While packaging a tax-filing Oracle Function, a teammate wants to copy a tenancy config file and an IAM user’s PEM into the image so SDK calls succeed. What is the documented secure pattern instead?
Select an answer to reveal the explanation.
Short Explanation
The platform slips a temporary worker badge into the container—resource principal—so you do not smuggle a person’s long-lived PEM into the image.
Full Explanation
The documented secure pattern for a tax-filing Oracle Function is to authenticate with the resource-principal session token and key that the Functions platform injects (environment variables in the OCI_RESOURCE_PRINCIPAL_* family) and to use the SDK’s resource-principal signer. No IAM user PEM belongs in the image or in application config. The Function’s dynamic-group membership plus IAM policy then authorize the specific Vault or other OCI calls the municipal workload needs.
Committing a user’s PEM to OCIR and loading it from Function application config at cold start embeds long-lived human credentials in every image and config read, violates rotation hygiene, and ties runtime auth to a person rather than the Function resource. Disabling IAM for the Function application and calling public OCI REST endpoints anonymously is not a supported bypass—OCI management and Secrets APIs expect authenticated, authorized principals. Mounting an instance-principal config from a Compute node into every Function container by default conflates Compute instance principals with Functions resource principals; Functions are not generally authorized by borrowing node instance-principal files.
Exam caveat: resource-principal tokens are time-bounded and cached; after policy changes, allow for refresh before concluding a policy is wrong. Operational check: remove any PEM or tenancy config files from the image build, deploy with resource-principal signing only, and confirm OCI SDK calls succeed while a search of the image layers shows no private keys.