The city’s grants Function is in dynamic group civic-fn-dg and must read objects only from bucket permit-uploads. Which policy shape best reflects least privilege?
Select an answer to reveal the explanation.
Short Explanation
Name the dynamic group as the subject, pick the object family and verb you need, then tighten with a where clause on the bucket—like a badge that opens one cabinet, not the whole floor.
Full Explanation
Effective Functions policies name a dynamic group as the subject and grant a scoped verb on a resource family, optionally with a where clause such as target.bucket.name. Examples include inspect vcns, manage objects for a named bucket, or read secret-family. manage all-resources in the compartment works but is not least privilege.