A recreation-department Function should read only the Vault secret that holds the parks database password, not every secret in the compartment. How should the policy be tightened?

To let a recreation-department Function read only the Vault secret that holds the parks database password, tighten IAM with a where clause that names the specific secret—for example target.secret.id—or an equivalent target constraint, rather than granting compartment-wide manage on all secrets. The Function’s dynamic group still receives read (or the minimum verb required) on secret-family or secret-bundles, but evaluation succeeds only for that municipal secret OCID.

Granting manage all-resources in the compartment because narrower where clauses are supposedly unsupported is false and dangerous; where clauses are a standard least-privilege tool for secrets and many other targets. Granting inspect on instance-family and relying on network path filtering for secret isolation confuses Compute inspect rights and network reachability with Secrets authorization—network path alone does not enforce which secret bundle can be read. Moving the Function to a public subnet so IAM where clauses are no longer evaluated is incorrect: subnet publicity does not disable IAM evaluation and worsens exposure.

Exam caveat: using target.secret.name versus target.secret.id depends on supported policy variables for the resource; prefer the documented variable for secrets and test denies on a second secret. Operational check: grant the scoped where clause, confirm the parks password retrieval succeeds, attempt retrieval of a different secret in the same compartment, and confirm authorization fails.