In Oracle Cloud Infrastructure (OCI), policies are written to define permissions for user groups. The correct policy to provide admin access to all three existing admin groups in a shared compartment (in this case, the
"Test" compartment) would be:
"Allow all-group to manage all-resources in compartment Test where request.principal.group.tag.
EmployeeGroup.Role='Admin'".
* "Allow all-group": Grants access to all groups.
* "to manage all-resources": Specifies full access permissions (manage includes all CRUD operations).
* "in compartment Test": Limits the scope of the policy to the "Test" compartment.
* "where request.principal.group.tag.EmployeeGroup.Role='Admin'": Adds a condition to restrict this admin-level access to only groups tagged with the role 'Admin'.
This policy ensures that only users in the groups tagged as Admin will be allowed to manage resources in the Test compartment, making it the most suitable choice for providing admin access.
For reference:
* OCI Policy Syntax Documentation