A water-utility Oracle Function must read a Vault secret at runtime…

Question

A water-utility Oracle Function must read a Vault secret at runtime without embedding an IAM user key. Which approach follows the documented Functions path?

Accepted Answer

Place the function in a dynamic group, grant that group read on the secret family or named secret, and call Secrets retrieval with the resource-principal signer — The Function becomes a named worker badge via a dynamic group; policy lets that badge read the secret; resource principal is how the badge signs the API call—no user PEM in the image.

Answer

Bake a tenancy admin PEM into the OCIR image and export it as a Function config key named DBPASSWORD

Answer

Store the password as an application config value and grant the Function manage all-resources in the tenancy

Answer

Put the password in a public Object Storage object and fetch it anonymously over the internet

A water-utility Oracle Function must read a Vault secret at runtime without embedding an IAM user key. Which approach follows the documented Functions path?

Short Explanation

Full Explanation