -67,0 +81 @@ This policy allows users full access to provision Oracle Database@AWS resources. + "ec2:DescribeAvailabilityZones", @@ -70,6 +84,5 @@ This policy allows users full access to provision Oracle Database@AWS resources. - "ec2:DescribeAvailabilityZones", - "ec2:DescribeRouteTables", - "ec2:CreateRoute", - "route53resolver:CreateResolverEndpoint", - "route53resolver:CreateResolverRule", - "route53resolver:AssociateResolverRule" + "ec2:ModifyOdbNetworkPeering", + "ec2:DescribeVpcEndpointAssociations", + "ec2:CreateVpcEndpoint", + "ec2:DeleteVpcEndpoints", + "ec2:DescribeVpcEndpoints", @@ -77 +89,0 @@ This policy allows users full access to provision Oracle Database@AWS resources. - "Effect": "Allow", @@ -90 +102,2 @@ This policy allows users full access to provision Oracle Database@AWS resources. - "odb.amazonaws.com" + "odb.amazonaws.com", + "vpc-lattice.amazonaws.com", @@ -93,0 +107,27 @@ This policy allows users full access to provision Oracle Database@AWS resources. + }, + { + "Sid": "AllowTaggingActions", + "Effect": "Allow", + "Action": [ + "odb:TagResource", + "odb:UntagResource", + "odb:ListTagsForResource" + ], + "Resource": "arn:aws:odb:*:*:odb-network/*" + }, + { + "Sid": "AllowOdbVpcLatticeActions", + "Effect": "Allow", + "Action": [ + "vpc-lattice:CreateServiceNetwork", + "vpc-lattice:DeleteServiceNetwork", + "vpc-lattice:GetServiceNetwork", + "vpc-lattice:CreateServiceNetworkResourceAssociation", + "vpc-lattice:DeleteServiceNetworkResourceAssociation", + "vpc-lattice:GetServiceNetworkResourceAssociation", + "vpc-lattice:CreateResourceGateway", + "vpc-lattice:DeleteResourceGateway", + "vpc-lattice:GetResourceGateway", + "vpc-lattice:CreateServiceNetworkVpcEndpointAssociation", + ], + "Resource": "*", @@ -144 +184 @@ How Oracle Database@AWS works with IAM -Troubleshooting +AWS managed policies