A library catalog function must list objects in an Object Storage bucket at runtime without embedding long-lived user API keys in configuration. What is the correct authentication approach for the running function?
Select an answer to reveal the explanation.
Short Explanation
The running function should show its own badge—its resource principal—not borrow a clerk’s permanent keys from a drawer. Pair that identity with a dynamic group for fnfunc and grant only what the handler needs.
Full Explanation
Oracle Functions exposes OCI_RESOURCE_PRINCIPAL_* environment variables so a running function authenticates as itself. Match the function with a dynamic group on resource type fnfunc and attach IAM policies that allow required actions such as reading a bucket or writing to a stream. Do not ship long-lived user API keys in configuration for this pattern.