A developer must authorize several Oracle Functions in one compartment to call OCI APIs. What should the dynamic-group matching rule select?

Dynamic groups authorize OCI resources as principals. For several Oracle Functions in one compartment, the matching rule should select Functions with resource.type = 'fnfunc' and then narrow by compartment, specific OCID, or a defined tag as needed. Once matched, IAM policies can Allow that dynamic-group to call the required APIs. Running Functions therefore act under resource principal membership, not under the human who last deployed them.

Matching IAM users who deployed the functions fails because deploy-time human group membership is not inherited by the running Function principal; confusing deployer identity with runtime identity is a frequent exam trap. Relying only on free-form tags as the supported matching dimension for fnfunc is incorrect—defined tags (and compartment/OCID constraints) are the supported tagging dimension for matching rules, while free-form tags are not the documented matching basis. Selecting API Gateway deployments because Functions supposedly never appear as OCI resources is false: Functions are first-class resources addressable as fnfunc in dynamic groups.

Exam caveat: a matching rule that is syntactically valid but points at the wrong compartment or omits fnfunc will yield an empty effective principal set even when policies look correct. Operational check: in the Console, open the dynamic group matching rule, confirm member Functions appear as expected for the civic compartment, attach a minimal policy, and invoke one Function to verify authorized OCI API calls succeed.