OCI

Set up Wiv's read-only integration with your Oracle Cloud Infrastructure tenancy using Cloud Shell.

Written By Dotan Cohen

Last updated About 2 months ago

WIV OCI Integration: Cloud Shell Setup Guide

This document outlines the steps to set up Wiv's read-only integration with your Oracle Cloud Infrastructure (OCI) tenancy using a Terraform script executed via OCI Cloud Shell.

Created resources

The Terraform configuration creates the following dedicated resources in your OCI tenancy for the Wiv platform:

  1. Service User: wiv-service

    Dedicated API-only user account. No console access. Contact email is stored for this user.

  2. Service Group: WivServiceGroup

    Contains the wiv-service user. Member of WivServicePolicy plus WivCostReportsEndorse.

  3. Policy: WivServicePolicy

    Grants read-only permissions to WivServiceGroup.

  4. Policy: WivCostReportsEndorse

    Cross-tenancy endorse statements so WivServiceGroup can read Objects in Oracle's billing tenancy. OCI Cost and Usage Reports (raw line-item CSV) live in Oracle-managed Object Storage, not inside your tenancy.

  5. API Key

    RSA key pair for secure API authentication. Public key is stored in OCI. Private key is exported to a credentials file.

  6. Tag Namespace: WivIntegration

    Used for tracking and identifying the integration resources.

Permissions granted to Wiv (all read-only)

The WivServicePolicy and WivCostReportsEndorse grant the WivServiceGroup read-only access as follows:

Resource Family

Verb/Access

Purpose

Cost & Billing

read usage-reports, read usage-budgets, inspect usage-reports

Cost optimization and aggregated usage via the Usage API (for example workflows using OCI Cost and Usage).

Cost Reports (billing bucket)

define tenancy usage-report as …; endorse group WivServiceGroup to read objects in tenancy usage-report

Download detailed line-item cost CSVs from Oracle's billing tenancy Object Storage (OCI Cost Reports step). Uses Oracle's fixed usage-report tenancy OCID; Terraform maps the alias usage-report for you.

Cloud Advisor

read optimizer-api-family

Read Cloud Advisor recommendations via the Optimizer API (OCI Cloud Advisor step).

Compute

inspect instance-family, inspect instance-images

Infrastructure inventory (instances, configurations, pools, images).

Storage

inspect volume-family, inspect object-family

Storage resources (volumes, boot volumes, backups, Object Storage buckets).

Database

inspect database-family, inspect autonomous-database-family

Database resources (DB Systems, DB Homes, Autonomous Databases).

Network

inspect virtual-network-family

Network topology (VCNs, subnets, load balancers).

Monitoring

read metrics

Performance data metrics.

Governance

inspect compartments, inspect tenancies

Organization structure (compartments, tenancy information).

Cloud Advisor: If Terraform or policy validation fails with an error similar to No permissions found for optimizer-api-family, Cloud Advisor may not be provisioned in your tenancy yet. In the OCI Console, open Billing & Cost Management → Cloud Advisor, complete any activation steps, then re-run terraform apply. Some Terraform bundles define an optional enable_cloud_advisor variable: when true, it creates WivCloudAdvisorPolicy with Allow group WivServiceGroup to read optimizer-api-family in tenancy. The default wiv-oci-setup configuration may attach the same read optimizer-api-family statement to WivServicePolicy instead or as well—check Identity → Policies after deploy.

Wiv security assurance: access limitations

Wiv's access is strictly limited to ensure the security of your environment and data.

What Wiv cannot do

  • No Mutating Operations: Wiv is prohibited from performing any write, modify, or delete operations on your resources. All permissions are strictly for inspection or reading.

  • No Sensitive Data Access: Wiv cannot read the contents of your tenancy storage buckets' object data for general workloads, database data, instance internals, or vault secrets by default policy. Inventory uses resource metadata only. Workflows that use OCI Cost and Usage Reports deliberately read billing line-item files that Oracle publishes in the shared billing Object Storage tenancy (not from your tenancy buckets)—that access is narrowly scoped by the WivCostReportsEndorse policy above.

Security controls and notes

  • Zero Write Permissions: Wiv cannot create, modify, or delete any resources.

  • Auditability: Every API call made by Wiv is logged in Governance → Audit. These logs can be filtered by Request Principal = wiv-service.

  • Revocation: Access can be immediately and easily revoked by deleting the wiv-service user.

  • Access Method: Access is exclusively via API keys; Wiv has no console access or password.

OCI Cloud Shell setup steps

Step 1: Open OCI

  1. Log into your OCI Console: https://cloud.oracle.com

  2. Click the Cloud Shell icon (terminal icon) in the top-right corner.

  3. Wait for the Cloud Shell to initialize (approximately 30 seconds).

Step 2: Download setup files

Run these commands in the Cloud Shell:

wget https://wiv-onboarding.s3.us-east-1.amazonaws.com/oci/wiv-oci-setup.zip unzip wiv-oci-setup.zip

Step 3: Run setup script

Run the setup script. It will automatically detect your Tenancy OCID and Region.

chmod +x setup.sh ./setup.sh

The script will prompt you for:

  • Your Company Name: Enter your company name.

  • Contact Email: Enter your email (this will be the email for the wiv-service user).

  • Environment: Press Enter for prod.

Confirm and deploy when prompted.

Step 4: Download credentials file

Once deployment is complete:

  1. Click the Cloud Shell menu (⋮) in the top-right.

  2. Select Download.

  3. Enter the filename: wiv-credentials-[YourCompany]-prod.json

  4. The file will download to your local computer.

Step 5: Upload the JSON file to Wiv OCI integration

Check that the resources were created successfully:

  • Identity → Users: Find wiv-service

  • Identity → Groups: Find WivServiceGroup

  • Identity → Policies: Find WivServicePolicy, WivCostReportsEndorse, and—if enabled—WivCloudAdvisorPolicy

Revoke access (if needed)

Access is immediately revoked upon user deletion.

Option 1: Via Terraform (recommended)

cd wiv-oci-setup/ terraform destroy

Option 2: Via OCI Console

  1. Navigate to Identity → Users.

  2. Select wiv-service.

  3. Click Delete.