OCI Object Storage: Copy Objects Across Tenancies Within a Region

Note: My original blog was published in ORACLE CLOUD INFRASTRUCTURE blog site on April 15th, 2019. I have republished it here with permission.

Official Disclaimer: The views and opinions expressed in this blog are those of the author and do not necessarily reflect the official policy or position of Oracle Corporation.

This post was developed jointly with Mohamad Charaf, Oracle Enterprise Cloud Architect.

If you have two tenancies in the same region, and you want to copy data that is stored in Object Storage from one tenancy to the other without making the buckets public, this action requires some additional types of identity and access management (IAM) policies.
This blog post walks you through how to create these policies. For this example, the source tenancy is named ACMEBMCS and the destination tenancy is named ACMEOCISA. In ACMEBMCS, the Object Storage buckets are in the benchmark compartment. In ACMEOCISA, the target compartment is oracleexa.
The following activities are required to enable copying across tenancies:
  1. Object Storage needs permission to access the source and the destination buckets.
  2. Both the source and destination tenancies require IAM policies to permit the copy. The tenancy that is the destination for the copy must have a policy with at least the following permissions:
    define tenancy CopySourceTenancy as <OCID_for_source_tenancy>
    define group CopySourceGroup as <OCID_for_group_in_source_tenancy>
    admit group CopySourceGroup of tenancy CopySourceTenancy to {OBJECT_READ, OBJECT_CREATE, OBJECT_OVERWRITE, OBJECT_INSPECT, OBJECT_DELETE} in tenancy
  3. The source tenancy of the copy operation must have policies in place with at least the following permissions:
    define tenancy CopyDestinationTenancy as <OCID_for_destination_tenancy>
    endorse group <group_name_in_source_tenancy> to {OBJECT_READ, OBJECT_CREATE, OBJECT_OVERWRITE, OBJECT_INSPECT, OBJECT_DELETE} in tenancy CopyDestinationTenancy
Using the console UI, the following policies were created for this example:

Source Tenancy Policy

Target Tenancy Policy

The instance principal from the destination tenancy initiates the copy process.
This example used object copy within the same region. If you're interested in cross-region copy, you can essentially use the same IAM policies and permissions. We've created a repository of guides especially for managing object storage with IAM polices using Terraform.

For additional background reading, review our foundational blog post on IAM best practices.


  1. Great blog.you put Good stuff.All the topics were explained briefly.so quickly understand for me.I am waiting for your next fantastic blog.Thanks for sharing.Any coures related details learn...
    Cloud Business Management Software Suite

  2. I found one successful example of this truth through this blog. I am going to use such information now. NEC Brisbane

  3. Excellent post. I really enjoy reading and also appreciate your work. This concept is a good way to enhance knowledge. Keep sharing this kind of articles, Thank you. Cyber Security IT Courses In Canada

  4. Nice info, I am very thankful to you for sharing this important knowledge. This information is helpful for everyone. Read more info about IT Solutions Auckland. So please always share this kind of information. Thanks.

  5. I admire this article for the well-researched content and excellent wording. Read more info about MSP Service. I got so involved in this material that I couldn’t stop reading. I am impressed with your work and skill. Thank you so much.

  6. Thank you for sharing such a useful article. I had a great time. This article was fantastic to read. Continue to publish more articles on
    Data Engineering Services 
    Data Analytics Solutions
    Data Modernization Solutions
    AI & ML Service Provider


Post a Comment

Popular posts from this blog

Access data anywhere using DataDistillr and your Oracle Cloud Credits

Guidance for Setting Up a Cloud Security Operations Center (cSOC)