OCI IAM Admin Users Should Not Have API Signing Keys

TENANCY_OCID="<your-tenancy-ocid>"
HOME_REGION="<home-region>"   # e.g. us-phoenix-1

oci iam policy list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[].{name:name,statements:statements}" \
  --region "$HOME_REGION"

ADMIN_GROUPS=("Administrators" "SecurityAdmins")

for GROUP_NAME in "${ADMIN_GROUPS[@]}"; do
  echo "=== Group: $GROUP_NAME ==="
  GROUP_OCID=$(oci iam group list \
    --compartment-id "$TENANCY_OCID" \
    --name "$GROUP_NAME" \
    --query "data[0].id" \
    --raw-output \
    --region "$HOME_REGION")

  oci iam group list-users \
    --group-id "$GROUP_OCID" \
    --query "data[].{name:name,id:id}" \
    --all \
    --region "$HOME_REGION"
done

ADMIN_USER_IDS=()

for GROUP_NAME in "${ADMIN_GROUPS[@]}"; do
  GROUP_OCID=$(oci iam group list \
    --compartment-id "$TENANCY_OCID" \
    --name "$GROUP_NAME" \
    --query "data[0].id" \
    --raw-output \
    --region "$HOME_REGION")

  USER_IDS=$(oci iam group list-users \
    --group-id "$GROUP_OCID" \
    --query "data[].id" \
    --raw-output \
    --all \
    --region "$HOME_REGION")

  for U in $USER_IDS; do
    ADMIN_USER_IDS+=("$U")
  done
done

for USER_ID in "${ADMIN_USER_IDS[@]}"; do
  echo "=== API keys for user: $USER_ID ==="
  oci iam user api-key list \
    --user-id "$USER_ID" \
    --query "data[].{keyId:key-id,fingerprint:fingerprint,timeCreated:\"time-created\"}" \
    --all \
    --region "$HOME_REGION"
done

oci iam user api-key delete \
  --user-id "<user-ocid>" \
  --fingerprint "<api-key-fingerprint>" \
  --force \
  --region "$HOME_REGION"

for USER_ID in "${ADMIN_USER_IDS[@]}"; do
  KEY_FPS=$(oci iam user api-key list \
    --user-id "$USER_ID" \
    --query "data[].fingerprint" \
    --raw-output \
    --all \
    --region "$HOME_REGION")

  for FP in $KEY_FPS; do
    echo "Deleting API key $FP for user $USER_ID"
    oci iam user api-key delete \
      --user-id "$USER_ID" \
      --fingerprint "$FP" \
      --force \
      --region "$HOME_REGION"
  done
done

Allow group Administrators to manage all-resources in tenancy
Allow group tenancy-admins to manage all-resources in tenancy

import oci
import re

# -----------------------
# CONFIG
# -----------------------
PROFILE_NAME = "DEFAULT"  # profile in ~/.oci/config
DRY_RUN = True            # True = detect only, False = actually delete keys

# Regex patterns to identify admin-like policy statements
ADMIN_ACTION_PATTERN = re.compile(r"\bmanage\s+all-resources\b", re.IGNORECASE)
ADMIN_SCOPE_PATTERN = re.compile(r"\b(in\s+tenancy|in\s+compartment\s+tenancy)\b", re.IGNORECASE)

def is_admin_policy_statement(stmt: str) -> bool:
    """
    Very simple parser: checks if a statement contains "manage all-resources"
    and is scoped "in tenancy" (or equivalent).
    E.g.: "Allow group Administrators to manage all-resources in tenancy"
    """
    return bool(ADMIN_ACTION_PATTERN.search(stmt) and ADMIN_SCOPE_PATTERN.search(stmt))

def main():
    # 1. Set up config and clients
    config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
    tenancy_ocid = config["tenancy"]

    identity_client = oci.identity.IdentityClient(config)

    # 2. Get root compartment (tenancy) details
    tenancy = identity_client.get_tenancy(tenancy_ocid).data
    root_compartment_id = tenancy.id  # same as tenancy OCID

    # 3. List all groups
    groups = oci.pagination.list_call_get_all_results(
        identity_client.list_groups,
        compartment_id=root_compartment_id
    ).data
    groups_by_name = {g.name: g for g in groups}

    # 4. List all policies in the tenancy (root compartment)
    policies = oci.pagination.list_call_get_all_results(
        identity_client.list_policies,
        compartment_id=root_compartment_id
    ).data

    admin_group_ocids = set()

    # 5. Identify admin groups from policies
    for policy in policies:
        for stmt in policy.statements:
            if is_admin_policy_statement(stmt):
                # Typical pattern: "Allow group <GroupName> to manage all-resources in tenancy"
                # Extract group name after 'group'
                m = re.search(r"Allow\s+group\s+([^\s]+)", stmt, re.IGNORECASE)
                if not m:
                    continue
                group_name = m.group(1)
                group_obj = groups_by_name.get(group_name)
                if group_obj:
                    admin_group_ocids.add(group_obj.id)

    if not admin_group_ocids:
        print("No admin groups detected based on policies.")
        return

    print("Admin groups detected:")
    for g in groups:
        if g.id in admin_group_ocids:
            print(f"  - {g.name} ({g.id})")

    # 6. For each admin group, list members
    admin_user_ocids = set()

    for group_id in admin_group_ocids:
        memberships = oci.pagination.list_call_get_all_results(
            identity_client.list_user_group_memberships,
            compartment_id=root_compartment_id,
            group_id=group_id
        ).data

        for m in memberships:
            admin_user_ocids.add(m.user_id)

    if not admin_user_ocids:
        print("No users found in admin groups.")
        return

    print("\nAdmin users (candidates to check for API keys):")
    users = []
    for user_id in admin_user_ocids:
        user = identity_client.get_user(user_id).data
        users.append(user)
        print(f"  - {user.name} ({user.id})")

    # 7. For each admin user, list and (optionally) delete API keys
    print("\nChecking API keys for admin users...")
    for user in users:
        api_keys = oci.pagination.list_call_get_all_results(
            identity_client.list_api_keys,
            user_id=user.id
        ).data

        if not api_keys:
            print(f"User {user.name} ({user.id}) has NO API signing keys.")
            continue

        print(f"User {user.name} ({user.id}) has {len(api_keys)} API signing key(s):")
        for key in api_keys:
            print(f"  - Key fingerprint: {key.fingerprint}, key_id: {key.key_id}")

            if DRY_RUN:
                print("    [DRY RUN] Would delete this key.")
            else:
                print("    Deleting this key...")
                identity_client.delete_api_key(user_id=user.id, key_id=key.key_id)
                print("    Deleted.")

    print("\nDone.")

if __name__ == "__main__":
    main()

# Example: API keys are managed with oci_identity_api_key
# Remediation: do NOT create api keys for admin users; remove/destroy any existing ones.

resource "oci_identity_user" "admin_user" {
  # Replace with your admin user details
  compartment_id = var.tenancy_ocid
  name           = "ADMIN_USERNAME"        # <- substitute with the actual admin username
  description    = "Admin user without API signing keys"
  email          = "ADMIN_EMAIL@example.com"
}

# If you currently have something like this, it must be removed to remediate:
# resource "oci_identity_api_key" "admin_api_key" {
#   user_id     = oci_identity_user.admin_user.id
#   key_value   = file("PATH_TO_PUBLIC_API_KEY_PEM")  # <- this creates an API signing key
#   description = "API key for admin user"
# }

# Instead, only create API keys for NON-admin users, e.g.:
resource "oci_identity_user" "non_admin_user" {
  compartment_id = var.tenancy_ocid
  name           = "NON_ADMIN_USERNAME"    # <- substitute with the actual non-admin username
  description    = "Non-admin user allowed to have API signing keys"
  email          = "NON_ADMIN_EMAIL@example.com"
}

resource "oci_identity_api_key" "non_admin_api_key" {
  user_id     = oci_identity_user.non_admin_user.id
  key_value   = file("PATH_TO_NON_ADMIN_PUBLIC_API_KEY_PEM") # <- path to the PEM public key
  description = "API key for non-admin user"
}