Implementing OCI Resource Policies for Fine-Grained Access Control in API
I've spent hours debugging this and I'm prototyping a solution and Currently developing an API that interacts with various OCI resources, and I'm looking for the best way to implement fine-grained access control using OCI Resource Policies. The goal is to restrict access to certain resources based on user roles without complicating the authentication flow. I've started by setting up a basic API using FastAPI and using the OCI SDK for Python. However, defining and applying resource policies seems less straightforward than I anticipated. Here's what I've tried so far: 1. **Creating IAM policies**: I initially created broad policies for user groups but realized that it does not provide the granularity I need. 2. **Using Resource Manager**: While exploring the OCI Resource Manager for policy management, I encountered issues with syntax errors in the policy definitions. Here’s an example of a policy I attempted: ```python Allow group Developers to manage objects in compartment MyCompartment ``` However, this didn’t restrict access as intended. 3. **Testing with OCI Console**: I also attempted to verify permissions through the OCI console by testing user roles, but the feedback wasn't clear on what permissions were missing. What are the best practices for structuring these policies in OCI to achieve the desired access control? Are there any specific examples or tools recommended for managing these permissions seamlessly? Any guidance on debugging these configurations would also be greatly appreciated as I work through this implementation. What am I doing wrong? Could this be a known issue?