OCI Object Storage: Copy Objects Across Tenancies Within a Region

Note: My original blog was published in ORACLE CLOUD INFRASTRUCTURE blog site on April 15th, 2019. I have republished it here with permission.

Official Disclaimer: The views and opinions expressed in this blog are those of the author and do not necessarily reflect the official policy or position of Oracle Corporation.
This post was developed jointly with Mohamad Charaf, Oracle Enterprise Cloud Architect.

If you have two tenancies in the same region, and you want to copy data that is stored in Object Storage from one tenancy to the other without making the buckets public, this action requires some additional types of identity and access management (IAM) policies.
This blog post walks you through how to create these policies. For this example, the source tenancy is named ACMEBMCS and the destination tenancy is named ACMEOCISA. In ACMEBMCS, the Object Storage buckets are in the benchmark compartment. In ACMEOCISA, the target compartment is oracleexa.
The following activities are required to enable copying across tenancies:
  1. Object Storage needs permission to access the source and the destination buckets.
  2. Both the source and destination tenancies require IAM policies to permit the copy. The tenancy that is the destination for the copy must have a policy with at least the following permissions:
    define tenancy CopySourceTenancy as <OCID_for_source_tenancy>

define group CopySourceGroup as <OCID_for_group_in_source_tenancy>
admit group CopySourceGroup of tenancy CopySourceTenancy to {OBJECT_READ, OBJECT_CREATE, OBJECT_OVERWRITE, OBJECT_INSPECT, OBJECT_DELETE} in tenancy
  3. The source tenancy of the copy operation must have policies in place with at least the following permissions:
    define tenancy CopyDestinationTenancy as <OCID_for_destination_tenancy>

endorse group <group_name_in_source_tenancy> to {OBJECT_READ, OBJECT_CREATE, OBJECT_OVERWRITE, OBJECT_INSPECT, OBJECT_DELETE} in tenancy CopyDestinationTenancy
Using the console UI, the following policies were created for this example:

Source Tenancy Policy

Target Tenancy Policy

The instance principal from the destination tenancy initiates the copy process.
This example used object copy within the same region. If you're interested in cross-region copy, you can essentially use the same IAM policies and permissions. We've created a repository of guides especially for managing object storage with IAM polices using Terraform.

For additional background reading, review our foundational blog post on IAM best practices.

Comments

Post a Comment

Popular posts from this blog

Digital Selfhood

Image
  Copyright: Sanjay Basu I was thrilled to be busy supporting our incredible team as we celebrated yet another phenomenal and successful third quarter! #oraclecloudinfrastructure This is quite evident from the following —  https://investor.oracle.com/investor-news/news-details/2025/Oracle-Announces-Fiscal-2025-Third-Quarter-Financial-Results/default.aspx I was immersed in collaborating with our events, partner relations, product marketing, and cloud engineering teams to gear up for the highly anticipated NVIDIA GTC #nvidia #gtc conference this week. The innovations and insights set to be unveiled are going to be game-changing! I apologize for the delay in publishing my monthly philosophy newsletter. This month, I’ll be focusing on the philosophy of digital personhood, especially in light of recent advances in AI and the GTC conference. I was preparing this article for over a month. Now I am pretty happy to publish it. These are my Philosophical Musings in a Pixelated World . ...
Read more

Axiomatic Thinking

Image
  Copyright: Sanjay Basu Building Knowledge from First Principles Axiomatic thinking represents one of humanity’s most influential intellectual tools — a systematic approach to building knowledge that has revolutionized mathematics, computer science, physics, and beyond. At its core, axiomatic thinking is deceptively simple: start with a minimal set of self-evident truths (axioms), and derive everything else through rigorous logical deduction. This approach has enabled us to construct elaborate theoretical frameworks with absolute certainty, from Euclidean geometry to modern cryptography. For tech professionals, understanding axiomatic thinking offers more than academic curiosity — it provides a mental model for solving complex problems, designing robust systems, and reasoning about the digital world we inhabit. This article explores the foundations, applications, and limitations of axiomatic thinking, with concrete examples from mathematics and computer science that demonstrate it...
Read more

How MSPs Can Deliver IT-as-a-Service with Better Governance

Image
 Sanjay Basu As a solutions architect, I often support partners who deliver managed IT services to their end customers. Similarly, I work with large enterprises who manage IT for multiple business units. One of the most frequent requests I get is for best practices on how to align Oracle Cloud Infrastructure solutions and Identity and Access Management (IAM) policies with business-specific governance use cases. For enterprise customers, this means having better control over usage costs across multiple business units. For managed service providers (MSPs), this involves having better cost governance over the IT environments that they manage for end customers in their Oracle Cloud Infrastructure tenancy. This post is structured like a case study, in which an example enterprise customer, ACME CORP's Central IT team, faces the following business challenge: How do they enable their departmental IT stakeholders, and the operators within those departments, to have the aut...
Read more