While packaging a tax-filing Oracle Function, a teammate wants to c…

Question

While packaging a tax-filing Oracle Function, a teammate wants to copy a tenancy config file and an IAM user’s PEM into the image so SDK calls succeed. What is the documented secure pattern instead?

Accepted Answer

Authenticate with the resource-principal session token and key the platform injects (OCIRESOURCEPRINCIPAL) and use the SDK resource-principal signer — The platform slips a temporary worker badge into the container—resource principal—so you do not smuggle a person’s long-lived PEM into the image.

Answer

Commit the user’s PEM to OCIR and load it from Function application config at cold start

Answer

Disable IAM for the Function application and call public OCI REST endpoints anonymously

Answer

Mount an instance-principal config from a Compute node into every Function container by default

While packaging a tax-filing Oracle Function, a teammate wants to copy a tenancy config file and an IAM user’s PEM into the image so SDK calls succeed. What is the documented secure pattern instead?

Short Explanation

Full Explanation