1. In the Console navigation menu, under Governance and Administration, go to Identity, and then click Policies.
2. Click Create Policy.
3. Enter a name and description for the policy.
4. In the Statement field, enter a policy rule in the following format:

   allow <subject> to <verb> <resource-type> in <location> where <condition>

   Conditions are optional. See Details for Verbs + Resource-Type Combinations.

5. (Optional) To add another statement, click + Another Statement.
6. Click Create.

At minimum, you need policies to:

• Allow users to use or manage GoldenGate resources, so that they can work with deployments and connections. For example:

  allow group <identity-domain>/<group-name> to manage goldengate-family in <location>

• Allow users to manage network resources, so that they can view and select compartments and subnets, and create and delete private endpoints when creating GoldenGate resources. For example:

  allow group <identity-domain>/<group-name> to manage virtual-network-family in <location>

  Optionally, you can further secure network resources using a combination of granular policies. See Policy Examples for Securing Network Resources.

• Define a dynamic group for your GoldenGate deployments to access resources in your tenancy:

  name: goldengate_deployments
  Matching rule: ALL {resource.type = 'goldengatedeployment', resource.compartment.id = '<location>'}

• Allow users to read the Identity and Access Management (IAM) user and group for validations in IAM enabled tenancies:

  allow service goldengate to {idcs_user_viewer, domain_resources_viewer} in <location>

• Oracle Vault, to access customer managed encryption keys. For example:

  allow group <identity-domain>/<group-name> to manage secret-family in <location>
  allow group <identity-domain>/<group-name> to use keys in <location>
  allow group <identity-domain>/<group-name> to use vaults in <location>
  allow dynamic-group goldengate_deployments to use keys in <location>
  allow dynamic-group goldengate_deployments to use vaults in <location> 

Depending on whether you intend to use the following services, you may also need to add policies for:

• Oracle Databases, for your source and/or target databases. For example:

  allow group <identity-domain>/<group-name> to read database-family in <location>

  allow group <identity-domain>/<group-name> to read autonomous-database-family in <location>

• Oracle Object Storage, to store manual OCI GoldenGate backups. For example:

  allow group <identity-domain>/<group-name> to manage objects in <location>
  allow dynamic-group goldengate_deployments to manage objects in <location>
  allow group <identity-domain>/<group-name> to inspect buckets in <location>

• OCI Logging, to access log groups. For example:

  allow group <identity-domain>/<group-name> to read log-groups in <location>
  allow group <identity-domain>/<group-name> to read log-content in <location>

• Load Balancer, if you enable public access to the deployment console:

  allow group <identity-domain>/<group-name> to manage load-balancers in <location>
  allow group <identity-domain>/<group-name> to manage public-ips in <location> 
   
  allow group <identity-domain>/<group-name> to manage network-security-groups in <location>
  allow group <identity-domain>/<group-name> to manage vcns in <location> where ANY {request.operation = 'CreateNetworkSecurityGroup', request.operation = 'DeleteNetworkSecurityGroup'}
  

• Work requests:

  allow group <identity-domain>/<group-name> to inspect work-requests in <location>

The following statement gives a group permission to manage tag-namespaces and tags for workspaces:

allow group <identity-domain>/<group-name> to manage tag-namespaces in <location>

To add a defined tag, you must have permission to use the tag namespace. To learn more about tagging, see Resource Tags.

For more information and additional example policies, see OCI GoldenGate Policies.

You can easily allow users access to network resources within a compartment with the policy:

allow group <group-name> to use virtual-network-family in compartment <compartment-name>

Alternatively, you can use the following policies to secure network resources at a more granular level: