Skip to content

OCI Onboarding

This section describes how to connect Oracle Cloud Infrastructure to SailPoint Entro using an IAM user and read-only access policies.

Management → Accounts & Integrations → Add New Account (top right) → Oracle Cloud Infrastructure

Prerequisites

Before starting, ensure you have:

  • An OCI account with permissions to create IAM Users, Groups, and Policies.

  • The OCI home region name (e.g., us-ashburn-1).

  1. Create IAM User and Group

    1. Create User: In the OCI Console, navigate to Identity & Security → Domains → User Management. Create a user named entro-reader.

      1. First Name: entro

      2. Last Name: reader

      3. Uncheck the Use the email address as the username

      4. Username: entro-reader

      5. Click on Create

    1. Create Group: Navigate to Identity & Security → Domains → User Management. Create a group named entro-readers and add the entro-reader user to it.

  2. Configure IAM Policies

    Navigate to Identity & Security → Policies and create a new policy.

    1. Give name and description to the policy.

    2. Click on Show manual editor and paste the below statements.

      Allow group entro-readers to inspect compartments in tenancy
Allow group entro-readers to inspect users in tenancy
Allow group entro-readers to inspect keys in tenancy
Allow group entro-readers to inspect vaults in tenancy
Allow group entro-readers to read secret-family in tenancy
      • Note to enter the group name, created in step 2, at the right place in the statements.

  3. Generate API Signing Key

    1. Go to the User Management page and click on entro-reader user.

    2. Under API Keys → Add API Key.

    3. Choose Generate API Key Pair.

    4. Download Private Key: Save the .pem file securely. This is the only time it is available for download.

    5. Click Add. Copy the configuration preview values (Tenancy OCID, User OCID, Fingerprint, and Region).

  4. Connect to SailPoint Entro

    1. Navigate: Management → Accounts & Integrations → Add New Account (top right) → Oracle Cloud Infrastructure.

    2. Fill in the following fields:

      • Environment Nickname: A descriptive name (e.g., OCI-PROD).

      • Tenancy OCID: Your OCI Tenancy identifier.

      • User OCID: The OCID of the entro-reader user.

      • Domain OCID (Optional): The domain OCID where the user and group created on. Can be retrieved from the Domains inventory (Identity & Security → Domains).

      • Region: Your OCI home region.

      • API Key Fingerprint: The API Key fingerprint from step 3.

      • Private Key (PEM): Paste the full content of the downloaded .pem file or upload the file.

      • Worker Group (Connector): Select the appropriate Worker Group handling Vault scans.

    3. Click Create Account.