Which Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) policy is invalid?

In Oracle Cloud Infrastructure (OCI), Identity and Access Management (IAM) policies are used to control access to resources. The policy in option C is invalid because "any-user" is not a valid principal in OCI IAM policies. OCI policies can only grant permissions to groups or dynamic groups, but not to arbitrary users.

Here’s an explanation for each option:

A. Allow dynamic-group 'Default'/'FrontEnd' to manage instance-family in compartment Project-A: This is valid. It grants the dynamic group 'FrontEnd' the ability to manage instances within the Project-A compartment.

B. Allow group 'Default'/'A-Admins' to manage all-resources in compartment Project-A: This is valid. It provides full administrative access to all resources in the Project-A compartment for the 'A-Admins' group.

C. Allow any-user to inspect users in tenancy: This is invalid because OCI does not allow the use of "any-user" in policies. You must specify a valid group or dynamic group to define permissions.

D. Allow group 'Default'/'A-Developers' to create volumes in compartment Project-A: This is valid. It permits the 'A-Developers' group to create volumes in the Project-A compartment.

For reference:

OCI Policy Reference

=================