OCI IAM Admin Users Should Have MFA Enabled

​

1. Find which admin users are missing MFA (Cloud Guard)

1. Sign in to the OCI Console with a security admin account.
2. Open the navigation menu → Security & Identity → Cloud Guard.
3. Go to Cloud Guard → Problems.
4. Filter:
   • Detector type: Identity and Access Management (or equivalent)
   • Problem: IAM Admin Users Should Have MFA Enabled
5. Note the usernames and identity domain / tenancy for each flagged problem.

​

2. Enable MFA for each flagged admin user

The exact UI labels differ slightly depending on whether you use Identity Domains (new model) or classic IAM. Most newer tenancies use Identity Domains.

​

A. For Identity Domain users (most common)

1. In the OCI Console, open the navigation menu → Identity & Security → Domains (or Identity & Security → Identity Domains).
2. Click the Identity Domain where the user resides (often Default domain).
3. Go to Users in the left menu.
4. Search for the admin user identified in step 1 and click the user.

5. In the user details, look for a tab/section such as Security, Multi-Factor Authentication, or Factors.
6. Ensure at least one MFA factor is registered for this user:
   • Typically TOTP Authenticator App (Google Authenticator, Microsoft Authenticator, etc.) or SMS/Email OTP.
   • If not enrolled, have the user:
     1. Sign in to OCI.
     2. Go to User menu (top-right) → My profile / My account.
     3. Open the Security or Multi-Factor Authentication section.
     4. Add an MFA factor (scan QR code for TOTP, verify code, etc.).
7. To enforce MFA (so it’s required, not optional), in the same Identity Domain:
   1. Go to Security → Authentication Policies.
   2. Edit the policy that applies to your admin users (e.g., policy assigned to the Administrators group, or the default policy).
   3. For the sign‑on policy rules that match these admin users, set:
      • Access requirement: Multi-factor authentication or equivalent.
      • Choose allowed factors (e.g., TOTP, SMS).
   4. Save the policy.

• Admins have at least one MFA factor configured.
• MFA is required at sign-in.

​

B. For classic OCI IAM (older tenancies)

1. Navigation menu → Identity & Security → Users.
2. Select the user.
3. Under User Details, open the MFA or Security section.
4. Enable or reset MFA for that user (this will typically require the user to set up an authenticator at next login).

​

3. Make MFA mandatory for admin groups (recommended hardening)

1. Identify your admin group(s), e.g.:
   • Administrators
   • Custom groups that have policies like ALLOW GROUP <group> TO MANAGE ALL-RESOURCES IN TENANCY.
2. In your Identity Domain’s Authentication Policies:
   • Add or edit a rule that targets these admin groups.
   • Set condition: “If user is in group Administrators (or your admin group)”
   • Set action: “Require MFA” (and optionally restrict location/IP/network as needed).
3. Save the policy.

​

4. Verify remediation in Cloud Guard / IAM Monitoring

1. After users have MFA configured and policies enforce it, wait for the next Cloud Guard evaluation cycle (or trigger a re-scan if available).
2. Go back to Cloud Guard → Problems.
3. Confirm that the problems for “IAM Admin Users Should Have MFA Enabled” are:
   • Marked Resolved, or
   • No longer listed.

• Confirm the specific user indeed has an MFA factor configured.
• Confirm the authentication policy actually requires MFA for that user’s sign-in context (group, network, app, etc.).

​

1. Prerequisites

• OCI CLI installed and configured (oci setup config)
• You know:
  • Tenancy OCID: ocid1.tenancy.oc1...
  • Root compartment OCID = tenancy OCID (for policies)
• Your admin group name (commonly Administrators)

​

2. Identify IAM Admin Group and Its Users

1. Find the Administrators group OCID:

oci iam group list \
  --all \
  --compartment-id <TENANCY_OCID> \
  --query "data[?name=='Administrators'].id | [0]" \
  --raw-output

2. List users in that group:

oci iam group list-users \
  --group-id <ADMINS_GROUP_OCID> \
  --all \
  --query "data[].{id:id,name:name}" \
  --output table

​

3. Detect Which Admin Users Lack MFA

oci iam group list-users \
  --group-id <ADMINS_GROUP_OCID> \
  --all \
  --query "data[].id" \
  --raw-output | while read USER_ID; do
  MFA_ENABLED=$(oci iam user get \
    --user-id "$USER_ID" \
    --query "data.\"is-mfa-activated\"" \
    --raw-output)
  if [ "$MFA_ENABLED" != "true" ]; then
    oci iam user get --user-id "$USER_ID" \
      --query "data.{id:id,name:name}"
  fi
done

​

4. Remediation Strategy

1. Require MFA for performing admin actions via IAM policy.
2. Temporarily disable non‑compliant admin users until they enable MFA.
3. Optionally force password reset at next login so they are driven through onboarding steps.

​

4.1. Enforce MFA for Admin Actions via Policy

1. Create a new policy in the root compartment (tenancy) that only allows admin actions when MFA is present.

oci iam policy create \
  --compartment-id <TENANCY_OCID> \
  --name "Admins-Require-MFA" \
  --description "Require MFA for Administrators group to manage all resources" \
  --statements '[
    "Allow group Administrators to manage all-resources in tenancy where request.user.mfaPresent = true"
  ]'

2. Remove or edit existing broad administrator policies that don’t have the MFA condition.
   For each previous policy that looked like:

Allow group Administrators to manage all-resources in tenancy

oci iam policy update \
  --policy-id <OLD_POLICY_OCID> \
  --statements '[
    "Allow group Administrators to manage all-resources in tenancy where request.user.mfaPresent = true"
  ]'

​

4.2. Disable Non‑Compliant Admin Users (Optional but Strong Remediation)

oci iam user update \
  --user-id <USER_ID> \
  --state INACTIVE

oci iam user update \
  --user-id <USER_ID> \
  --force-change-password-next-login true

oci iam user update \
  --user-id <USER_ID> \
  --state ACTIVE

​

5. Instruct Users to Enable MFA

1. Log in to OCI Console.
2. Go to: Profile (top-right) → My profile → My Multi-Factor Authentication.
3. Add a device and complete TOTP setup (scan QR code + verification code).

​

6. Automate Continuous Monitoring with CLI

#!/bin/bash
TENANCY_OCID="<TENANCY_OCID>"
ADMINS_GROUP_OCID=$(oci iam group list \
  --all \
  --compartment-id "$TENANCY_OCID" \
  --query "data[?name=='Administrators'].id | [0]" \
  --raw-output)

echo "Administrators without MFA:"
oci iam group list-users \
  --group-id "$ADMINS_GROUP_OCID" \
  --all \
  --query "data[].id" \
  --raw-output | while read USER_ID; do
  MFA_ENABLED=$(oci iam user get \
    --user-id "$USER_ID" \
    --query "data.\"is-mfa-activated\"" \
    --raw-output)
  if [ "$MFA_ENABLED" != "true" ]; then
    oci iam user get \
      --user-id "$USER_ID" \
      --query "data.{id:id,name:name,email:\"email\"}" \
      --output table
  fi
done

• You cannot auto‑enable MFA for users programmatically; users must enroll themselves.
• You can:
  1. Detect which users are “admins” (or have admin‑level privileges),
  2. Check if they have MFA TOTP devices,
  3. Notify / tag / disable them or take another action if non‑compliant.

​

1. Prerequisites

1. Install Python SDK:
   pip install oci
   
2. Have an OCI config file (usually ~/.oci/config) and a profile with enough privileges:
   • Permission to list policies, list groups, list users, and list MFA devices:
     allow group <your-admin-group> to read users in tenancy
     allow group <your-admin-group> to read groups in tenancy
     allow group <your-admin-group> to read policies in tenancy
     allow group <your-admin-group> to read user-mfa-totp-devices in tenancy
     

​

2. Define What “Admin User” Means

• “Admin users” = users who are members of groups that have policies with broad privileges, like:
  • allow group <GroupName> to manage all-resources in tenancy
  • or similarly powerful policies.

• Only specific groups like Administrators, CloudAdmins, etc.
• Or parse policies for manage all-resources in tenancy.

1. Identify groups that have a powerful policy (contains manage all-resources in tenancy in statement).
2. Any user in those groups is considered an admin user.

​

3. Python Script: Detect Admin Users Without MFA

• Reads all IAM policies in the tenancy.
• Finds “admin groups” via policy text.
• Gathers users in those groups.
• Checks whether each user has any MFA TOTP devices.
• Prints a report of non‑MFA admin users (you can wire this into email/Slack, or take other actions).

import oci

# ---------- CONFIG ----------
PROFILE_NAME = "DEFAULT"  # change if needed
CONFIG_FILE = "~/.oci/config"

# Optional: narrow down what we consider "admin-level" in a simple way
ADMIN_POLICY_PHRASES = [
    "manage all-resources in tenancy",
    "manage all-resources in compartment",  # if you use tenancy-level compartments
]
# ----------------------------


def is_admin_policy_statement(statement_text: str) -> bool:
    text = statement_text.lower()
    return any(phrase in text for phrase in ADMIN_POLICY_PHRASES)


def main():
    config = oci.config.from_file(CONFIG_FILE, PROFILE_NAME)
    identity_client = oci.identity.IdentityClient(config)
    tenancy_id = config["tenancy"]

    # 1. List all policies in the tenancy
    policies = []
    list_policies_response = oci.pagination.list_call_get_all_results(
        identity_client.list_policies,
        compartment_id=tenancy_id
    )
    policies = list_policies_response.data

    # 2. Extract groups that have "admin-level" statements
    admin_group_ocids = set()

    for policy in policies:
        for stmt in policy.statements:
            if is_admin_policy_statement(stmt):
                # Example statement format:
                # "Allow group Administrators to manage all-resources in tenancy"
                # We need the group name.
                s = stmt.strip().lower()
                # Very simple parse: "allow group <group-name> to ..."
                if s.startswith("allow group "):
                    try:
                        # Split into: ["allow", "group", "<group-name>", "to", ...]
                        parts = s.split()
                        # We assume a single-word group name here; if you use multi-word names,
                        # use a more robust parser or regex.
                        group_name = parts[2]
                        admin_group_ocid = get_group_ocid_by_name(identity_client, tenancy_id, group_name)
                        if admin_group_ocid:
                            admin_group_ocids.add(admin_group_ocid)
                    except Exception:
                        pass  # If parsing fails, skip that statement

    if not admin_group_ocids:
        print("No admin groups found via policy parsing. Adjust ADMIN_POLICY_PHRASES or parsing logic.")
        return

    # 3. List all groups and cache mapping
    all_groups = oci.pagination.list_call_get_all_results(
        identity_client.list_groups,
        compartment_id=tenancy_id
    ).data
    groups_by_id = {g.id: g for g in all_groups}

    # 4. For each admin group, list all users
    admin_user_ocids = set()
    for group_ocid in admin_group_ocids:
        group = groups_by_id.get(group_ocid)
        if not group:
            continue
        print(f"Processing admin group: {group.name} ({group.id})")

        # list users in this group
        members = oci.pagination.list_call_get_all_results(
            identity_client.list_user_group_memberships,
            compartment_id=tenancy_id,
            group_id=group_ocid
        ).data

        for m in members:
            admin_user_ocids.add(m.user_id)

    if not admin_user_ocids:
        print("No admin users found.")
        return

    # 5. For each admin user, check MFA TOTP devices
    non_mfa_admins = []
    for user_id in admin_user_ocids:
        user = identity_client.get_user(user_id).data

        mfa_devices = oci.pagination.list_call_get_all_results(
            identity_client.list_mfa_totp_devices,
            user_id=user_id
        ).data

        if len(mfa_devices) == 0:
            non_mfa_admins.append(user)

    # 6. Report
    print("\n====== ADMIN USERS WITHOUT MFA ENABLED ======")
    if not non_mfa_admins:
        print("All admin users have at least one MFA TOTP device.")
    else:
        for u in non_mfa_admins:
            print(f"- {u.name} (OCID: {u.id}, Email: {u.email})")


def get_group_ocid_by_name(identity_client, tenancy_id, group_name_lower: str):
    """
    Find group OCID by name (case-insensitive) within tenancy.
    """
    groups = oci.pagination.list_call_get_all_results(
        identity_client.list_groups,
        compartment_id=tenancy_id
    ).data

    for g in groups:
        if g.name.lower() == group_name_lower:
            return g.id
    return None


if __name__ == "__main__":
    main()

​

4. “Remediation” Options You Can Automate

• Send email / Slack / PagerDuty alert for those users.
• Tag the user (via freeform or defined tags) as non_compliant = true.
• Disable the user automatically after a grace period (be very careful):
  identity_client.update_user(
      user_id=user.id,
      update_user_details=oci.identity.models.UpdateUserDetails(
          lifecycle_state="INACTIVE"  # or use appropriate property if available
      )
  )
  
• Move them out of admin groups (update group memberships) until they enable MFA.

​

5. How to Run as Monitoring

• Run the script from:
  • A CI pipeline,
  • A cron job on a bastion host,
  • An OCI Function (converted to a function handler),
  • Or an OCI Cloud Shell scheduled job.
• Aggregate output to OCI Logging or another monitoring system.

• Your actual admin group names
• Or paste one/two example IAM policy statements from your tenancy

1. In the OCI Console, go to Identity & Security → Users.
2. Select the ADMIN_USER (replace with your actual admin username).
3. In the user details, use the Multi-Factor Authentication / MFA section to:
   • Enroll or reset an MFA device (e.g., TOTP authenticator app), and
   • Follow the QR-code / code-verification flow to complete setup.