A civic Oracle Function only needs to fetch a Vault secret bundle at invoke time. Which IAM verb and target best match least privilege?
Select an answer to reveal the explanation.
Short Explanation
IAM verbs climb like building-access badges: inspect, read, use, manage. Fetching a password is a read badge, not a master key to the whole tenancy.
Full Explanation
Least privilege for a civic Function that only fetches a Vault secret bundle at invoke time is read on secret-family or read on secret-bundles for the needed compartment or resource scope. IAM verbs escalate inspect < read < use < manage. Retrieval needs read-level access to obtain contents and bundle metadata; it does not need manage rights to create, delete, or reconfigure unrelated secrets, and it certainly does not need manage all-resources in the tenancy.
Granting manage all-resources in the tenancy so the Function “never hits an authorization error” maximizes blast radius: a compromised Function could alter nearly anything. Granting manage secret-family in the compartment so the Function can also create and delete unrelated secrets overshoots retrieval and invites accidental or malicious secret lifecycle changes. Granting only inspect on VCNs fails because network inspect rights do not imply secret retrieval; secrets authorization is a separate Vault/IAM target, not a side effect of VCN visibility.
Exam caveat: some operations distinguish secret-family management from secret-bundle read; policies that only allow inspect on secrets still cannot return plaintext bundles. Operational check: replace any manage all-resources statements with a read secret-family or read secret-bundles statement scoped to the Function’s dynamic group, invoke retrieval, and confirm success—then attempt a create-secret call and confirm it is denied.