Managing Network Sources

If you're in the Administrators group, then you have the required access for managing network sources. To write policies specifically for network sources, use the network-sources resource type, found with the other IAM components, in Details for IAM without Identity Domains.

If you're new to policies, see Getting Started with Policies and Common Policies.

Apply tags to resources to help organize them according to business needs. Apply tags at the time you create a resource, or update the resource later with the wanted tags. For general information about applying tags, see Resource Tags.

A network source is a set of defined IP addresses. The IP addresses can be public IP addresses or IP addresses from VCNs within your tenancy. After you create the network source, you can reference it in policy or in your tenancy's authentication settings to control access based on the originating IP address.

Network sources can only be created in the tenancy (or root compartment) and, like other IAM resources, reside in the home region. For information about the number of network sources you can have, see IAM Without Identity Domains Limits.

You can use network sources to help secure your tenancy in the following ways:

• Specify the network source in IAM policy to restrict access to resources.

  When specified in a policy, IAM validates that requests to access a resource originate from an allowed IP address.

  For example, you can restrict access to Object Storage buckets in your tenancy to only users that are signed in to Oracle Cloud Infrastructure through your corporate network. Or, you can allow only resources belonging to specific subnets of a specific VCN to make requests over a service gateway.

• Specify the network source in your tenancy's authentication settings to restrict sign in to the Console.

  You can set up your tenancy's authentication policy to allow sign in to the Console from only those IP addresses specified in your network source. Users attempting to sign in from an IP address not on the allowed list in your network source will be denied access. For information on using a network source restriction in authentication policy, see Managing Authentication Settings.

To restrict access to requests made from a set of IP addresses, do the following:

1. Create a network source that specifies the allowed IP addresses.
2. Write a policy that uses the network source variable in a condition.

allow group CorporateUsers to manage object-family in tenancy where request.networkSource.name='corpnet'

For information about using the API and signing requests, see REST API documentation and Security Credentials. For information about SDKs, see SDKs and the CLI.

Use these API operations to manage network sources:

• CreateNetworkSource
• ListNetworkSources
• GetNetworkSource
• UpdateNetworkSource
• DeleteNetworkSource

{
"compartmentId" : "ocid1.tenancy.oc1..aaaaaaaabaexampleuniqueID",
"description" : "Corporate IP ranges to be used for IP-based authorization",
"name" : "corpnet",
"virtualSourceList": [
{"vcnId": "ocid1.vcn.oc1.iad.aaaaaaaaexampleuniqueID", "ipRanges": [ "129.213.39.0/24" ]}

],
"publicSourceList": [ "192.0.2.5", "192.0.2.6" ],
"services": ["all"]
]
}

{
"virtualSourceList": [{vcnId: "ocid1.vcn.oc1.iad.aaaaaaaaexampleuniqueID", "ipRanges": [ "129.213.39.0/24" ]}],
"publicSourceList": [ "192.0.2.0/25", "192.0.2.200" ]
}