Exam 1z0-1072-22 topic 1 question 43 discussion

confirmed via documentation C

Create a dynamic group. In the dynamic group definition, you provide the matching rules to specify which instances you want to allow to make API calls against services. Create a policy granting permissions to the dynamic group to access services in your tenancy (or compartment). A developer in your organization configures the application built using the Oracle Cloud Infrastructure SDK to authenticate using the instance principals provider. The developer deploys the application and the SDK to all the instances that belong to the dynamic group. The deployed SDK makes calls to Oracle Cloud Infrastructure APIs as allowed by the policy (without needing to configure API credentials). For each API call made by an instance, the Audit service logs the event, recording the OCID of the instance as the value of principalId in the event log. See Contents of an Audit Log Event for more information. Link : https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/callingservicesfrominstances.htm

Auth tokens are not necessary for instance principals to authenticate with APIs. Instance principals use the IAM service to authenticate with APIs, and the IAM service does not require auth tokens.