Oracle Exam 1Z0-1067 Topic 8 Question 27 Discussion

Let auditors inspect your resources

Type of access:Ability to list the resources in all compartments. Be aware that:

The operation to list IAM policies includes the contents of the policies themselves

The list operations for Networking resource-types return all the information (for example, the contents of security lists and route tables)

The operation to list instances requires thereadverb instead ofinspect, and the contents include the user-provided metadata.

The operation to view Audit service events requires thereadverb instead ofinspect.

Where to create the policy:In the tenancy. Because of the concept ofpolicy inheritance, auditors can then inspect both the tenancy and all compartments beneath it. Or you could choose to give auditors access to only specific compartments if they don't need access to the entire tenancy.

Allow group Auditors to inspect all-resources in tenancy

Allow group Auditors to read instances in tenancy

Allow group Auditors to read audit-events in tenancy