> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI IAM Admin Users Should Have MFA Enabled ### More Info: All administrator users should have Multi-Factor Authentication (MFA) enabled. Admin accounts are high-value targets, and MFA provides a critical second layer of defense against credential theft. ### Risk Level High ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * GDPR * HIPAA * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To fix **“OCI IAM Admin Users Should Have MFA Enabled”** using the **OCI Console** and align with the OCI IAM Monitoring/Cloud Guard finding, do the following: *** ## 1. Find which admin users are missing MFA (Cloud Guard) 1. Sign in to the **OCI Console** with a security admin account. 2. Open the navigation menu → **Security & Identity** → **Cloud Guard**. 3. Go to **Cloud Guard → Problems**. 4. Filter: * **Detector type**: `Identity and Access Management` (or equivalent) * **Problem**: `IAM Admin Users Should Have MFA Enabled` 5. Note the **usernames** and **identity domain / tenancy** for each flagged problem. *** ## 2. Enable MFA for each flagged admin user > The exact UI labels differ slightly depending on whether you use **Identity Domains** (new model) or **classic IAM**. Most newer tenancies use Identity Domains. ### A. For Identity Domain users (most common) 1. In the OCI Console, open the navigation menu → **Identity & Security** → **Domains** (or **Identity & Security → Identity Domains**). 2. Click the **Identity Domain** where the user resides (often `Default` domain). 3. Go to **Users** in the left menu. 4. Search for the **admin user** identified in step 1 and click the user. **Set up/enforce MFA:** 5. In the user details, look for a tab/section such as **Security**, **Multi-Factor Authentication**, or **Factors**. 6. Ensure at least one MFA factor is registered for this user: * Typically **TOTP Authenticator App (Google Authenticator, Microsoft Authenticator, etc.)** or **SMS/Email OTP**. * If not enrolled, have the user: 1. Sign in to OCI. 2. Go to **User menu (top-right) → My profile / My account**. 3. Open the **Security** or **Multi-Factor Authentication** section. 4. Add an MFA factor (scan QR code for TOTP, verify code, etc.). 7. To **enforce** MFA (so it’s required, not optional), in the same Identity Domain: 1. Go to **Security** → **Authentication Policies**. 2. Edit the policy that applies to your **admin users** (e.g., policy assigned to the Administrators group, or the default policy). 3. For the **sign‑on policy** rules that match these admin users, set: * **Access requirement**: `Multi-factor authentication` or equivalent. * Choose allowed factors (e.g., TOTP, SMS). 4. Save the policy. This ensures: * Admins have at least one MFA factor configured. * MFA is required at sign-in. ### B. For classic OCI IAM (older tenancies) If you’re using the older (non–Identity Domain) model: 1. Navigation menu → **Identity & Security** → **Users**. 2. Select the **user**. 3. Under **User Details**, open the **MFA** or **Security** section. 4. Enable or reset **MFA** for that user (this will typically require the user to set up an authenticator at next login). You may also need to adjust **security policies** or **sign-on rules** if exposed, to require MFA for admins. *** ## 3. Make MFA mandatory for admin groups (recommended hardening) 1. Identify your admin group(s), e.g.: * `Administrators` * Custom groups that have policies like `ALLOW GROUP TO MANAGE ALL-RESOURCES IN TENANCY`. 2. In your Identity Domain’s **Authentication Policies**: * Add or edit a rule that targets these admin groups. * Set **condition**: “If user is in group Administrators (or your admin group)” * Set **action**: “Require MFA” (and optionally restrict location/IP/network as needed). 3. Save the policy. This will ensure any new admin user automatically must use MFA. *** ## 4. Verify remediation in Cloud Guard / IAM Monitoring 1. After users have MFA configured and policies enforce it, wait for the next Cloud Guard evaluation cycle (or trigger a re-scan if available). 2. Go back to **Cloud Guard → Problems**. 3. Confirm that the problems for **“IAM Admin Users Should Have MFA Enabled”** are: * Marked **Resolved**, or * No longer listed. If they’re still present: * Confirm the specific user indeed has an MFA factor configured. * Confirm the **authentication policy** actually requires MFA for that user’s sign-in context (group, network, app, etc.). *** If you share whether you’re on **Identity Domains** or **classic IAM**, I can give the exact UI labels for your specific setup. Below is how to **detect** and then **remediate** “OCI IAM Admin Users Should Have MFA Enabled” using the OCI CLI.\ Note: MFA *activation itself* must be done by the user via the Console; you can’t auto-enroll MFA from the CLI. From the CLI you can (1) detect non‑MFA admins and (2) enforce policies / disable them until they comply. *** ## 1. Prerequisites * OCI CLI installed and configured (`oci setup config`) * You know: * Tenancy OCID: `ocid1.tenancy.oc1...` * Root compartment OCID = tenancy OCID (for policies) * Your admin group name (commonly `Administrators`) *** ## 2. Identify IAM Admin Group and Its Users 1. Find the Administrators group OCID: ```bash theme={null} oci iam group list \ --all \ --compartment-id \ --query "data[?name=='Administrators'].id | [0]" \ --raw-output ``` Save the result as `ADMINS_GROUP_OCID`. 2. List users in that group: ```bash theme={null} oci iam group list-users \ --group-id \ --all \ --query "data[].{id:id,name:name}" \ --output table ``` *** ## 3. Detect Which Admin Users Lack MFA For each user ID from above, check whether MFA is activated. Option A – Use `is-mfa-activated` on the user: ```bash theme={null} oci iam group list-users \ --group-id \ --all \ --query "data[].id" \ --raw-output | while read USER_ID; do MFA_ENABLED=$(oci iam user get \ --user-id "$USER_ID" \ --query "data.\"is-mfa-activated\"" \ --raw-output) if [ "$MFA_ENABLED" != "true" ]; then oci iam user get --user-id "$USER_ID" \ --query "data.{id:id,name:name}" fi done ``` This prints all **Administrators** who do **not** have MFA enabled. *** ## 4. Remediation Strategy You cannot “turn on” MFA from CLI. You can: 1. Require MFA for performing admin actions via IAM policy. 2. Temporarily disable non‑compliant admin users until they enable MFA. 3. Optionally force password reset at next login so they are driven through onboarding steps. ### 4.1. Enforce MFA for Admin Actions via Policy 1. Create a new policy in the root compartment (tenancy) that **only allows admin actions when MFA is present**. Example policy statement (tenancy-level): ```bash theme={null} oci iam policy create \ --compartment-id \ --name "Admins-Require-MFA" \ --description "Require MFA for Administrators group to manage all resources" \ --statements '[ "Allow group Administrators to manage all-resources in tenancy where request.user.mfaPresent = true" ]' ``` 2. Remove or edit existing broad administrator policies that don’t have the MFA condition.\ For each previous policy that looked like: ```text theme={null} Allow group Administrators to manage all-resources in tenancy ``` Update it to add the MFA condition: ```bash theme={null} oci iam policy update \ --policy-id \ --statements '[ "Allow group Administrators to manage all-resources in tenancy where request.user.mfaPresent = true" ]' ``` This ensures **any** admin operation will fail unless the user has an active MFA session. *** ### 4.2. Disable Non‑Compliant Admin Users (Optional but Strong Remediation) For each admin user without MFA (from step 3), you can disable them: ```bash theme={null} oci iam user update \ --user-id \ --state INACTIVE ``` You may also force password change at next login (when you reactivate them): ```bash theme={null} oci iam user update \ --user-id \ --force-change-password-next-login true ``` Then re-activate once they’ve confirmed MFA is enabled: ```bash theme={null} oci iam user update \ --user-id \ --state ACTIVE ``` *** ## 5. Instruct Users to Enable MFA Each admin must: 1. Log in to OCI Console. 2. Go to: Profile (top-right) → **My profile** → **My Multi-Factor Authentication**. 3. Add a device and complete TOTP setup (scan QR code + verification code). Once done, the `is-mfa-activated` flag will be `true` and MFA-based policies will allow their admin actions. *** ## 6. Automate Continuous Monitoring with CLI Run periodically (e.g., via cron) to report non‑MFA admins: ```bash theme={null} #!/bin/bash TENANCY_OCID="" ADMINS_GROUP_OCID=$(oci iam group list \ --all \ --compartment-id "$TENANCY_OCID" \ --query "data[?name=='Administrators'].id | [0]" \ --raw-output) echo "Administrators without MFA:" oci iam group list-users \ --group-id "$ADMINS_GROUP_OCID" \ --all \ --query "data[].id" \ --raw-output | while read USER_ID; do MFA_ENABLED=$(oci iam user get \ --user-id "$USER_ID" \ --query "data.\"is-mfa-activated\"" \ --raw-output) if [ "$MFA_ENABLED" != "true" ]; then oci iam user get \ --user-id "$USER_ID" \ --query "data.{id:id,name:name,email:\"email\"}" \ --output table fi done ``` This gives you CLI-based IAM monitoring and the remediation hooks (policy + user state) to enforce MFA for IAM admin users. Below is a practical way to **monitor** and help **remediate** “OCI IAM Admin Users Should Have MFA Enabled” using Python and the OCI SDK. Key points: * You **cannot auto‑enable** MFA for users programmatically; users must enroll themselves. * You **can**: 1. Detect which users are “admins” (or have admin‑level privileges), 2. Check if they have MFA TOTP devices, 3. Notify / tag / disable them or take another action if non‑compliant. *** ## 1. Prerequisites 1. Install Python SDK: ```bash theme={null} pip install oci ``` 2. Have an OCI config file (usually `~/.oci/config`) and a profile with enough privileges: * Permission to **list policies**, **list groups**, **list users**, and **list MFA devices**: ```text theme={null} allow group to read users in tenancy allow group to read groups in tenancy allow group to read policies in tenancy allow group to read user-mfa-totp-devices in tenancy ``` *** ## 2. Define What “Admin User” Means Common, straightforward approach: * “Admin users” = users who are **members of groups** that have policies with broad privileges, like: * `allow group to manage all-resources in tenancy` * or similarly powerful policies. You can tune this to your environment: * Only specific groups like `Administrators`, `CloudAdmins`, etc. * Or parse policies for `manage all-resources in tenancy`. For simplicity, we’ll: 1. Identify groups that have a powerful policy (contains `manage all-resources in tenancy` in statement). 2. Any user in those groups is considered an *admin user*. *** ## 3. Python Script: Detect Admin Users Without MFA This sample: * Reads all IAM policies in the tenancy. * Finds “admin groups” via policy text. * Gathers users in those groups. * Checks whether each user has any MFA TOTP devices. * Prints a report of **non‑MFA admin users** (you can wire this into email/Slack, or take other actions). ```python theme={null} import oci # ---------- CONFIG ---------- PROFILE_NAME = "DEFAULT" # change if needed CONFIG_FILE = "~/.oci/config" # Optional: narrow down what we consider "admin-level" in a simple way ADMIN_POLICY_PHRASES = [ "manage all-resources in tenancy", "manage all-resources in compartment", # if you use tenancy-level compartments ] # ---------------------------- def is_admin_policy_statement(statement_text: str) -> bool: text = statement_text.lower() return any(phrase in text for phrase in ADMIN_POLICY_PHRASES) def main(): config = oci.config.from_file(CONFIG_FILE, PROFILE_NAME) identity_client = oci.identity.IdentityClient(config) tenancy_id = config["tenancy"] # 1. List all policies in the tenancy policies = [] list_policies_response = oci.pagination.list_call_get_all_results( identity_client.list_policies, compartment_id=tenancy_id ) policies = list_policies_response.data # 2. Extract groups that have "admin-level" statements admin_group_ocids = set() for policy in policies: for stmt in policy.statements: if is_admin_policy_statement(stmt): # Example statement format: # "Allow group Administrators to manage all-resources in tenancy" # We need the group name. s = stmt.strip().lower() # Very simple parse: "allow group to ..." if s.startswith("allow group "): try: # Split into: ["allow", "group", "", "to", ...] parts = s.split() # We assume a single-word group name here; if you use multi-word names, # use a more robust parser or regex. group_name = parts[2] admin_group_ocid = get_group_ocid_by_name(identity_client, tenancy_id, group_name) if admin_group_ocid: admin_group_ocids.add(admin_group_ocid) except Exception: pass # If parsing fails, skip that statement if not admin_group_ocids: print("No admin groups found via policy parsing. Adjust ADMIN_POLICY_PHRASES or parsing logic.") return # 3. List all groups and cache mapping all_groups = oci.pagination.list_call_get_all_results( identity_client.list_groups, compartment_id=tenancy_id ).data groups_by_id = {g.id: g for g in all_groups} # 4. For each admin group, list all users admin_user_ocids = set() for group_ocid in admin_group_ocids: group = groups_by_id.get(group_ocid) if not group: continue print(f"Processing admin group: {group.name} ({group.id})") # list users in this group members = oci.pagination.list_call_get_all_results( identity_client.list_user_group_memberships, compartment_id=tenancy_id, group_id=group_ocid ).data for m in members: admin_user_ocids.add(m.user_id) if not admin_user_ocids: print("No admin users found.") return # 5. For each admin user, check MFA TOTP devices non_mfa_admins = [] for user_id in admin_user_ocids: user = identity_client.get_user(user_id).data mfa_devices = oci.pagination.list_call_get_all_results( identity_client.list_mfa_totp_devices, user_id=user_id ).data if len(mfa_devices) == 0: non_mfa_admins.append(user) # 6. Report print("\n====== ADMIN USERS WITHOUT MFA ENABLED ======") if not non_mfa_admins: print("All admin users have at least one MFA TOTP device.") else: for u in non_mfa_admins: print(f"- {u.name} (OCID: {u.id}, Email: {u.email})") def get_group_ocid_by_name(identity_client, tenancy_id, group_name_lower: str): """ Find group OCID by name (case-insensitive) within tenancy. """ groups = oci.pagination.list_call_get_all_results( identity_client.list_groups, compartment_id=tenancy_id ).data for g in groups: if g.name.lower() == group_name_lower: return g.id return None if __name__ == "__main__": main() ``` *** ## 4. “Remediation” Options You Can Automate Once you have `non_mfa_admins`, you can add logic instead of just printing: * **Send email / Slack / PagerDuty** alert for those users. * **Tag** the user (via freeform or defined tags) as `non_compliant = true`. * **Disable the user** automatically after a grace period (be very careful): ```python theme={null} identity_client.update_user( user_id=user.id, update_user_details=oci.identity.models.UpdateUserDetails( lifecycle_state="INACTIVE" # or use appropriate property if available ) ) ``` * **Move them out of admin groups** (update group memberships) until they enable MFA. (Exact disabling / group-change calls depend on your policy; do not automate this without testing.) *** ## 5. How to Run as Monitoring * Run the script from: * A CI pipeline, * A cron job on a bastion host, * An OCI Function (converted to a function handler), * Or an OCI Cloud Shell scheduled job. * Aggregate output to OCI Logging or another monitoring system. If you tell me: * Your **actual admin group names** * Or paste one/two example IAM policy statements from your tenancy I can adjust the Python parsing to your exact environment and add email/Slack notification examples. Terraform cannot currently enable or enforce MFA for OCI IAM users; the OCI Terraform provider does not expose any resource or argument to manage MFA devices or MFA enforcement on `oci_identity_user` or related identity objects. You must configure MFA for admin users directly in the OCI Console (or via non-Terraform API/CLI): 1. In the OCI Console, go to **Identity & Security → Users**. 2. Select the **ADMIN\_USER** (replace with your actual admin username). 3. In the user details, use the **Multi-Factor Authentication** / **MFA** section to: * Enroll or reset an MFA device (e.g., TOTP authenticator app), and * Follow the QR-code / code-verification flow to complete setup. Because this setting is outside Terraform’s control, `terraform plan` will show **no changes** related to MFA; the remediation is entirely out-of-band from Terraform.