OCI IAM Only Administrators Should Manage All Resources

oci iam policy list \
  --compartment-id <TENANCY_OCID> \
  --all \
  --output table

oci iam policy get \
  --policy-id <POLICY_OCID> \
  --query 'data.{name:"name", statements:"statements"}'

Allow group <NonAdminGroup> to manage all-resources in tenancy
Allow group <NonAdminGroup> to manage all-resources in compartment <name>

oci iam group create \
  --name Administrators \
  --description "Administrators with full access to manage all resources"

oci iam group add-user \
  --group-id <ADMIN_GROUP_OCID> \
  --user-id <USER_OCID>

oci iam policy create \
  --compartment-id <TENANCY_OCID> \
  --name AdminsManageAllResources \
  --description "Allow Administrators to manage all resources in tenancy" \
  --statements '["Allow group Administrators to manage all-resources in tenancy"]'

--statements '["Allow group Administrators to manage all-resources in compartment <COMPARTMENT_NAME>"]'

oci iam policy get \
  --policy-id <POLICY_OCID> \
  --query 'data.statements' \
  --raw-output > current_policy_statements.json

[
  "Allow group Devs to manage all-resources in tenancy",
  "Allow group Devs to read audit-events in tenancy"
]

[
  "Allow group Devs to use instances in compartment Dev-Compartment",
  "Allow group Devs to read audit-events in tenancy"
]

oci iam policy update \
  --policy-id <POLICY_OCID> \
  --statements file://current_policy_statements.json \
  --force

oci iam policy delete \
  --policy-id <POLICY_OCID> \
  --force

oci iam policy list \
  --compartment-id <TENANCY_OCID> \
  --all \
  --query "data[?contains(join(' ', statements), 'manage all-resources')].{name:name, statements:statements}" \
  --output table

ALLOWED_ADMIN_GROUPS = {
    "Administrators",
    "SecurityAdmins"
}

import oci
import re

# ------------- CONFIG ----------------
PROFILE_NAME = "DEFAULT"          # OCI CLI profile
ALLOWED_ADMIN_GROUPS = {
    "Administrators",             # Example admin group(s)
    "SecurityAdmins"
}
# ------------------------------------


def get_all_compartments(identity_client, tenancy_id):
    """
    Recursively gets all compartments under the tenancy.
    """
    compartments = []

    def _list_compartments(parent_id):
        response = oci.pagination.list_call_get_all_results(
            identity_client.list_compartments,
            tenancy_id,
            compartment_id_in_subtree=True,
            access_level="ANY"
        )
        for c in response.data:
            if c.lifecycle_state == "ACTIVE":
                compartments.append(c)

    _list_compartments(tenancy_id)
    return compartments


def extract_principals_from_statement(statement):
    """
    Very simple parsing for common patterns like:
      'Allow group X to manage all-resources in tenancy'
      'Allow dynamic-group DG1 to manage all-resources in tenancy'
    This is not a full IAM policy parser but works for typical cases.
    """
    # Normalize
    s = " ".join(statement.split()).lower()

    # We'll return a list of dicts, e.g. [{'type': 'group', 'name': 'Administrators'}]
    principals = []

    # Match 'allow group <name> to manage all-resources'
    group_match = re.findall(r"allow group ([a-z0-9_\-]+) to manage all-resources", s)
    for g in group_match:
        principals.append({"type": "group", "name": g})

    # Match 'allow dynamic-group <name> to manage all-resources'
    dg_match = re.findall(r"allow dynamic-group ([a-z0-9_\-]+) to manage all-resources", s)
    for dg in dg_match:
        principals.append({"type": "dynamic-group", "name": dg})

    return principals


def statement_grants_manage_all_resources(statement):
    """
    Checks if the statement includes 'manage all-resources'.
    """
    s = statement.lower()
    return "manage all-resources" in s


def main():
    # Load config & clients
    config = oci.config.from_file(profile_name=PROFILE_NAME)
    identity_client = oci.identity.IdentityClient(config)
    tenancy_id = config["tenancy"]

    # Get all compartments (including root)
    compartments = get_all_compartments(identity_client, tenancy_id)
    compartments.append(identity_client.get_compartment(tenancy_id).data)  # add tenancy root

    print("Scanning policies for 'manage all-resources'...")

    violations = []

    for compartment in compartments:
        # List policies in this compartment
        policies = oci.pagination.list_call_get_all_results(
            identity_client.list_policies,
            compartment.id
        ).data

        for policy in policies:
            for stmt in policy.statements:
                if not statement_grants_manage_all_resources(stmt):
                    continue

                principals = extract_principals_from_statement(stmt)
                for p in principals:
                    # Only enforce for groups here; you can extend for dynamic-groups
                    if p["type"] == "group":
                        group_name = p["name"]
                        # Compare case-insensitively with allowed admin groups
                        if group_name not in {g.lower() for g in ALLOWED_ADMIN_GROUPS}:
                            violations.append({
                                "policy_id": policy.id,
                                "policy_name": policy.name,
                                "compartment_id": compartment.id,
                                "compartment_name": compartment.name,
                                "statement": stmt,
                                "principal_type": p["type"],
                                "principal_name": group_name
                            })

    # Report
    if not violations:
        print("No violations found. Only allowed admin groups manage all-resources.")
    else:
        print("Found the following non-admin principals with 'manage all-resources':\n")
        for v in violations:
            print(f"- Policy: {v['policy_name']} (ID: {v['policy_id']})")
            print(f"  Compartment: {v['compartment_name']} ({v['compartment_id']})")
            print(f"  Principal: {v['principal_type']} '{v['principal_name']}'")
            print(f"  Statement: {v['statement']}\n")


if __name__ == "__main__":
    main()

def remediate_policy(identity_client, policy, bad_statement):
    """
    Remove the violating statement from the policy.
    """
    new_statements = [s for s in policy.statements if s != bad_statement]

    update_details = oci.identity.models.UpdatePolicyDetails(
        description=policy.description,
        statements=new_statements,
        version_date=policy.version_date
    )

    response = identity_client.update_policy(
        policy_id=policy.id,
        update_policy_details=update_details
    )
    return response.data

resource "oci_identity_policy" "iam_monitoring_admin_only" {
  # Replace with your compartment OCID (for root, use the tenancy OCID)
  compartment_id = "OCID_OF_TENANCY_OR_COMPARTMENT"

  # Replace with your policy name
  name        = "IAM_MONITORING_ADMIN_ONLY_POLICY"
  description = "Restrict manage all-resources to administrator group only"

  # Replace ADMIN_GROUP_NAME with the actual OCI IAM group that should have full admin
  statements = [
    # This is the remediated form:
    # previously something like:
    #   "allow any-user to manage all-resources in tenancy"
    # is TOO permissive and must be removed/replaced.
    "Allow group ADMIN_GROUP_NAME to manage all-resources in tenancy"
  ]
}