OCI IAM Admin Group Should Be Protected From Self-Modification

Allow group IAM-Admins to manage groups in tenancy
Allow group IAM-Admins to manage policies in tenancy
Allow group IAM-Admins to manage users in tenancy

oci setup config

TENANCY_OCID="<your_tenancy_ocid>"

ADMIN_GROUP_OCID=$(
  oci iam group list \
    --compartment-id "$TENANCY_OCID" \
    --all \
    --query "data[?name=='Administrators'].id | [0]" \
    --raw-output
)

echo "Administrators group OCID: $ADMIN_GROUP_OCID"

oci iam policy list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query 'data[].{id:id, name:name}' \
  --output table

POLICY_ID="<policy_ocid_here>"

oci iam policy get --policy-id "$POLICY_ID" \
  --query "data.{name:name, statements:statements}" \
  --output json

IAM_ADMINS_GROUP=$(
  oci iam group create \
    --name "iam-admins" \
    --description "Dedicated group to manage IAM (users, groups, policies) for the tenancy" \
    --query "data.id" \
    --raw-output
)

echo "iam-admins group OCID: $IAM_ADMINS_GROUP"

USER_OCID="<user_ocid_to_become_iam_admin>"

oci iam group add-user \
  --group-id "$IAM_ADMINS_GROUP" \
  --user-id "$USER_OCID"

oci iam policy create \
  --compartment-id "$TENANCY_OCID" \
  --name "iam-admins-policy" \
  --description "Policy granting IAM management rights to iam-admins group" \
  --statements '[
    "Allow group iam-admins to manage users in tenancy",
    "Allow group iam-admins to manage groups in tenancy",
    "Allow group iam-admins to manage policies in tenancy",
    "Allow group iam-admins to manage dynamic-groups in tenancy",
    "Allow group iam-admins to manage federation-providers in tenancy",
    "Allow group iam-admins to manage tag-namespaces in tenancy"
  ]'

POLICY_ID="<policy_ocid_with_admin_iam_perms>"

oci iam policy get --policy-id "$POLICY_ID" \
  --query "data.statements" \
  --output json > policy-statements.json

"Allow group Administrators to manage users in tenancy",
"Allow group Administrators to manage groups in tenancy",
"Allow group Administrators to manage policies in tenancy",
"Allow group Administrators to manage dynamic-groups in tenancy",
"Allow group Administrators to manage tag-namespaces in tenancy",
...

oci iam policy update \
  --policy-id "$POLICY_ID" \
  --statements file://policy-statements.json

oci iam policy list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[*].{name:name, id:id, statements:statements}" \
  --output json > all-policies.json

grep -n '"Allow group Administrators to manage ' all-policies.json || echo "No self-modifying IAM policy found for Administrators."

Allow group Administrators to manage all-resources in tenancy
Allow group Administrators to manage groups in tenancy
Allow group Administrators to manage users in tenancy
Allow group Administrators to manage policies in tenancy

-- Give Admin group general admin, but NOT IAM:
Allow group Administrators to manage all-resources in tenancy
    where target.service.name != 'identity'

-- Give IAM-Security-Admins full IAM control:
Allow group IAM-Security-Admins to manage identity-domains in tenancy
Allow group IAM-Security-Admins to manage users in tenancy
Allow group IAM-Security-Admins to manage groups in tenancy
Allow group IAM-Security-Admins to manage policies in tenancy

Allow group Administrators to manage groups in tenancy
    where target.group.name != 'Administrators'

import oci
import re

# ---------------- CONFIG ----------------
PROFILE_NAME = "DEFAULT"
# Admin-like groups you want to protect from self-modification:
PROTECTED_GROUPS = [
    "Administrators",
    "SecurityAdmins",
    "TenantAdmins",
]
# ----------------------------------------


def is_risky_statement(stmt: str, group: str) -> bool:
    """
    Heuristic: flags statements where a protected group can manage:
    - all-resources
    - groups
    - policies
    - users
    without a 'where' clause restricting IAM or itself.
    """
    normalized = " ".join(stmt.split()).lower()

    # must have: "allow group <group>" or "allow dynamic-group <group>" etc.
    if f"allow group {group.lower()}" not in normalized:
        return False

    # simple pattern checks
    risky_verbs = [
        "manage all-resources",
        "manage groups",
        "manage users",
        "manage policies",
        "manage identity-domains",
    ]
    has_risky_verb = any(rv in normalized for rv in risky_verbs)
    if not has_risky_verb:
        return False

    # If there is a WHERE clause, you might want a deeper parse;
    # here we treat ANY condition as "less risky", but you can tighten this.
    has_condition = " where " in normalized

    # Flag when powerful AND no condition
    return has_risky_verb and not has_condition


def main():
    config = oci.config.from_file(profile_name=PROFILE_NAME)
    identity = oci.identity.IdentityClient(config)

    tenancy_id = config["tenancy"]

    print(f"Scanning policies in tenancy {tenancy_id} ...")

    # List all policies in the tenancy (root compartment)
    list_policies_response = oci.pagination.list_call_get_all_results(
        identity.list_policies,
        compartment_id=tenancy_id
    )

    risky_findings = []

    for policy in list_policies_response.data:
        for stmt in policy.statements:
            for group in PROTECTED_GROUPS:
                if is_risky_statement(stmt, group):
                    risky_findings.append({
                        "policy_name": policy.name,
                        "policy_id": policy.id,
                        "compartment_id": policy.compartment_id,
                        "group": group,
                        "statement": stmt,
                    })

    if not risky_findings:
        print("No risky self-modification statements found for protected groups.")
        return

    print("\nRISKY STATEMENTS FOUND:")
    for f in risky_findings:
        print("-------------------------------------------------")
        print(f"Policy Name  : {f['policy_name']}")
        print(f"Policy OCID  : {f['policy_id']}")
        print(f"Compartment  : {f['compartment_id']}")
        print(f"Group        : {f['group']}")
        print(f"Statement    : {f['statement']}")
    print("-------------------------------------------------")
    print(f"Total findings: {len(risky_findings)}")

    # Here you could:
    # - push to monitoring system (e.g., send to OCI Logging, Splunk, etc.)
    # - send an email or Slack alert
    # - write to a file for compliance reports


if __name__ == "__main__":
    main()

resource "oci_identity_policy" "IAM_ADMIN_GROUP_PROTECTION" {
  compartment_id = "TENANCY_OCID"        # Replace with your tenancy OCID (the root compartment)
  name           = "ADMIN_GROUP_PROTECTION_POLICY"  # Replace with your desired policy name
  description    = "Prevent the Administrators group from modifying its own membership"

  statements = [
    # Add this deny rule alongside any existing allow rules that grant admin privileges.
    # If you already manage an IAM policy for admins, add this statement into that resource's `statements` list.
    "Deny group Administrators to manage groups in tenancy where target.group.name = 'Administrators'",
  ]

  # Optional: pin to the date when policy language was valid
  # version_date = "2024-01-01"
}