Search code examples
cloudoracle-cloud-infrastructure

OCI - Unable to create policies for local VCN peering in different tenancies using LPG


I am trying to connect 2 VCNs from different tenancies using LPG and while creating the policies given in the official documentation, I face an error: unable to parse Define compartment acceptorComp as id ocid1.compartment.oc1..aaa and am unable to figure out why am I facing this issue or how do I go about solving this issue

I tried looking through the docs to try and understand the syntax properly but couldn't find anything related to defining compartments or anything that could help me.

The config I used for requestor:

Define tenancy Requestor as ocid1.tenancy.oc1..qqq
Define group requestorGrp as ocid1.group.oc1..www
Define compartment acceptorComp as id ocid1.compartment.oc1..aaa

Admit group requestorGrp of tenancy Requestor to manage local-peering-to in compartment acceptorComp
Admit group requestorGrp of tenancy Requestor to associate local-peering-gateways in tenancy Requestor with local-peering-gateways in compartment acceptorComp

I was facing the same issue in the acceptor policy as this line is shared.


Solution

  • I had the same issue and found this blog post by Oracle guys and it worked.

    Non-Identity Domain Tenancy Policy Template

    Policy Requestor (implemented by the requestor):

    Define tenancy Acceptor as <acceptor-tenancy-ocid>
    Allow group <requestor-group-name> to manage remote-peering-from in compartment <requestor-compartment-name>
    Endorse group <requestor-group-name> to manage remote-peering-to in tenancy Acceptor
    

    Policy Acceptor (implemented by the acceptor):

    Define tenancy Requestor as <requestor-tenancy-ocid>
    Define group <requestor-group-name> as <requestor-group-ocid>
    Admit group <requestor-group-name> of tenancy Requestor to manage remote-peering-to in compartment <acceptor-compartment-name>
    

    Source: Inter-Tenancy VCN peering using Remote Peering Connection