Guide
Connect Oracle Cloud
About 10 minutes, in the OCI console, as a tenancy administrator. VizTopo reads instances, VCNs, subnets, security lists, network security groups and block and boot volumes, in every compartment the user may see and every region the tenancy uses. It signs each request with an API key of a user whose group's policy only reads. You give VizTopo the private key once: it's stored encrypted on the server and never sent back to your browser.
1. A group whose policy only reads
Identity & Security → Domains → your domain (usually Default) → User management → Groups → Create group, named VizTopo.
Identity & Security → Policies, in the root compartment: Create policy, named VizTopo. Turn on Show manual editor and paste these statements:
Allow group VizTopo to inspect compartments in tenancy Allow group VizTopo to inspect tenancies in tenancy Allow group VizTopo to read instance-family in tenancy Allow group VizTopo to read virtual-network-family in tenancy Allow group VizTopo to read volume-family in tenancy Allow group VizTopo to use network-security-groups in tenancy where request.permission = 'NETWORK_SECURITY_GROUP_LIST_SECURITY_RULES'
The last statement lets VizTopo read network security groups' rules (which ports are open) and nothing else: OCI counts listing them as "use". To read only one compartment, write in compartment id <its OCID> instead of in tenancy in the three read lines, and give the same OCID in VizTopo.
2. A user for VizTopo, and its API key
In the same domain, Users → Create user (for example viztopo), and add it to the VizTopo group. It only signs requests with its API key: it needs no console password.
Open the user, then API keys → Add API key → Generate API key pair → Download private key → Add. OCI shows a configuration file preview: copy it.
3. Add the connection
In VizTopo: Connections → Add connection → Oracle Cloud. Paste the configuration file preview (it fills in the tenancy and user OCIDs, the fingerprint and the home region), and load or paste the private key. Test connection signs a few read-only requests and tries each listing; nothing is saved until you choose Save connection.
VizTopo reads every region the tenancy is subscribed to, starting from the home region. A user can have three API keys, so a new key can be added before the old one is deleted (Rotate secret, in VizTopo).
4. Optional: start, stop and reboot instances
VizTopo can start a stopped instance, stop a running one and reboot it, with write mode on for the connection and your rules allowing it. It always uses OCI's graceful actions (SOFTSTOP and SOFTRESET: the operating system is asked to shut down first) and never terminates an instance. Add one statement to the same policy, which allows the power actions and nothing else:
Allow group VizTopo to use instances in tenancy where request.permission = 'INSTANCE_POWER_ACTIONS'
Questions
Why an API key?
viztopo.com signs in from outside your tenancy, so it needs a credential of its own. The key's user is in a group whose policy only reads, VizTopo only ever sends signatures (never the key) to Oracle, and you can delete the API key in OCI at any time.
Does VizTopo keep the private key?
Yes, encrypted with AES-256-GCM on the server, so it can keep reading. It's never sent back to your browser and never logged. Remove the connection, or delete the API key in OCI, to stop it.
Can VizTopo terminate my instances?
No. The read policy only reads, and the optional power statement only allows start, stop and reboot. VizTopo has no terminate action.
Updated