Agent skill · product strategy · jeremylongshore
oraclecloud-enterprise-rbac
Design OCI compartment hierarchies, dynamic groups, and cross-tenancy
Why this skill is useful
Provides specific OCI compartment design patterns and Python scripts for creating compartment hierarchies that are not commonly known.
What it needs
Requires oci installed locally. Requires oraclecloud account access. About 5k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Oracle Cloud Enterprise RBAC Overview OCI compartments are powerful but the inheritance model is confusing. Policies at root vs compartment level behave differently, dynamic groups enable compute-to-service auth without API keys, and cross-tenancy access requires matching policies on both sides. Most teams get this wrong and over-permission everything with manage all-resources in tenancy. This skill designs proper compartment hierarchies with least-privilege access. Purpose: Build a scalable, least-privilege OCI organization structure using compartments, policy inheritance, dynamic groups, and tag-based access control. Prerequisites OCI Python SDK — pip install oci OCI config file at ~/.oci/config with valid credentials (user, fingerprint, tenancy, region, keyfile) Tenancy administrator access — compartment and policy creation requires root-level permissions Familiarity with OCI IAM basics (see oraclecloud-security-basics for policy syntax) Python 3.8+ Instructions Step 1: Design the Compartment Hierarchy OCI compartments are nested organizational units. Unlike AWS accounts, they share a single tenancy with inherited policies. A standard enterprise layout: Create this hierarchy programmatically: Step 2: Understand Policy Inheritance Rules Policy inheritance is the most misunderstood OCI concept. Three critical rules: 1. Policies at root apply to all compartments below. A policy Allow group DevOps to manage all-resources in tenancy grants access everywhere. 2. Policies attached to a compartment only apply to that compartment and its children. A policy attached to dev does NOT grant access to prod. 3. Child compartments inherit parent permissions. If DevOps can manage instance-family in compartment dev, they can also manage instances in dev-compute and dev-data (children of dev). Step 3: Create Dynamic Groups for Instance Principal Dynamic groups enable OCI instances and functions to authenticate to OCI services without API keys. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/oraclecloud-enterprise-rbac--561e2c