---
description: Details of API Security policy to use SpaceONE plugin
---

# (Oracle Cloud Infrastructure) Identity and Access Management(IAM) Policy Management

## IAM Policy

**SpaceONE** highly recommends to set appropriate permissions to access your _**cloud resources**_ for each purpose.&#x20;

Please, Set service account,  To Create API for each use case

* [General Collector](#general-collector)

## General Collector&#x20;

Collector requires appropriate authorities to collect cloud resources. We strongly recommend to limit collector's service account its permission to **read only access**.&#x20;

Otherwise, you can add more restrictions per resources or actions. One of the useful example is to restrict its rights within region.

#### STEP 1. Log in Oracle Cloud Infrastructure Console > Identity

Go to Identity > Users and Click  `CREATE USER`

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWcKSRemgrqTixJvj4t%2F-MWgJUmaNaogx3KL1Cky%2Fcreate_user_button.png?alt=media\&token=9f67d583-83cd-4160-9bc3-6f13f37240da)

#### STEP 2. Set IAM User details

Click  `IAM User`and Enter  _**User name**_ and _**Description**_&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWcKSRemgrqTixJvj4t%2F-MWgKv7r2_oZoT1UEE1a%2Fcreate_IAM_user.png?alt=media\&token=7f66e0fe-d1c3-47fe-b500-33713ae9d3af)

#### STEP 3. Set API Keys to IAM User&#x20;

Go to Identity > Users > User > Details > API Keys. Click `Add API Key` and add or Generate API Key.&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWcKSRemgrqTixJvj4t%2F-MWgLY4P3pwb9Vm-OsMK%2Fadd_or_generate_api_key.png?alt=media\&token=61af5585-3064-4ccc-97c5-45bc091d5358)



#### STEP 4. Create Group for IAM User&#x20;

Go to Identity > Groups and Click  `Create Group` Button. Enter _**Name**_ and _**Description**_.

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWcKSRemgrqTixJvj4t%2F-MWgMwWS1aeU0hTyB7Gz%2Fcreate_group.png?alt=media\&token=a5b2864c-025c-4f5e-ade7-2b32072b74a3)

#### STEP 5. Add IAM User to Group

Go to Group that you made and Click `Add User to Group`  Button and add IAM User.&#x20;

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWcKSRemgrqTixJvj4t%2F-MWgM_bVtFU0WtnlFiGH%2Fadd_user_to_group.png?alt=media\&token=6caf47f5-72e4-4cfc-abe5-c29edb3e4b53)

#### STEP 6. Set Policies to Group

Go to Identity > Policies and Click `Create Policy` Button.

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWcKSRemgrqTixJvj4t%2F-MWgNnCi0aVZgCrpgRf6%2Fmove_to_policies.png?alt=media\&token=85069d1d-f280-4228-a0fe-ebdb60a4d19e)



Enter _**Name**_ and _**Description**_ and _**Policies**_ by manually.&#x20;

Entering statements directly in the text box, ensure that you follow the [Policy Syntax](https://docs.oracle.com/en-us/iaas/Content/Identity/Concepts/policysyntax.htm#Policy_Syntax) rules.

When using General Collector, the **following two policies are required**:

```
Allow group {group_name} to inspect compartments in tenancy
Allow group {group_name} to inspect tenancies in tenancy
```

![](https://402810733-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LzBJTlSpVTrcscLp2gb%2F-MWcKSRemgrqTixJvj4t%2F-MWgO5_3isnbEhj3UO4b%2Fcreate_policies.png?alt=media\&token=31be658d-a726-4c04-b36e-f1b24c8e0908)

