> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI IAM Only Administrators Should Manage All Resources ### More Info: Only administrator groups should have manage all-resources privileges. Policies granting any-user the ability to manage all resources violate least-privilege and create uncontrolled access. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Below are concise, console‑based steps to remediate the “OCI IAM Only Administrators Should Manage All Resources” problem and monitor it in OCI. *** ## 1. Identify Who Currently Has Broad (“Manage All-Resources”) Access 1. Sign in to the **OCI Console**. 2. Open the **Navigation Menu** → **Identity & Security** → **Identity & Access Management (IAM)** → **Policies**. 3. For each compartment (especially **root compartment**): * Select the **compartment** in the left filter. * Review each **policy** for statements containing: * `manage all-resources in tenancy` * `manage all-resources in compartment ` 4. List all **groups** in those statements that have `manage all-resources` (e.g. `Group DevOps`). You want only your dedicated admin group (e.g. `Administrators`) to have this level. *** ## 2. Define / Verify the Administrator Group 1. In the Console, go to: **Identity & Security** → **Identity & Access Management (IAM)** → **Groups**. 2. Ensure you have a single, clearly named group for full admins, e.g. `Administrators`. * If not, click **Create Group**, name it `Administrators`, and add a description such as “Full tenancy administrators”. *** ## 3. Restrict “Manage All Resources” to Administrators Only ### 3.1. Update Existing Policies For each policy that grants `manage all-resources`: 1. Open **IAM → Policies**. 2. Click the policy name. 3. Click **Edit Policy Statements**. 4. Find statements like: ```text theme={null} Allow group DevOps to manage all-resources in tenancy Allow group DevTeam to manage all-resources in compartment ``` 5. Change them to something more restrictive, for example: * For full admins only: ```text theme={null} Allow group Administrators to manage all-resources in tenancy ``` * For non-admins, grant *least privilege*, e.g. only required services: ```text theme={null} Allow group DevOps to manage instance-family in compartment Dev Allow group DevTeam to use object-family in compartment Dev ``` 6. Save the updated policy. ### 3.2. Ensure Only Administrators Have Full-Tenancy Admin Rights 1. Still under **Policies**, verify that: * The **only** policy with `manage all-resources in tenancy` references the `Administrators` group (or equivalent). * No other group is given `manage all-resources in tenancy` or wide `manage all-resources in root compartment`. *** ## 4. Clean Up User Membership 1. Go to **Identity & Security → IAM → Users**. 2. For each user: * Open the user → **Groups** tab. * Confirm only true admins are members of `Administrators`. * Remove non‑admins from any group that has broad (`manage all-resources`) privileges: * Click **Remove** next to the group membership. *** ## 5. Enable / Verify IAM Monitoring (Audit + Cloud Guard) ### 5.1. Ensure Audit is Enabled Audit is on by default but verify: 1. Go to **Identity & Security → Audit**. 2. Confirm you can see events for compartments (no extra steps usually needed). You can query for high‑risk IAM changes, e.g. events where policies are created/updated or group membership changes. ### 5.2. Enable Cloud Guard (If Not Already) 1. Go to **Identity & Security → Cloud Guard**. 2. If not enabled: * Click **Enable Cloud Guard**. * Choose: * **Target**: typically the **tenancy** for full coverage. * **Detector Recipe**: use the **Oracle-Managed** default, then customize as needed. 3. Save. *** ## 6. Configure Cloud Guard for “Only Admins Manage All Resources” 1. In **Cloud Guard**, open: * **Detector Recipes** → find your **Configuration** or **Identity** detector recipe. 2. Click the recipe → **View Details** → **Detector Rules**. 3. Look for a rule related to: * “Overly permissive IAM policy”, “All-resources permissions”, or similar wording (names can vary by version/region). 4. Ensure the rule is: * **Enabled**. * Severity set appropriately (**High/Critical**). 5. Attach the recipe to your **Cloud Guard Target** (the tenancy or key compartments): * Go to **Targets**. * Click your target. * Confirm your updated detector recipe is associated. This makes Cloud Guard raise problems whenever non‑admin groups get broad manage‑all access. *** ## 7. (Optional) Create Notifications for Violations 1. Go to **Developer Services → Notifications**. 2. Create a **Topic** (e.g., `cloud-guard-alerts`). 3. Subscribe your email or PagerDuty/Slack endpoint. 4. Back in **Cloud Guard**: * Go to **Responder Recipes** or **Rules**. * Configure a **responder** that: * Triggers on the IAM “overly permissive policy” problem. * Sends notification to the topic you created. *** ## 8. Validate 1. Try to add a test policy for a non‑admin group with: ```text theme={null} Allow group TestGroup to manage all-resources in compartment Dev ``` 2. Confirm: * Non‑admin users still can’t manage resources outside their scope. * Cloud Guard shows a **Problem** for the over‑permissive IAM policy (if you enabled that rule). This configuration ensures only your administrator group can manage all resources, and IAM changes are monitored via Audit and Cloud Guard from the OCI Console. Below is a minimal, CLI-focused way to remediate “Only Administrators Should Manage All Resources” in OCI IAM, assuming: * You already know which group is your “Administrators” group (or you will create one). * You want to ensure that only this group has `manage all-resources` privileges in the tenancy or compartments. *** ## 1. Identify Existing “Over-Privileged” Policies You’re looking for any policy that grants `manage all-resources` (or similarly broad verbs like `manage instance-family` at the tenancy level) to non-admin groups. ### 1.1 List all policies in the tenancy ```bash theme={null} oci iam policy list \ --compartment-id \ --all \ --output table ``` Replace `` with your root tenancy OCID. ### 1.2 Get details for a specific policy For each suspicious policy, get full details: ```bash theme={null} oci iam policy get \ --policy-id \ --query 'data.{name:"name", statements:"statements"}' ``` Look for statements like: ```text theme={null} Allow group to manage all-resources in tenancy Allow group to manage all-resources in compartment ``` *** ## 2. Ensure You Have a Designated Admin Group ### 2.1 Create an Administrators group (if not already present) ```bash theme={null} oci iam group create \ --name Administrators \ --description "Administrators with full access to manage all resources" ``` Record the returned `ocid` if needed. ### 2.2 Add admin users to the Administrators group ```bash theme={null} oci iam group add-user \ --group-id \ --user-id ``` Repeat as needed for each admin. *** ## 3. Create/Verify the Correct Admin Policy You want a single clear policy that grants the admin group full rights. ### 3.1 Create an admin policy (if missing) ```bash theme={null} oci iam policy create \ --compartment-id \ --name AdminsManageAllResources \ --description "Allow Administrators to manage all resources in tenancy" \ --statements '["Allow group Administrators to manage all-resources in tenancy"]' ``` If you prefer per-compartment instead of tenancy-wide, scope it accordingly: ```bash theme={null} --statements '["Allow group Administrators to manage all-resources in compartment "]' ``` *** ## 4. Remove or Tighten Non-Admin “Manage All-Resources” Policies For each policy that grants `manage all-resources` to a non-admin group: ### 4.1 Download current policy for editing ```bash theme={null} oci iam policy get \ --policy-id \ --query 'data.statements' \ --raw-output > current_policy_statements.json ``` This will produce something like: ```json theme={null} [ "Allow group Devs to manage all-resources in tenancy", "Allow group Devs to read audit-events in tenancy" ] ``` ### 4.2 Edit the JSON file locally * Remove or narrow the `manage all-resources` line. * Replace with least-privilege statements (for example): ```json theme={null} [ "Allow group Devs to use instances in compartment Dev-Compartment", "Allow group Devs to read audit-events in tenancy" ] ``` ### 4.3 Update the policy in OCI ```bash theme={null} oci iam policy update \ --policy-id \ --statements file://current_policy_statements.json \ --force ``` Repeat for each policy that grants broad rights to non-admin groups. *** ## 5. (Optional) Disable or Delete Unused Broad Policies If a policy is purely obsolete and only grants over-broad permissions: ### 5.1 Delete the policy ```bash theme={null} oci iam policy delete \ --policy-id \ --force ``` *** ## 6. Validate via CLI ### 6.1 List policies again and search for “manage all-resources” ```bash theme={null} oci iam policy list \ --compartment-id \ --all \ --query "data[?contains(join(' ', statements), 'manage all-resources')].{name:name, statements:statements}" \ --output table ``` Verify that: * Only the Administrators group is granted `manage all-resources` (tenancy or compartments as per your design). * Other groups have more granular permissions (e.g., `use`, `inspect`, or specific resource-family `manage`). *** If you share an example of a current policy statement, I can give you the exact replacement statements and the precise `oci iam policy update` command. Below is a concrete way to **monitor and remediate** the issue “Only Administrators Should Manage All Resources” in **OCI IAM** using **Python** and the OCI Python SDK. ### Goal Identify IAM policies that grant `manage all-resources` and ensure that: * Only *approved admin groups/compartments* have that level of access. * Any non‑admin principal with `manage all-resources` is flagged (and optionally auto‑remediated). *** ## 1. Prerequisites 1. Install OCI SDK: ```bash theme={null} pip install oci ``` 2. Configure your OCI CLI profile (usually `~/.oci/config`) with a user that has permission to: * `INSPECT`/`READ`/`MANAGE` policies. * Optionally `UPDATE` policies (for automated remediation). *** ## 2. Define Allowed Admin Principals Decide which IAM groups are allowed to have full access, e.g.: ```python theme={null} ALLOWED_ADMIN_GROUPS = { "Administrators", "SecurityAdmins" } ``` If you use dynamic groups or compartments instead, add rules accordingly. *** ## 3. Python Script: Monitor Policies for `manage all-resources` This script: * Lists all compartments and all IAM policies. * Parses each policy statement. * Finds statements that grant `manage all-resources`. * Flags if the principal is not in `ALLOWED_ADMIN_GROUPS`. You can run this periodically (e.g., as an OCI Function or scheduled job). ```python theme={null} import oci import re # ------------- CONFIG ---------------- PROFILE_NAME = "DEFAULT" # OCI CLI profile ALLOWED_ADMIN_GROUPS = { "Administrators", # Example admin group(s) "SecurityAdmins" } # ------------------------------------ def get_all_compartments(identity_client, tenancy_id): """ Recursively gets all compartments under the tenancy. """ compartments = [] def _list_compartments(parent_id): response = oci.pagination.list_call_get_all_results( identity_client.list_compartments, tenancy_id, compartment_id_in_subtree=True, access_level="ANY" ) for c in response.data: if c.lifecycle_state == "ACTIVE": compartments.append(c) _list_compartments(tenancy_id) return compartments def extract_principals_from_statement(statement): """ Very simple parsing for common patterns like: 'Allow group X to manage all-resources in tenancy' 'Allow dynamic-group DG1 to manage all-resources in tenancy' This is not a full IAM policy parser but works for typical cases. """ # Normalize s = " ".join(statement.split()).lower() # We'll return a list of dicts, e.g. [{'type': 'group', 'name': 'Administrators'}] principals = [] # Match 'allow group to manage all-resources' group_match = re.findall(r"allow group ([a-z0-9_\-]+) to manage all-resources", s) for g in group_match: principals.append({"type": "group", "name": g}) # Match 'allow dynamic-group to manage all-resources' dg_match = re.findall(r"allow dynamic-group ([a-z0-9_\-]+) to manage all-resources", s) for dg in dg_match: principals.append({"type": "dynamic-group", "name": dg}) return principals def statement_grants_manage_all_resources(statement): """ Checks if the statement includes 'manage all-resources'. """ s = statement.lower() return "manage all-resources" in s def main(): # Load config & clients config = oci.config.from_file(profile_name=PROFILE_NAME) identity_client = oci.identity.IdentityClient(config) tenancy_id = config["tenancy"] # Get all compartments (including root) compartments = get_all_compartments(identity_client, tenancy_id) compartments.append(identity_client.get_compartment(tenancy_id).data) # add tenancy root print("Scanning policies for 'manage all-resources'...") violations = [] for compartment in compartments: # List policies in this compartment policies = oci.pagination.list_call_get_all_results( identity_client.list_policies, compartment.id ).data for policy in policies: for stmt in policy.statements: if not statement_grants_manage_all_resources(stmt): continue principals = extract_principals_from_statement(stmt) for p in principals: # Only enforce for groups here; you can extend for dynamic-groups if p["type"] == "group": group_name = p["name"] # Compare case-insensitively with allowed admin groups if group_name not in {g.lower() for g in ALLOWED_ADMIN_GROUPS}: violations.append({ "policy_id": policy.id, "policy_name": policy.name, "compartment_id": compartment.id, "compartment_name": compartment.name, "statement": stmt, "principal_type": p["type"], "principal_name": group_name }) # Report if not violations: print("No violations found. Only allowed admin groups manage all-resources.") else: print("Found the following non-admin principals with 'manage all-resources':\n") for v in violations: print(f"- Policy: {v['policy_name']} (ID: {v['policy_id']})") print(f" Compartment: {v['compartment_name']} ({v['compartment_id']})") print(f" Principal: {v['principal_type']} '{v['principal_name']}'") print(f" Statement: {v['statement']}\n") if __name__ == "__main__": main() ``` *** ## 4. Optional: Automated Remediation Once you’ve identified violating policies, you have two main choices: 1. **Edit the policy statements** to: * Remove `manage all-resources` for non‑admin groups. * Replace with narrower verbs/resources (e.g., `read`, `use`, or specific services). 2. **Delete the entire policy** if it’s not needed. Example pattern to **update a policy** (manual & careful): ```python theme={null} def remediate_policy(identity_client, policy, bad_statement): """ Remove the violating statement from the policy. """ new_statements = [s for s in policy.statements if s != bad_statement] update_details = oci.identity.models.UpdatePolicyDetails( description=policy.description, statements=new_statements, version_date=policy.version_date ) response = identity_client.update_policy( policy_id=policy.id, update_policy_details=update_details ) return response.data ``` You’d call `remediate_policy` for each specific violating statement after reviewing it. *** ## 5. Operationalizing as Monitoring * Run this Python script: * As an **OCI Function** triggered by a **scheduled job** (via OCI DevOps or an external scheduler). * Or as a CI job in your security pipeline. * Export findings to: * OCI Logging / Object Storage / SIEM. * Email / Slack / ticketing system. This gives you continuous **OCI IAM monitoring** that enforces “only administrators manage all resources” using Python. ```hcl theme={null} resource "oci_identity_policy" "iam_monitoring_admin_only" { # Replace with your compartment OCID (for root, use the tenancy OCID) compartment_id = "OCID_OF_TENANCY_OR_COMPARTMENT" # Replace with your policy name name = "IAM_MONITORING_ADMIN_ONLY_POLICY" description = "Restrict manage all-resources to administrator group only" # Replace ADMIN_GROUP_NAME with the actual OCI IAM group that should have full admin statements = [ # This is the remediated form: # previously something like: # "allow any-user to manage all-resources in tenancy" # is TOO permissive and must be removed/replaced. "Allow group ADMIN_GROUP_NAME to manage all-resources in tenancy" ] } ``` Substitute: * `OCID_OF_TENANCY_OR_COMPARTMENT` with your tenancy or compartment OCID where the policy is defined. * `IAM_MONITORING_ADMIN_ONLY_POLICY` with your existing policy name if you are remediating an existing policy, not creating a new one. * `ADMIN_GROUP_NAME` with the actual administrator group that should manage all resources (for example, `Administrators`). This change updates the existing policy in place and does not force its replacement; it is a safe apply from a resource lifecycle perspective, but it will immediately revoke `manage all-resources` from `any-user`. For verification, `terraform plan` should show the `oci_identity_policy` with its `statements` changing from a line granting `manage all-resources` to `any-user` (or another overly broad principal) to the restricted `Allow group ADMIN_GROUP_NAME to manage all-resources in tenancy`.