After fixing an IAM policy for a civic Oracle Function, an immediate re-invoke still returns NotAuthorizedOrNotFound. The matching rule and policy text are now correct. What is the most likely explanation?
Select an answer to reveal the explanation.
Short Explanation
The Function keeps a short-lived memory of its old badge—about fifteen minutes—so a correct new policy can still fail until that cached token ages out.
Full Explanation
When the matching rule and policy text are already correct but an immediate re-invoke of a civic Oracle Function still returns NotAuthorizedOrNotFound, the most likely explanation is resource-principal token caching—on the order of about fifteen minutes—so authorization changes may not apply until the cached token refreshes. The Function continues presenting a principal context evaluated under the prior authorization snapshot until expiry/refresh, which looks like a sticky deny even though Console policy now reads correctly.
Claiming Functions ignore IAM and only honor Kubernetes RBAC RoleBindings is false for Oracle Functions calling OCI APIs; IAM is the authorization system for those calls. Claiming dynamic-group membership for fnfunc is evaluated only at tenancy create time is false; membership is based on the current matching rule as resources exist, not a one-time tenancy bootstrap. Requiring a hard image rebuild after every policy edit for secret retrieval confuses policy propagation with artifact rebuilds; policy changes do not require repackaging the Function image.
Exam caveat: mis-copied compartment OCIDs or a dynamic group that does not actually list the Function produce the same error class—verify membership before blaming only cache TTL. Operational check: confirm the Function OCID is a member of the dynamic group, wait for resource-principal refresh (or force a new execution environment after the cache window), re-invoke, and only then escalate to rewriting policy text.