Skip to main content

Oracle Cloud connection

An Oracle Cloud connection lets CloudFlow action nodes call OCI APIs by reusing the API key stored for an existing OCI Asset. CloudFlow does not store a second private key and does not create a Cloud Connect configuration.

Oracle Cloud connections are available to customers enrolled in Early Access.

Required permissions​

To create the connection, your DoiT account must have the CloudFlow Manager permission.

OCI billing onboarding only grants access to billing report objects. To use Oracle Cloud nodes, add a separate policy for the DoiT IAM group. The following policy supports the Early Access catalog and its deletion safeguards; replace <compartment_ocid> with the compartment that contains the resources:

Allow group doit-saas-readers to inspect compartments in tenancy
Allow group doit-saas-readers to inspect tenancies in tenancy
Allow group doit-saas-readers to inspect volumes in tenancy
Allow group doit-saas-readers to inspect instances in tenancy
Allow group doit-saas-readers to inspect volume-attachments in tenancy

Allow group doit-saas-readers to manage volumes in compartment id <compartment_ocid> where request.permission='VOLUME_DELETE'

Allow group doit-saas-readers to read instances in compartment id <compartment_ocid>
Allow group doit-saas-readers to use instances in compartment id <compartment_ocid> where request.permission='INSTANCE_POWER_ACTIONS'

Allow group doit-saas-readers to read public-ips in compartment id <compartment_ocid>
Allow group doit-saas-readers to manage public-ips in compartment id <compartment_ocid> where any {request.permission='PUBLIC_IP_DELETE', request.permission='PUBLIC_IP_UNASSIGN_PRIVATE_IP'}
Allow group doit-saas-readers to use private-ips in compartment id <compartment_ocid> where request.permission='PRIVATE_IP_UNASSIGN_PUBLIC_IP'

Repeat the compartment-scoped statements for each compartment that CloudFlow can manage. The tenancy-wide volume, instance, and attachment inspection statements let CloudFlow verify that a volume is not attached to an instance in another compartment before deletion. Use a dedicated group if your organization separates billing ingestion from automation.

If the group is in a non-default identity domain, use the domain-qualified group name, for example Allow group '<identity_domain>'/'doit-saas-readers' ....

For the permission required by each OCI API operation, see Core Services permissions.

Create the connection​

  1. Make sure the tenancy is available as an OCI Asset in DoiT Cloud Intelligence.
  2. Sign in to the DoiT console, select Automation and operations, and then select CloudFlow.
  3. From the sidebar, select Connections, then select Oracle Cloud.
  4. Select Create connection from existing permissions.
  5. Select one or more OCI Assets and then select Create connection.
  6. Open the connection and select Re-check permissions.

If the check reports Insufficient permissions, update the OCI policy and retry. You do not need to recreate the OCI Asset unless its API key changes. The capability check is read-only and advisory; a resource-level policy can still cause an individual node to fail at runtime.

Use the connection​

Add the connection to an Oracle Cloud node. Select an accessible compartment and subscribed region, or enter their identifiers directly. CloudFlow stores and sends the compartment OCID even when you select it by name.

See also​

Last updated on