A developer must authorize several Oracle Functions in one compartment to call OCI APIs. What should the dynamic-group matching rule select?
Select an answer to reveal the explanation.
Short Explanation
A dynamic group is a club roster for resources. For Functions, the roster key is resource.type = 'fnfunc', then narrow by compartment, OCID, or a defined tag—not free-form tags.
Full Explanation
Oracle Functions become principals through dynamic groups. Matching rules select functions with resource.type = 'fnfunc' and may further constrain by compartment, OCID, or a defined tag; free-form tags are not supported for matching. Policies then name that dynamic group rather than an IAM user or group as the subject of a running function.