Upgrade to Pro — share decks privately, control downloads, hide ads and more …

CSPモデルにおけるOCI設計ガイドライン / OCI Design Guide for...

CSPモデルにおけるOCI設計ガイドライン / OCI Design Guide for CSPs

Cloud Solutions Provider (CSP) モデルでOracle Cloud Infrastructureを利用するにあたって、設計上の考慮事項をまとめた資料です。

More Decks by Oracle Cloud Infrastructure ソリューション・エンジニア

Other Decks in Technology

Transcript

  1. Copyright © 2022, Oracle and/or its affiliates 2 Oracle Cloud

    Infrastructure( OCI) Cloud Solutions Provider (CSP) • • OCI
  2. CSP* OCI / → Identity Domain CSP Copyright © 2022,

    Oracle and/or its affiliates 3 OCI OCI+ *CSP( ): https://www.oracle.com/jp/partnernetwork/expertise/cloud-solutions-provider/
  3. Oracle IaaS/Paas/Saas Copyright © 2022, Oracle and/or its affiliates 4

    OCI IAM Identity Domains SSO (Outbound) • • SAML, OIDC, OAuth • • App Gateway • RADIUS • Linux PAM **** Oracle Cloud IaaS/PaaS • • • • OCI • ID • Console | CLI | APIs • / • • SCIM • AD • ( ) ! ? ü (Inbound) • ID/ • IdP • (SNS) • • • OATH OAuth FIDO2 REST APIs SAML OIDC SCIM IAM OCI IAM IDCS OCI IAM Identity Domains
  4. ( ) • 1 ※ • ( ) • Copyright

    © 2022, Oracle and/or its affiliates 5 001 A (A ) B (B ) A B (A ) (B ) Default ( )
  5. Copyright © 2022, Oracle and/or its affiliates 6 (1 )

    (2 ) (3 ) Default Virtual Machine Block Storage Database ( ) Policies ( ) Policies Groups Groups
  6. ( ) Administrators ( ) • • (manage all-resources) ※

    ( ) ( ) Copyright © 2022, Oracle and/or its affiliates 7 Allow Group <Domain Name>/<Group Name> to manage all-resources in Compartment <Compartment Name>
  7. Copyright © 2022, Oracle and/or its affiliates 8 • (

    ) ( ) • • • OCI CLI SDK • Free 10 • 6
  8. ( ) Copyright © 2022, Oracle and/or its affiliates 9

    OCI (…in tenancy ) ( ) • (Cloud Shell ) • ( : Cloud Guard ) • (use) ( : ) • ( ) ( )
  9. (allow group <domain/group> to…) inspect tenancies in tenancy IAM inspect

    compartments in tenancy IAM manage tenancy-preferences in tenancy IAM manage network-sources in tenancy IAM ( ) use tag-namespaces in tenancy where any {target.tag-namspace.name ='XXX' } IAM ( ) read announcements in tenancy Announcement (Announcement) read objectstorage-namespaces in tenancy Object Storage API use cloud-shell in tenancy Cloud Shell ( ) ( ) (…in tenancy) Copyright © 2022, Oracle and/or its affiliates 10
  10. Our mission is to help people see data in new

    ways, discover insights, unlock endless possibilities.