This document contains the OCI permissions required for the SynCloud scanner.
In this onboarding model, the customer creates one local read-only OCI user in the customer tenancy. SynCloud uses that customer API key for scanner visibility. No cross-tenancy policy is required.
Security Summary
These policies grant read-only posture and billing visibility for the SynCloud scanner. They do not allow SynCloud to create, update, delete, or manage customer resources.
The scanner does not read customer application data, database table contents, secret values, or general object-storage contents. The only object contents read are OCI FOCUS cost-report CSVs from Oracle's billing namespace, used for cost and financial analysis.
OCI Budgets requires the IAM verb use for some budget APIs. The scanner uses
that access only for list/get style budget and cost anomaly reads.
1. Required Values
CUSTOMER_TENANCY_OCID=<customer tenancy OCID>
CUSTOMER_HOME_REGION=<customer home region>
CUSTOMER_IDENTITY_DOMAIN=<identity domain name, usually Default>
Only the customer home region is required here. The scanner discovers the customer's subscribed OCI regions during the scan.
2. Local Scanner User
Create a local read-only user and group in the customer tenancy:
User: syncloud-scanner-iam
Group: SyncloudScannerGroup
Add the user to SyncloudScannerGroup.
In the policies below, replace <SyncloudScannerGroup_OCID> with the OCID of
the group you just created.
SyncloudScannerGroup_OCID=<customer group OCID>
Policy Creation Instructions
For each policy section below:
OCI Console -> Identity & Security -> Policies -> Create Policy
Compartment: customer tenancy root compartment
Name: use the policy name shown in the section
Policy: paste the policy block shown in the section
3. Scanner Resource Policy
Create this policy in the customer tenancy root compartment.
Name:
SyncloudScannerResourceAccess
Policy:
Allow group id <SyncloudScannerGroup_OCID> to read all-resources in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect tenancies in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect compartments in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read vss-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read cloud-guard-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read data-safe-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read loganalytics-features-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read loganalytics-resources-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read waas-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read waf-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read nosql-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read audit-events in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read optimizer-api-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read announcements in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read dbmgmt-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read dbmgmt-mysql-family in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read opsi-family in tenancy
4. IAM And Identity Policy
Create this policy in the customer tenancy root compartment.
Name:
SyncloudScannerIamAccess
Policy:
Allow group id <SyncloudScannerGroup_OCID> to inspect tenancies in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read compartments in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect users in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read users in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect groups in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read groups in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect dynamic-groups in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read dynamic-groups in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect identity-providers in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read identity-providers in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect policies in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read policies in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read credentials in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect tag-namespaces in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read tag-namespaces in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect tag-defaults in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect domains in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read domains in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect authentication-policies in tenancy
Allow group id <SyncloudScannerGroup_OCID> to inspect network-sources in tenancy
5. Billing And FinOps Policy
Create this policy in the customer tenancy root compartment.
Name:
SyncloudScannerBillingAccess
Policy:
Allow group id <SyncloudScannerGroup_OCID> to read usage-report in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read usage-budgets in tenancy
Allow group id <SyncloudScannerGroup_OCID> to use usage-budgets in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read computed-usages in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read invoices in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read subscribed-services in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read subscription in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read billing-schedules in tenancy
Allow group id <SyncloudScannerGroup_OCID> to read rate-cards in tenancy
6. FOCUS Cost Reports Policy
Create this policy in the customer tenancy root compartment.
Name:
SyncloudScannerCostReportsAccess
Policy:
Define tenancy bling as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
Endorse group SyncloudScannerGroup to read objects in tenancy bling
This is only for OCI FOCUS cost-report CSVs in Oracle's billing namespace. It does not grant access to customer application object-storage buckets.
7. Identity Domains Read Access
The scanner needs read/list access to these Identity Domain resources:
Users
Groups
Identity Providers
Applications
Application Roles
Password Policies
If the tenancy IAM policy does not allow those SCIM reads, grant
syncloud-scanner-iam the least-privilege Identity Domain role that permits
read/list access to those resources.
8. API Key Details To Send To SynCloud
Generate an API key for:
syncloud-scanner-iam
Send these values through the secure channel:
tenancy_ocid
user_ocid
fingerprint
private_key_pem
region