A recreation-department Function should read only the Vault secret…

Question

A recreation-department Function should read only the Vault secret that holds the parks database password, not every secret in the compartment. How should the policy be tightened?

Accepted Answer

Add a where clause that names the specific secret (for example target.secret.id) or equivalent target constraint instead of compartment-wide manage — A where clause is a label on the exact cabinet—this secret id or that bucket name—so the Function cannot browse every credential on the floor.

Answer

Grant manage all-resources in the compartment because narrower where clauses are unsupported for secrets

Answer

Grant inspect instance-family only and rely on network path filtering for secret isolation

Answer

Move the Function to a public subnet so IAM where clauses are no longer evaluated

A recreation-department Function should read only the Vault secret that holds the parks database password, not every secret in the compartment. How should the policy be tightened?

Short Explanation

Full Explanation