URDATA_lz_one-oe_iam_v5.auto.tfvars.json

{
    "compartments_configuration": {
        "enable_delete": "true",
        "compartments": {
            "CMP-LANDINGZONE-P-KEY": {
                "name": "cmp-landingzone",
                "description": "URDATA Enclosing Production Landing Zone Compartment",
                "children": {
                    "CMP-LZP-NETWORK-KEY": {
                        "name": "cmp-lzp-network",
                        "description": "URDATA Shared Network Compartment"
                    },
                    "CMP-LZP-SECURITY-KEY": {
                        "name": "cmp-lzp-security",
                        "description": "URDATA Shared Security Compartment"
                    },
                    "CMP-LZP-PLATFORM-KEY": {
                        "name": "cmp-lzp-platform",
                        "description": "URDATA Shared Platform Compartment"
                    },
                    "CMP-LZP-PROD-KEY": {
                        "name": "cmp-lzp-prod",
                        "description": "URDATA Prod Environment Compartment",
                    "children": {
                        "CMP-LZP-P-NETWORK-KEY": {
                            "name": "cmp-lzp-p-network",
                            "description": "URDATA preprod Network Compartment"
                        },
                        "CMP-LZP-P-PLATFORM-KEY": {
                            "name": "cmp-lzp-p-platform",
                            "description": "URDATA prod platform Compartment"
                        },
                        "CMP-LZP-P-PROJECT-KEY": {
                            "name": "cmp-lzp-p-project",
                            "description": "URDATA prod projects Compartment",
                            "children": {
                                "CMP-LZP-P-DWH-KEY": {
                                    "name": "cmp-lzp-p-dwh",
                                    "description": "URDATA prod projects, DWH compartment"
                                }
                            }
                        }
                    }
                    },
                    "CMP-LZP-PREPROD-KEY": {
                        "name": "cmp-lzp-preprod",
                        "description": "URDATA Preprod Environment Compartment",
                    "children": {
                        "CMP-LZP-PP-NETWORK-KEY": {
                            "name": "cmp-lzp-pp-network",
                            "description": "URDATA preprod Network Compartment"
                        },
                        "CMP-LZP-PP-PLATFORM-KEY": {
                            "name": "cmp-lzp-pp-platform",
                            "description": "URDATA preprod platform Compartment"
                        },
                        "CMP-LZP-PP-PROJECT-KEY": {
                            "name": "cmp-lzp-pp-project",
                            "description": "URDATA preprod projects Compartment",
                            "children": {
                                "CMP-LZP-PP-DWH-KEY": {
                                    "name": "cmp-lzp-pp-dwh",
                                    "description": "URDATA preprod projects, DWH compartment"
                                }
                            }
                        }
                    }
                    },
                    "CMP-LZP-DEV-KEY": {
                        "name": "cmp-lzp-dev",
                        "description": "URDATA Dev Environment Compartment",
                        "children": {
                            "CMP-LZP-D-NETWORK-KEY": {
                                "name": "cmp-lzp-d-network",
                                "description": "URDATA dev Network Compartment"
                            },
                            "CMP-LZP-D-PLATFORM-KEY": {
                                "name": "cmp-lzp-d-platform",
                                "description": "URDATA dev platform Compartment"
                            },
                            "CMP-LZP-D-PROJECT-KEY": {
                                "name": "cmp-lzp-d-project",
                                "description": "URDATA dev projects Compartment",
                                "children": {
                                    "CMP-LZP-D-DWH-KEY": {
                                        "name": "cmp-lzp-d-dwh",
                                        "description": "URDATA dev projects, DWH compartment"
                                    }
                                }
    
                            }
                        }
                    },
                    "CMP-LZP-SANDBOX-KEY": {
                        "name": "cmp-lzp-sandbox",
                        "description": "URDATA Sandbox Environment Compartment",
                        "children": {
                            "CMP-LZP-S-NETWORK-KEY": {
                                "name": "cmp-lzp-s-network",
                                "description": "URDATA sandbox Network Compartment"
                            },
                            "CMP-LZP-S-PLATFORM-KEY": {
                                "name": "cmp-lzp-s-platform",
                                "description": "URDATA sandbox platform Compartment"
                            },
                            "CMP-LZP-S-PROJECT-KEY": {
                                "name": "cmp-lzp-s-project",
                                "description": "URDATA sandbox projects Compartment",
                                "children": {
                                    "CMP-LZP-S-DWH-KEY": {
                                        "name": "cmp-lzp-s-dwh",
                                        "description": "URDATA sandbox projects, DWH compartment"
                                    }
                                }
    
                            }
                        }
                    }
                }
            }
        }
    },
    "groups_configuration": {
        "groups": {
            "GRP-IAM-ADMINS": {
                "name": "group-iam-admins",
                "description": "Group Tenancy global Identity and access management administrator."
            },
            "GRP-CREDENTIAL-ADMINS": {
                "name": "group-credential-admins",
                "description": "Group Tenancy global credential administrator."
            },
            "GRP-ANNOUNCEMENT-READERS": {
                "name": "group-announcement-readers",
                "description": "Group Tenancy global readers of OCI monitoring information."
            },
            "GRP-BUDGET-ADMINS": {
                "name": "group-budget-admins",
                "description": "Group Tenancy global budget control."
            },
            "GRP-AUDITORS": {
                "name": "group-auditors",
                "description": "Group Tenancy global read access (for security auditing or health checks)."
            },
            "GRP-NETWORK-ADMINS": {
                "name": "group-network-admins",
                "description": "Group Tenancy global and shared network administration group, including common LZ network elements."
            },
            "GRP-SECURITY-ADMINS": {
                "name": "group-security-admins",
                "description": "Group Tenancy global and shared security administration group."
            },
            "GRP-LZP-P-DWH-ADMINS": {
                "name": "group-lzp-p-dwh-admins",  
                "description": "Group responsible for administrating PROD/DWH related applications."
            },
            "GRP-LZP-PP-DWH-ADMINS": {
                "name": "group-lzp-pp-dwh-admins",  
                "description": "Group responsible for administrating PREPROD/DWH related applications."
            },
            "GRP-LZP-D-DWH-ADMINS": {
                "name": "group-lzp-d-dwh-admins",  
                "description": "Group responsible for administrating DEV/DWH related applications."
            },
            "GRP-LZP-S-DWH-ADMINS": {
                "name": "group-lzp-s-dwh-admins",  
                "description": "Group responsible for administrating SANDBOX/DWH related applications."
            }
        }
    },
    "policies_configuration": {
        "enable_cis_benchmark_checks": "false",
        "supplied_policies": {
            "policy-SERVICES": {
                "name": "policy-services",
                "description": "POL.00 Open LZ policy for all supported resources in the tenancy.",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "allow service cloudguard to manage cloudevents-rules in tenancy where target.rule.type='managed'",
                    "allow service cloudguard to read tenancies in tenancy",
                    "allow service cloudguard to read all-resources in tenancy",
                    "allow service cloudguard to use network-security-groups in tenancy",
                    "Allow any-user to { WLP_BOM_READ } in tenancy where all { request.principal.id = target.agent.id, request.principal.type = 'workloadprotectionagent'}",
                    "Allow any-user to { WLP_CONFIG_READ } in tenancy where all { request.principal.id = target.agent.id, request.principal.type = 'workloadprotectionagent'}",
                    "Endorse any-user to { WLP_LOG_CREATE } in any-tenancy where all { request.principal.id = target.agent.id, request.principal.type = 'workloadprotectionagent' }",
                    "Endorse any-user to { WLP_METRICS_CREATE } in any-tenancy where all { request.principal.id = target.agent.id, request.principal.type = 'workloadprotectionagent' }",
                    "Endorse any-user to { WLP_ADHOC_QUERY_READ } in any-tenancy where all { request.principal.id = target.agent.id, request.principal.type = 'workloadprotectionagent' }",
                    "Endorse any-user to { WLP_ADHOC_RESULTS_CREATE } in any-tenancy where all { request.principal.id = target.agent.id, request.principal.type = 'workloadprotectionagent'}",
                    "allow service vulnerability-scanning-service to manage instances in tenancy",
                    "allow service vulnerability-scanning-service to read compartments in tenancy",
                    "allow service vulnerability-scanning-service to read repos in tenancy",
                    "allow service vulnerability-scanning-service to read vnics in tenancy",
                    "allow service vulnerability-scanning-service to read vnic-attachments in tenancy",
                    "allow service osms to read instances in tenancy",
                    "allow service blockstorage, oke, streaming, Fssoc1Prod, objectstorage-eu-frankfurt-1 to use keys in tenancy"
                ]
            },
            "policy-IAM-ADMINISTRATION": {
                "name": "policy-iam-administration",
                "description": "POL.01 Open LZ allows group-iam-admins group users to manage IAM resoures in the tenancy.",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "allow group group-iam-admins to inspect users in tenancy",
                    "allow group group-iam-admins to manage users in tenancy where all {request.operation != 'ListApiKeys',request.operation != 'ListAuthTokens',request.operation != 'ListCustomerSecretKeys',request.operation != 'UploadApiKey',request.operation != 'DeleteApiKey',request.operation != 'UpdateAuthToken',request.operation != 'CreateAuthToken',request.operation != 'DeleteAuthToken',request.operation != 'CreateSecretKey',request.operation != 'UpdateCustomerSecretKey',request.operation != 'DeleteCustomerSecretKey'}",
                    "allow group group-iam-admins to inspect groups in tenancy",
                    "allow group group-iam-admins to read policies in tenancy",
                    "allow group group-iam-admins to manage groups in tenancy where all {target.group.name != 'Administrators',target.group.name != 'group-credential-admins'}",
                    "allow group group-iam-admins to inspect identity-providers in tenancy",
                    "allow group group-iam-admins to manage identity-providers in tenancy where any {request.operation = 'AddIdpGroupMapping', request.operation = 'DeleteIdpGroupMapping'}",
                    "allow group group-iam-admins to manage dynamic-groups in tenancy",
                    "allow group group-iam-admins to manage authentication-policies in tenancy",
                    "allow group group-iam-admins to manage network-sources in tenancy",
                    "allow group group-iam-admins to manage quota in tenancy",
                    "allow group group-iam-admins to use cloud-shell in tenancy",
                    "allow group group-iam-admins to manage tag-defaults in tenancy",
                    "allow group group-iam-admins to manage tag-namespaces in tenancy",
                    "allow group group-iam-admins to manage orm-jobs in tenancy",
                    "allow group group-iam-admins to manage orm-config-source-providers in tenancy"
                ]
            },
            "policy-CREDENTIAL-ADMINISTRATION": {
                "name": "policy-credential-administration",
                "description": "POL.02 Open LZ policy which allows group-credential-admins group users to manage user credentials of local users in the tenancy .",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "allow group group-credential-admins to inspect users in tenancy",
                    "allow group group-credential-admins to inspect groups in tenancy",
                    "allow group group-credential-admins to manage users in tenancy where any {request.operation = 'ListApiKeys',request.operation = 'ListAuthTokens',request.operation = 'ListCustomerSecretKeys',request.operation = 'UploadApiKey',request.operation = 'DeleteApiKey',request.operation = 'UpdateAuthToken',request.operation = 'CreateAuthToken',request.operation = 'DeleteAuthToken',request.operation = 'CreateSecretKey',request.operation = 'UpdateCustomerSecretKey',request.operation = 'DeleteCustomerSecretKey',request.operation = 'UpdateUserCapabilities'}",
                    "allow group group-credential-admins to use cloud-shell in tenancy"
                ]
            },
            "policy-ANNOUNCEMENT-READERS": {
                "name": "policy-announcement-readers",
                "description": "POL.03 Open LZ policy which allows group-announcement-readers group users to read OCI announcements in the tenancy.",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "allow group group-announcement-readers to read announcements in tenancy",
                    "allow group group-announcement-readers to use cloud-shell in tenancy"
                ]
            },
            "policy-BUDGET-ADMINISTRATION": {
                "name": "policy-budget-administration",
                "description": "POL.04 Open LZ policy which allows group-budget-admins group users to manage all budget resources in the tenancy.",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "define tenancy usage-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq",
                    "endorse group group-budget-admins to read objects in tenancy usage-report",
                    "allow group group-budget-admins to manage usage-report in tenancy",
                    "allow group group-budget-admins to manage usage-budgets in tenancy"
                ]
            },
            "policy-AUDITING": {
                "name": "policy-auditing",
                "description": "POL.05 Open LZ policy which allows group-auditors group users to read all the resources in the tenancy.",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "allow group group-auditors to inspect all-resources in tenancy",
                    "allow group group-auditors to read instances in tenancy",
                    "allow group group-auditors to read load-balancers in tenancy",
                    "allow group group-auditors to read buckets in tenancy",
                    "allow group group-auditors to read nat-gateways in tenancy",
                    "allow group group-auditors to read public-ips in tenancy",
                    "allow group group-auditors to read file-family in tenancy",
                    "allow group group-auditors to read instance-configurations in tenancy",
                    "allow group group-auditors to read network-security-groups in tenancy",
                    "allow group group-auditors to read resource-availability in tenancy",
                    "allow group group-auditors to read audit-events in tenancy",
                    "allow group group-auditors to read users in tenancy",
                    "allow group group-auditors to use cloud-shell in tenancy",
                    "allow group group-auditors to read vss-family in tenancy",
                    "allow group group-auditors to read usage-budgets in tenancy",
                    "allow group group-auditors to read usage-reports in tenancy",
                    "allow group group-auditors to read data-safe-family in tenancy"
                ]
            },
            "policy-NETWORK-ADMINISTRATION": {
                "name": "policy-network-administration",
                "description": "POL.06 Open LZ policy which allows group-network-admins group users to manage all network resources in the compartment.",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "allow group group-network-admins to use cloud-shell in tenancy",
                    "allow group group-network-admins to read usage-budgets in tenancy",
                    "allow group group-network-admins to read usage-reports in tenancy",
                    "allow group group-network-admins to read objectstorage-namespaces in tenancy",
                    "allow group group-network-admins to read all-resources in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage virtual-network-family in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage dns in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage load-balancers in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage alarms in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage metrics in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage ons-family in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage orm-stacks in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage orm-jobs in compartment cmp-landingzone:cmp-lzp-network",
                    "allow group group-network-admins to manage orm-config-source-providers in compartment cmp-landingzone:cmp-lzp-network"
                ]
            },
            "policy-NETWORK-ENV-ADMINISTRATION": {
                "name": "policy-network-env-administration",
                "description": "POL.06 Open LZ policy which allows group-network-admins group users to manage all network environment resources in the compartment.",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "allow group group-network-admins to read all-resources in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage virtual-network-family in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage dns in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage load-balancers in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage alarms in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage metrics in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage ons-family in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage orm-stacks in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage orm-jobs in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to manage orm-config-source-providers in compartment cmp-landingzone:cmp-lzp-prod:cmp-lzp-p-network",
                    "allow group group-network-admins to read all-resources in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage virtual-network-family in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage dns in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage load-balancers in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage alarms in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage metrics in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage ons-family in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage orm-stacks in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage orm-jobs in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to manage orm-config-source-providers in compartment cmp-landingzone:cmp-lzp-preprod:cmp-lzp-pp-network",
                    "allow group group-network-admins to read all-resources in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage virtual-network-family in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage dns in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage load-balancers in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage alarms in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage metrics in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage ons-family in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage orm-stacks in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage orm-jobs in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to manage orm-config-source-providers in compartment cmp-landingzone:cmp-lzp-dev:cmp-lzp-d-network",
                    "allow group group-network-admins to read all-resources in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage virtual-network-family in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage dns in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage load-balancers in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage alarms in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage metrics in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage ons-family in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage orm-stacks in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage orm-jobs in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network",
                    "allow group group-network-admins to manage orm-config-source-providers in compartment cmp-landingzone:cmp-lzp-sandbox:cmp-lzp-s-network"
                ]
            },
            "policy-SECURITY-ADMINISTRATION": {
                "name": "policy-security-administration",
                "description": "POL.07 Open LZ policy which allows group-security-admins group users to manage all security resources in the security compartment.",
                "compartment_id": "TENANCY-ROOT",
                "statements": [
                    "allow group group-security-admins to use cloud-shell in tenancy",
                    "allow group group-security-admins to read usage-budgets in tenancy",
                    "allow group group-security-admins to read usage-reports in tenancy",
                    "allow group group-security-admins to read objectstorage-namespaces in tenancy",
                    "allow group group-security-admins to manage cloudevents-rules in tenancy",
                    "allow group group-security-admins to manage cloud-guard-family in tenancy",
                    "allow group group-security-admins to read tenancies in tenancy",
                    "allow group group-security-admins to manage tag-namespaces in tenancy",
                    "allow group group-security-admins to manage tag-defaults in tenancy",
                    "allow group group-security-admins to manage repos in tenancy",
                    "allow group group-security-admins to read audit-events in tenancy",
                    "allow group group-security-admins to read app-catalog-listing in tenancy",
                    "allow group group-security-admins to read instance-images in tenancy",
                    "allow group group-security-admins to inspect buckets in tenancy",
                    "allow group group-security-admins to read all-resources in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage instance-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage volume-family in compartment cmp-landingzone:cmp-lzp-security where all{request.permission != 'VOLUME_BACKUP_DELETE', request.permission != 'VOLUME_DELETE', request.permission != 'BOOT_VOLUME_BACKUP_DELETE'}",
                    "allow group group-security-admins to manage object-family in compartment cmp-landingzone:cmp-lzp-security where all{request.permission != 'OBJECT_DELETE', request.permission != 'BUCKET_DELETE'}",
                    "allow group group-security-admins to manage file-family in compartment cmp-landingzone:cmp-lzp-security where all{request.permission != 'FILE_SYSTEM_DELETE', request.permission != 'MOUNT_TARGET_DELETE', request.permission != 'EXPORT_SET_DELETE', request.permission != 'FILE_SYSTEM_DELETE_SNAPSHOT', request.permission != 'FILE_SYSTEM_NFSv3_UNEXPORT'}",
                    "allow group group-security-admins to manage vaults in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage keys in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage secret-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage logging-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage serviceconnectors in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage streams in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage ons-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage functions-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage waas-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage security-zone in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage orm-stacks in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage orm-jobs in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage orm-config-source-providers in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage vss-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to read work-requests in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage bastion-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to read instance-agent-plugins in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage cloudevents-rules in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage alarms in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage metrics in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to use key-delegate in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to read virtual-network-family in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to use subnets in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to use network-security-groups in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to use vnics in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to manage private-ips in compartment cmp-landingzone:cmp-lzp-security",
                    "allow group group-security-admins to read keys in compartment cmp-landingzone:cmp-lzp-security"
                ]
            },
            "policy-LZP-P-DWH-ADMINISTRATORS-POLICY": {
                "name": "policy-lzp-p-dwh-administration",
                "description": "Open LZ policy which allows the grp-lzp-p-dwh-admins group users to manage applications in the PROD/PROJ/DWH  compartment.",
                "compartment_id": "CMP-LZP-PROD-KEY",
                "statements": [
                    "allow group grp-lzp-p-dwh-admins to use cloud-shell in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to read all-resources in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to use network-security-groups in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage functions-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage api-gateway-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage ons-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage streams in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage cluster-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage alarms in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage metrics in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage logging-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage instance-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage volume-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh where all{request.permission != 'VOLUME_BACKUP_DELETE', request.permission != 'VOLUME_DELETE', request.permission != 'BOOT_VOLUME_BACKUP_DELETE'}",
                    "allow group grp-lzp-p-dwh-admins to manage object-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh where all{request.permission != 'OBJECT_DELETE', request.permission != 'BUCKET_DELETE'}",
                    "allow group grp-lzp-p-dwh-admins to manage file-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh where all{request.permission != 'FILE_SYSTEM_DELETE', request.permission != 'MOUNT_TARGET_DELETE', request.permission != 'EXPORT_SET_DELETE', request.permission != 'FILE_SYSTEM_DELETE_SNAPSHOT', request.permission != 'FILE_SYSTEM_NFSv3_UNEXPORT'}",
                    "allow group grp-lzp-p-dwh-admins to manage repos in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage orm-stacks in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage orm-jobs in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage orm-config-source-providers in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to read audit-events in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to read work-requests in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage bastion-session in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage cloudevents-rules in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to read instance-agent-plugins in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage keys in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to use key-delegate in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage secret-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to read repos in compartment cmp-lzp-p-project",
                    "allow group grp-lzp-p-dwh-admins to manage database-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage autonomous-database-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to manage data-safe-family in compartment cmp-lzp-p-project:cmp-lzp-p-dwh",
                    "allow group grp-lzp-p-dwh-admins to use vnics in compartment cmp-lzp-p-project:cmp-lzp-p-dwh"
                ]
            },
            "policy-LZP-PP-DWH-ADMINISTRATORS-POLICY": {
                "name": "policy-lzp-pp-dwh-administration",
                "description": "Open LZ policy which allows the grp-lzp-pp-dwh-admins group users to manage applications in the PREPROD/PROJ/DWH  compartment.",
                "compartment_id": "CMP-LZP-PREPROD-KEY",
                "statements": [
                    "allow group grp-lzp-pp-dwh-admins to use cloud-shell in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to read all-resources in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to use network-security-groups in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage functions-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage api-gateway-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage ons-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage streams in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage cluster-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage alarms in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage metrics in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage logging-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage instance-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage volume-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh where all{request.permission != 'VOLUME_BACKUP_DELETE', request.permission != 'VOLUME_DELETE', request.permission != 'BOOT_VOLUME_BACKUP_DELETE'}",
                    "allow group grp-lzp-pp-dwh-admins to manage object-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh where all{request.permission != 'OBJECT_DELETE', request.permission != 'BUCKET_DELETE'}",
                    "allow group grp-lzp-pp-dwh-admins to manage file-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh where all{request.permission != 'FILE_SYSTEM_DELETE', request.permission != 'MOUNT_TARGET_DELETE', request.permission != 'EXPORT_SET_DELETE', request.permission != 'FILE_SYSTEM_DELETE_SNAPSHOT', request.permission != 'FILE_SYSTEM_NFSv3_UNEXPORT'}",
                    "allow group grp-lzp-pp-dwh-admins to manage repos in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage orm-stacks in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage orm-jobs in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage orm-config-source-providers in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to read audit-events in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to read work-requests in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage bastion-session in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage cloudevents-rules in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to read instance-agent-plugins in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage keys in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to use key-delegate in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage secret-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to read repos in compartment cmp-lzp-pp-project",
                    "allow group grp-lzp-pp-dwh-admins to manage database-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage autonomous-database-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to manage data-safe-family in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh",
                    "allow group grp-lzp-pp-dwh-admins to use vnics in compartment cmp-lzp-pp-project:cmp-lzp-pp-dwh"
                ]
            },
            "policy-LZP-D-DWH-ADMINISTRATORS-POLICY": {
                "name": "policy-lzp-d-dwh-administration",
                "description": "Open LZ policy which allows the grp-lzp-d-dwh-admins group users to manage applications in the DEV/PROJ/DWH  compartment.",
                "compartment_id": "CMP-LZP-DEV-KEY",
                "statements": [
                    "allow group grp-lzp-d-dwh-admins to use cloud-shell in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to read all-resources in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to use network-security-groups in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage functions-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage api-gateway-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage ons-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage streams in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage cluster-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage alarms in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage metrics in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage logging-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage instance-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage volume-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh where all{request.permission != 'VOLUME_BACKUP_DELETE', request.permission != 'VOLUME_DELETE', request.permission != 'BOOT_VOLUME_BACKUP_DELETE'}",
                    "allow group grp-lzp-d-dwh-admins to manage object-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh where all{request.permission != 'OBJECT_DELETE', request.permission != 'BUCKET_DELETE'}",
                    "allow group grp-lzp-d-dwh-admins to manage file-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh where all{request.permission != 'FILE_SYSTEM_DELETE', request.permission != 'MOUNT_TARGET_DELETE', request.permission != 'EXPORT_SET_DELETE', request.permission != 'FILE_SYSTEM_DELETE_SNAPSHOT', request.permission != 'FILE_SYSTEM_NFSv3_UNEXPORT'}",
                    "allow group grp-lzp-d-dwh-admins to manage repos in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage orm-stacks in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage orm-jobs in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage orm-config-source-providers in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to read audit-events in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to read work-requests in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage bastion-session in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage cloudevents-rules in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to read instance-agent-plugins in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage keys in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to use key-delegate in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage secret-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to read repos in compartment cmp-lzp-d-project",
                    "allow group grp-lzp-d-dwh-admins to manage database-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage autonomous-database-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to manage data-safe-family in compartment cmp-lzp-d-project:cmp-lzp-d-dwh",
                    "allow group grp-lzp-d-dwh-admins to use vnics in compartment cmp-lzp-d-project:cmp-lzp-d-dwh"
                ]
            },
            "policy-LZP-S-DWH-ADMINISTRATORS-POLICY": {
                "name": "policy-lzp-s-dwh-administration",
                "description": "Open LZ policy which allows the grp-lzp-s-dwh-admins group users to manage applications in the SANDBOX/PROJ/DWH  compartment.",
                "compartment_id": "CMP-LZP-SANDBOX-KEY",
                "statements": [
                    "allow group grp-lzp-s-dwh-admins to use cloud-shell in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to read all-resources in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to use network-security-groups in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage functions-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage api-gateway-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage ons-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage streams in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage cluster-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage alarms in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage metrics in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage logging-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage instance-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage volume-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh where all{request.permission != 'VOLUME_BACKUP_DELETE', request.permission != 'VOLUME_DELETE', request.permission != 'BOOT_VOLUME_BACKUP_DELETE'}",
                    "allow group grp-lzp-s-dwh-admins to manage object-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh where all{request.permission != 'OBJECT_DELETE', request.permission != 'BUCKET_DELETE'}",
                    "allow group grp-lzp-s-dwh-admins to manage file-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh where all{request.permission != 'FILE_SYSTEM_DELETE', request.permission != 'MOUNT_TARGET_DELETE', request.permission != 'EXPORT_SET_DELETE', request.permission != 'FILE_SYSTEM_DELETE_SNAPSHOT', request.permission != 'FILE_SYSTEM_NFSv3_UNEXPORT'}",
                    "allow group grp-lzp-s-dwh-admins to manage repos in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage orm-stacks in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage orm-jobs in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage orm-config-source-providers in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to read audit-events in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to read work-requests in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage bastion-session in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage cloudevents-rules in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to read instance-agent-plugins in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage keys in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to use key-delegate in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage secret-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to read repos in compartment cmp-lzp-s-project",
                    "allow group grp-lzp-s-dwh-admins to manage database-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage autonomous-database-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to manage data-safe-family in compartment cmp-lzp-s-project:cmp-lzp-s-dwh",
                    "allow group grp-lzp-s-dwh-admins to use vnics in compartment cmp-lzp-s-project:cmp-lzp-s-dwh"
                ]
            }
        }
    }
}