> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI IAM Policies Should Not Grant Manage/Use On All Resources ### More Info: IAM policies should not grant manage or use permissions on all-resources. Broad resource access violates least-privilege principles and magnifies the impact of credential compromise. ### Risk Level Critical ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Here’s how to remediate “OCI IAM Policies Should Not Grant Manage/Use On All Resources” using the OCI Console. ### 1. Identify Overly Broad Policies 1. Sign in to the **OCI Console**. 2. Open the navigation menu (☰) → **Identity & Security** → **Identity** → **Policies**. 3. In the **Scope** selector at the top left, check both: * **Tenancy** level (root) * Each **compartment** where you define policies 4. In the policy list, look for policies containing statements like: * `... to manage all-resources in tenancy` * `... to manage all-resources in compartment ` * `... to use all-resources in tenancy` * `... to use all-resources in compartment ` You can quickly find them by: * Clicking a policy name * Using browser search (Ctrl+F / Cmd+F) for `all-resources`. These are the ones violating the rule. *** ### 2. Plan Least-Privilege Replacement For each policy statement using `manage all-resources` or `use all-resources`, decide: 1. **Which principal actually needs access?** * Group? Dynamic group? User? 2. **Which services/resources do they really need?**\ Replace `all-resources` with more specific verbs and resource-types, e.g.: Common replacements: * Instead of:\ `allow group app-admins to manage all-resources in compartment app-compartment` * Use something like: ```text theme={null} allow group app-admins to manage instance-family in compartment app-compartment allow group app-admins to manage volume-family in compartment app-compartment allow group app-admins to read virtual-network-family in compartment app-compartment ``` Useful resource-type families: * `instance-family` * `volume-family` * `virtual-network-family` * `object-family` * `database-family` * `stream-family` * `functions-family` * etc. 3. **Scope to the smallest compartment possible.**\ Avoid “in tenancy” unless truly necessary; prefer “in compartment ``”. *** ### 3. Edit the Policy in the Console For each problematic policy: 1. In **Identity → Policies**, click the **policy name**. 2. Click **Edit Policy**. 3. In the **Statements** text box: * Remove or change statements containing: * `manage all-resources` * `use all-resources` * Replace them with: * Specific resource families (e.g., `instance-family`, `database-family`) * Appropriate verb (`inspect`, `read`, `use`, `manage`) * Narrower scope (`in compartment ` instead of `in tenancy`) Example transformation: **Before:** ```text theme={null} allow group monitoring-ops to manage all-resources in tenancy ``` **After (more appropriate for monitoring use cases):** ```text theme={null} allow group monitoring-ops to read metrics in tenancy allow group monitoring-ops to read alarms in tenancy allow group monitoring-ops to read compartments in tenancy allow group monitoring-ops to inspect instances in tenancy ``` (Adjust to your actual needs; often *read/inspect* is enough for monitoring.) 4. Click **Save Changes**. *** ### 4. Validate Access Still Works 1. Identify a **test user** in the affected group (e.g., member of `monitoring-ops`). 2. Log in as that user (or use **Auth token + CLI** to test). 3. Confirm they can: * Perform their required monitoring tasks (view metrics, alarms, logs, etc.). * Cannot create/delete unrelated resources (e.g., VCNs, instances, buckets). If something fails due to missing permission, **add only the minimal additional statements** needed. *** ### 5. Clean Up and Standardize 1. Repeat the above steps for any remaining `manage/use all-resources` policies. 2. Document: * Which groups have which policies. * Which compartments those apply to. 3. Going forward: * Use **compartment + resource-family + minimal verb** for all new policies. * Avoid `all-resources` entirely unless under a controlled break-glass/admin account. *** If you share one of your current policy statements, I can rewrite it into a least‑privilege version tailored to your exact monitoring use case. Below is a step‑by‑step remediation using OCI CLI to fix policies that grant `manage`/`use` on `all-resources`, and replace them with least‑privilege Monitoring permissions. Assumptions (adjust for your tenancy): * You have OCI CLI configured (`oci setup config` already done). * You know: * **Compartment OCID** where the policy lives: `COMPARTMENT_OCID` * **Group name** that should have Monitoring access: `MONITORING_GROUP` * **Namespace** you want to allow access to (optional): `my_app_ns` *** ## 1. Identify Problem Policies List policies in the compartment: ```bash theme={null} oci iam policy list \ --compartment-id COMPARTMENT_OCID \ --all ``` For each policy, inspect its statements: ```bash theme={null} oci iam policy get \ --policy-id POLICY_OCID \ --query 'data."statements"' \ --output table ``` Look for statements like: ```text theme={null} allow group MONITORING_GROUP to manage all-resources in compartment allow group MONITORING_GROUP to use all-resources in compartment allow group MONITORING_GROUP to manage all-resources in tenancy allow group MONITORING_GROUP to use all-resources in tenancy ``` Note the `POLICY_OCID` of each policy that has such statements. *** ## 2. Decide Desired Least‑Privilege Monitoring Access Typical least‑privilege examples for Monitoring: Read metrics only: ```text theme={null} allow group MONITORING_GROUP to read metrics in compartment ``` Manage alarms only: ```text theme={null} allow group MONITORING_GROUP to manage alarms in compartment ``` Optionally restrict metrics further by namespace: ```text theme={null} allow group MONITORING_GROUP to read metrics in compartment where target.metrics.namespace = 'my_app_ns' ``` You will **replace** the `manage/use all-resources` statements with such specific ones. *** ## 3. Export Existing Policy for Backup For each affected policy: ```bash theme={null} oci iam policy get \ --policy-id POLICY_OCID \ --query 'data' \ --output json > old-policy-POLICY_OCID.json ``` Keep this as backup. *** ## 4. Build a Cleaned‑Up Policy Definition (Locally) Open the backup JSON file and extract / edit the `statements` array. For example, if original statements were: ```json theme={null} "statements": [ "allow group MONITORING_GROUP to manage all-resources in compartment my-compartment", "allow group OTHER_GROUP to manage users in tenancy" ] ``` Change to something like: ```json theme={null} "statements": [ "allow group MONITORING_GROUP to read metrics in compartment my-compartment where target.metrics.namespace = 'my_app_ns'", "allow group MONITORING_GROUP to manage alarms in compartment my-compartment", "allow group OTHER_GROUP to manage users in tenancy" ] ``` Save this minimal JSON file (for update) as `updated-statements.json`: ```json theme={null} { "statements": [ "allow group MONITORING_GROUP to read metrics in compartment my-compartment where target.metrics.namespace = 'my_app_ns'", "allow group MONITORING_GROUP to manage alarms in compartment my-compartment", "allow group OTHER_GROUP to manage users in tenancy" ] } ``` Alternatively, just keep the array and use `--statements` directly (see next step). *** ## 5. Update the Policy Using OCI CLI Option A – Pass `--statements` directly (simpler): ```bash theme={null} oci iam policy update \ --policy-id POLICY_OCID \ --statements '[ "allow group MONITORING_GROUP to read metrics in compartment my-compartment where target.metrics.namespace = '\''my_app_ns'\''", "allow group MONITORING_GROUP to manage alarms in compartment my-compartment", "allow group OTHER_GROUP to manage users in tenancy" ]' \ --if-match "$(oci iam policy get --policy-id POLICY_OCID --query 'data."etag"' --raw-output)" ``` Note the quoting: `'` around JSON, escaped `'` inside the `where` clause. Option B – Use a JSON file: Create `policy-update.json`: ```json theme={null} { "statements": [ "allow group MONITORING_GROUP to read metrics in compartment my-compartment where target.metrics.namespace = 'my_app_ns'", "allow group MONITORING_GROUP to manage alarms in compartment my-compartment", "allow group OTHER_GROUP to manage users in tenancy" ] } ``` Then: ```bash theme={null} ETAG=$(oci iam policy get --policy-id POLICY_OCID --query 'data."etag"' --raw-output) oci iam policy update \ --policy-id POLICY_OCID \ --from-json file://policy-update.json \ --if-match "$ETAG" ``` This replaces the entire `statements` array, removing `manage/use all-resources`. *** ## 6. Verify the Updated Policy ```bash theme={null} oci iam policy get \ --policy-id POLICY_OCID \ --query 'data."statements"' \ --output table ``` Ensure: * No statement includes `manage all-resources` or `use all-resources`. * Monitoring group has only the specific Monitoring permissions you want. *** ## 7. (Optional) Split Broad Policies into Separate Monitoring‑Specific Policy Instead of mixing Monitoring and non‑Monitoring permissions in a single policy, you can: 1. **Create** a new Monitoring policy: ```bash theme={null} oci iam policy create \ --compartment-id COMPARTMENT_OCID \ --name "monitoring-least-privilege-policy" \ --description "Least-privilege Monitoring access" \ --statements '[ "allow group MONITORING_GROUP to read metrics in compartment my-compartment where target.metrics.namespace = '\''my_app_ns'\''", "allow group MONITORING_GROUP to manage alarms in compartment my-compartment" ]' ``` 2. **Edit the old policy** to remove `MONITORING_GROUP` lines, keeping only non‑Monitoring ones. *** If you paste a sample of your current problematic policy statements, I can give you an exact `oci iam policy update` command tailored to your case. Below is a practical way to detect and remediate OCI IAM policies that grant `manage`/`use` on `all-resources`, and then restrict them to Monitoring-only permissions using Python and the OCI SDK. *** ## 1. Decide What “Monitoring-Only” Access Should Be Typical least-privilege Monitoring permissions look like: **Read-only monitoring** (view metrics and alarms): ```text theme={null} allow group to read metrics in compartment allow group to read alarms in compartment allow group to use metrics-family in compartment ``` **If you genuinely need to manage alarms:** ```text theme={null} allow group to manage alarms in compartment allow group to use metrics-family in compartment ``` Replace: * `` with the actual group name used in the overbroad policy. * `` with the correct compartment. You will be replacing overbroad statements like: ```text theme={null} allow group to manage all-resources in tenancy allow group to use all-resources in compartment ``` with the minimal set above. *** ## 2. Install and Configure the OCI Python SDK ```bash theme={null} pip install oci ``` Set up your `~/.oci/config` or environment variables (tenancy, user OCID, key, region). Example `~/.oci/config`: ```ini theme={null} [DEFAULT] user=ocid1.user.oc1..aaaa... fingerprint=aa:bb:cc:dd:... key_file=~/.oci/oci_api_key.pem tenancy=ocid1.tenancy.oc1..aaaa... region=eu-frankfurt-1 ``` *** ## 3. Python Script: Find and Fix Overbroad Policies This script: 1. Lists policies in a given compartment or tenancy. 2. Looks for statements containing `manage all-resources` or `use all-resources`. 3. For statements containing a target group you care about, it: * Removes the overbroad lines. * Appends Monitoring-only statements. 4. Updates the policy. **Important:** * Run in **dry-run mode** first (set `DRY_RUN = True`) to see what would change. * Adjust `TARGET_GROUPS`, `MONITORING_STATEMENTS`, and compartments to match your environment. ```python theme={null} import oci import re # ---------- CONFIG ---------- PROFILE = "DEFAULT" # profile in ~/.oci/config COMPARTMENT_OCID = "" # where policies live DRY_RUN = True # set to False when you are sure TARGET_GROUPS = ["MyMonitoringGroup"] # groups you want to fix # -------------------------------- # Minimal monitoring-only policy lines to add per group and compartment def monitoring_statements_for_group(group_name, compartment_name): return [ f"allow group {group_name} to read metrics in compartment {compartment_name}", f"allow group {group_name} to read alarms in compartment {compartment_name}", f"allow group {group_name} to use metrics-family in compartment {compartment_name}", # uncomment if they must manage alarms # f"allow group {group_name} to manage alarms in compartment {compartment_name}", ] def main(): config = oci.config.from_file(profile_name=PROFILE) identity_client = oci.identity.IdentityClient(config) # List policies in the chosen compartment/tenancy policies = oci.pagination.list_call_get_all_results( identity_client.list_policies, compartment_id=COMPARTMENT_OCID ).data for policy in policies: original_statements = list(policy.statements or []) new_statements = [] modified = False print(f"\nChecking policy: {policy.name} ({policy.id})") # Determine compartment name (optional, for better rules) try: comp = identity_client.get_compartment(policy.compartment_id).data compartment_name = comp.name except Exception: compartment_name = "ROOT" # fallback; adjust as needed for stmt in original_statements: stmt_stripped = stmt.strip() lower_stmt = stmt_stripped.lower() # Does this statement grant manage/use all-resources? if ( (" manage all-resources " in lower_stmt or " use all-resources " in lower_stmt or lower_stmt.endswith(" manage all-resources") or lower_stmt.endswith(" use all-resources")) and "group " in lower_stmt ): # Check if this statement involves one of our target groups involves_target = any( re.search(rf"\bgroup\s+{re.escape(g.lower())}\b", lower_stmt) for g in TARGET_GROUPS ) if involves_target: print(f" - Found overbroad statement to fix: '{stmt_stripped}'") modified = True # For each group in this statement, add monitoring-only rules for g in TARGET_GROUPS: if re.search(rf"\bgroup\s+{re.escape(g.lower())}\b", lower_stmt): ms = monitoring_statements_for_group(g, compartment_name) print(f" -> Replacing with least-privilege Monitoring rules for group {g}:") for line in ms: print(f" {line}") if line not in new_statements: new_statements.append(line) # Do NOT keep the overbroad statement continue # If statement is not overbroad (or not on target group), keep as-is new_statements.append(stmt_stripped) if modified: print(f"\nPolicy '{policy.name}' will be UPDATED.") print("Old statements:") for s in original_statements: print(f" {s}") print("New statements:") for s in new_statements: print(f" {s}") if not DRY_RUN: update_details = oci.identity.models.UpdatePolicyDetails( description=policy.description, statements=new_statements, version_date=policy.version_date ) identity_client.update_policy(policy.id, update_details) print(f"Policy '{policy.name}' updated.") else: print("DRY RUN: No changes sent to OCI.") else: print(" No overbroad Monitoring-related statements found to remediate.") if __name__ == "__main__": main() ``` *** ## 4. Steps to Use Safely 1. Fill in: * `COMPARTMENT_OCID` * `TARGET_GROUPS` 2. Start with `DRY_RUN = True`. 3. Review the script’s console output for each policy. 4. Once satisfied, set `DRY_RUN = False` and run again. 5. Test that Monitoring users can still perform required actions (view metrics/alarms, manage alarms if needed). If you share an example of one of your current overbroad policy statements, I can give you the exact replacement statements and a tighter filter for the script. ```hcl theme={null} resource "oci_identity_policy" "monitoring_policy" { # Replace with your tenancy or compartment OCID that owns the policy compartment_id = "OCID_OF_TENANCY_OR_COMPARTMENT" name = "MONITORING_POLICY_NAME" description = "Least-privilege IAM policy for Monitoring" # Replace GROUP_NAME with the name of the IAM group that needs Monitoring access # Replace COMPARTMENT_OCID_WITH_MONITORED_RESOURCES with the compartment OCID whose resources are being monitored statements = [ # Narrowed from: "Allow group GROUP_NAME to manage all-resources in tenancy" # or: "Allow group GROUP_NAME to use all-resources in tenancy" "Allow group GROUP_NAME to use metrics in tenancy", "Allow group GROUP_NAME to manage alarms in compartment COMPARTMENT_OCID_WITH_MONITORED_RESOURCES" ] } ``` Changing the `statements` of `oci_identity_policy` updates the policy in place and does not force replacement of the resource. For verification, `terraform plan` should show the existing `oci_identity_policy` with its `statements` being updated from `manage/use all-resources` to the more specific Monitoring permissions shown above, with no other changes.