n the Oracle Cloud Infrastructure (OCI) Logging Service, controlling access is paramount for security and operational efficiency. IAM (Identity and Access Management) policies serve as the cornerstone for defining access permissions. These policies delineate who can access the logging service and to what extent. Let’s delve into the various levels of access and their corresponding IAM policies.
Defining User Roles
User roles in OCI Logging typically fall into two categories: Log Administrators and Log Viewers.
- Log Administrators: These users wield significant control over logging functionalities. They can enable logs, manage log groups, and oversee log-related operations.
- Log Viewers: Their role is more limited, primarily focusing on retrieving and viewing logs.
IAM Policies Hierarchical Structure
IAM policies operate within a hierarchical structure, ensuring granular control over access rights. These policies can be applied at the tenancy or compartment level, allowing for tailored access management.
Example IAM Policies for Log Administrators
For a group designated as log administrators, various levels of access can be delineated:
- Inspect Level: Granting the ability to view log groups within a specific compartment.
- Read Level: Enabling users to access metadata of logs and log groups.
- Use Level: Allowing for modifications within log groups.
- Manage Level: Providing comprehensive permissions, including creation and deletion of log groups.
Example IAM Policies for Log Viewers
For log viewers, who primarily need access to search and view log content:
- Read Log Content: Permitting users to access and search log content within a specified compartment.
Agent Configuration
Agent configuration is crucial for custom log ingestion. Users responsible for provisioning agent configurations require appropriate permissions.
- Unified Configuration Usage: Facilitating the provisioning of agent configurations within a designated compartment.
Dynamic Group Policies
Dynamic groups, comprising instances requiring access to configurations, necessitate tailored policies.
- Instance Access: Allowing designated instances to utilize log content within a specific compartment.
Exploring Logs: Search and Visualization
Powerful Search Capabilities
OCI Logging Service offers robust search functionalities, accessible through the OCI Console, CLI, or APIs. Users can execute custom queries to filter logs based on diverse criteria.
- Basic and Advanced Modes: Two modes cater to varying complexity levels of queries.
Filtering Options
Users can refine their searches using various filtering options, including log fields, strings, keywords, and time intervals. Each log entry is exportable in detail, with JSON format facilitating comprehensive analysis.
Log Visualization
The service facilitates visualization of log data through chart widgets, offering insights into log trends and patterns.
- Chart Options: Users can choose from stacked bar charts, pie charts, line charts, etc., to visualize data according to preference.
- Auto-Refresh: Log data can be auto-refreshed at regular intervals, ensuring real-time monitoring and analysis.
Log Retention Period
The logging service maintains logs for a maximum of six months, ensuring compliance and historical analysis.
In conclusion, IAM policies play a pivotal role in managing access to OCI Logging Service, while robust search and visualization capabilities empower users to effectively explore and analyze log data.