List of Oracle Cloud Infrastructure provider permissions for Cortex Cloud.
Permission | Module | Scope | Purpose |
|---|---|---|---|
Admit group CortexOutpostGroup of tenancy CortexOutpost to use volumes in tenancy | ADS | In tenancy | Allow creation of backups from volumes |
Admit group CortexOutpostGroup of tenancy CortexOutpost to use key-delegate in tenancy | ADS | In tenancy | Re-encrypt backups during copy/restore operations |
Admit group CortexOutpostGroup of tenancy CortexOutpost to associate keys in tenancy with volumes in tenancy CortexOutpost | ADS | Volumes in tenancy | Associate encryption keys with volumes during backup/restore |
Admit group CortexOutpostGroup of tenancy CortexOutpost to use tag-namespaces in tenancy | ADS | In tenancy | Enable tagging for permission scoping, resource tracking, and cost visibility |
Admit group CortexOutpostGroup of tenancy CortexOutpost to manage boot-volume-backups in tenancy where request.operation != 'DeleteBootVolumeBackup' | ADS | Excludes delete | Allow full management of boot volume backups except deletion |
Admit group CortexOutpostGroup of tenancy CortexOutpost to manage boot-volume-backups in tenancy where target.resource.tag.cortex_m-o-lcaas_id.panw_capability = 'cortex-scan-platform' | ADS | Only boot-volume-backups tagged with panw_capability = cortex-scan-platform | Restrict deletion to Cortex scan-related resources only |
Admit group CortexOutpostGroup of tenancy CortexOutpost to read all-resources in tenancy | ADS | In tenancy | Read-only access to all resources |
"Discovery Engine" read only access. Grants read-only access to OCI tenancy and resources.
Permission | Scope | Purpose |
|---|---|---|
Allow dynamic-group registry-scan to manage buckets in tenancy | Tag-scoped (project_id) | Manage Object Storage buckets for scan artifacts/results |
Allow dynamic-group registry-scan to manage objects in tenancy | Tag-scoped (project_id) | Upload/download image layers, manifests, and reports |
Allow dynamic-group registry-scan to read secret-bundles in tenancy | Tag-scoped (project_id) | Retrieve registry credentials from OCI Vault |
Endorse dynamic-group registry-scan to read repos in any-tenancy | Cross-tenancy | Allow cross-tenancy image pulls for scans |
Permission | Scope | Purpose |
|---|---|---|
Allow any-user to manage buckets in tenancy | Tag-scoped (project_id) | Create/manage buckets for scan data |
Allow any-user to manage objects in tenancy | Tag-scoped (project_id) | Read/write objects (artifacts, logs, results) |
Allow any-user to use keys in tenancy | Tag-scoped (project_id) | Decrypt secrets for registry access |
Allow any-user to manage secret-versions in tenancy | Tag-scoped (project_id) | Rotate credentials and manage secret versions |
Allow any-user to manage secrets in tenancy | Tag-scoped (project_id) | Create/update secrets for scanners |
Allow any-user to manage secret-family in tenancy | Tag-scoped (project_id) | Broader secret-management rights |
Allow any-user to manage vaults in tenancy | Tag-scoped (project_id) | Create/administer Vaults for key and secret storage |
Allow any-user to inspect tag-family in tenancy | Global | Discover tag namespaces/definitions |
Allow any-user to use tag-family (namespace=cortex_cloud, managed_by=PANW) | Restricted | Restrict tag usage to Palo Alto-managed groups |
Endorse any-group to use tag-namespaces in any-tenancy | Cross-tenancy | Allow tag namespace usage across tenancies |