OCI IAM Service Administrator Group Should Be Defined

Using Console

To remediate “OCI IAM Service Administrator Group Should Be Defined” using the OCI Console, you essentially need to:

Create (or verify) a group for IAM Service Administrators
Attach the correct policies to that group
(Optionally) Assign users to the group

Below are the step‑by‑step instructions in the OCI Console.

1. Identify the Relevant Compartment / Domain

Sign in to the OCI Console.
In the top-left, open the Navigation menu.
Go to Identity & Security →
- If you use OCI IAM Identity Domains: choose Identity Domains → select your domain.
- If you use the classic IAM model: choose Identity (or Identity & Security → Users, Groups & Policies depending on your tenancy view).

Use the same scope (tenancy/compartment/domain) where you manage IAM and security policies.

2. Create an “IAM Service Administrators” Group

For IAM Identity Domains

In your identity domain, go to Groups.
Click Create group.
Name it something like: IAM-Service-Admins (or the name required by your policy/standard).
Add a description, e.g. “Group for IAM Service Administrators with permissions to manage IAM resources.”
Click Create.

For Classic IAM (Tenancy-level Groups)

Under Identity & Security → Identity → Groups.
Click Create Group.
Enter:
- Name: IAM-Service-Admins
- Description: “Group for IAM Service Administrators with permissions to manage IAM resources.”
Click Create.

3. Attach Policies Granting IAM Service Admin Rights

You need tenancy-level (or appropriate compartment-level) policies allowing management of IAM resources. Typically this is at the tenancy level for central IAM administration.

Go to Identity & Security → Identity → Policies.
In the Compartment selector, choose the tenancy (root) compartment (unless your org uses a different pattern).
Click Create Policy.

Example policy (tenancy-level) for a strong IAM Service Admin role:

Name: iam-service-admin-policy
Description: Policy granting IAM service admin rights to IAM-Service-Admins group
Compartment: tenancy/root
Statements (start with these and tighten as needed):

Allow group IAM-Service-Admins to manage users in tenancy
Allow group IAM-Service-Admins to manage groups in tenancy
Allow group IAM-Service-Admins to manage policies in tenancy
Allow group IAM-Service-Admins to manage dynamic-groups in tenancy
Allow group IAM-Service-Admins to manage compartments in tenancy
Allow group IAM-Service-Admins to manage authentication-policies in tenancy
Allow group IAM-Service-Admins to manage identity-providers in tenancy
Allow group IAM-Service-Admins to manage tag-namespaces in tenancy
Allow group IAM-Service-Admins to manage tag-defaults in tenancy
Allow group IAM-Service-Admins to manage domains in tenancy

Click Create.

Adjust statements if your security baseline prescribes a narrower scope (for example, only specific IAM resources).

4. Add Users to the IAM Service Admin Group

Identity Domains

Within the identity domain, open Groups.
Click the IAM-Service-Admins group.
Go to Members → Add members.
Select the appropriate users.
Click Add / Save.

Classic IAM

Go to Identity → Users.
For each user who should be an IAM Service Administrator:
- Click the user name.
- Go to Groups tab.
- Click Add User to Group.
- Select IAM-Service-Admins.
- Click Add.

5. Confirm the Misconfiguration Clears in Monitoring

Wait for your OCI Security Zones / Cloud Guard / IAM Monitoring (depending on what you use) to re-evaluate.
In the service that raised “OCI IAM Service Administrator Group Should Be Defined,” check that:
- A group exists with the intended name/role, and
- Policies granting IAM admin permissions are attached.

If your monitoring tool expects a specific group name or exact policy pattern, align your group name and policy statements to that standard, then re-run the compliance check.

Using CLI

Below are concise, step‑by‑step OCI CLI instructions to ensure an IAM Service Administrator group exists and is properly configured for monitoring.Assumptions:

You have OCI CLI configured with appropriate tenancy-level permissions.
You know your tenancy OCID: ocid1.tenancy.oc1...
You want a group named IAM-Service-Admins (change as needed).

1. Set common variables (optional, for convenience)

TENANCY_OCID="<your-tenancy-ocid>"
COMPARTMENT_OCID="$TENANCY_OCID"   # IAM resources are at tenancy level
GROUP_NAME="IAM-Service-Admins"

2. Check if the IAM Service Administrator group already exists

oci iam group list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?name=='$GROUP_NAME']"

If this returns an object, the group exists—note its id and skip to step 4.
If it returns [], create it.

3. Create the IAM Service Administrator group (if missing)

oci iam group create \
  --compartment-id "$TENANCY_OCID" \
  --name "$GROUP_NAME" \
  --description "Group for IAM Service Administrators"

Capture the group OCID from the output:

GROUP_OCID="<returned-group-ocid>"

(If you already had the group from step 2, set GROUP_OCID to that ID instead.)

4. Create / ensure an IAM policy for Service Administrators

Example: full IAM admin at tenancy level (adjust to your policy standard / CIS profile).

POLICY_NAME="IAM-Service-Admins-Policy"

oci iam policy list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?name=='$POLICY_NAME']"

If empty, create:

oci iam policy create \
  --compartment-id "$TENANCY_OCID" \
  --name "$POLICY_NAME" \
  --description "Policy granting IAM administration to IAM-Service-Admins group" \
  --statements '[
    "Allow group '"$GROUP_NAME"' to manage users in tenancy",
    "Allow group '"$GROUP_NAME"' to manage groups in tenancy",
    "Allow group '"$GROUP_NAME"' to manage policies in tenancy",
    "Allow group '"$GROUP_NAME"' to inspect compartments in tenancy"
  ]'

If the policy exists but needs updating, edit the JSON statements and run:

oci iam policy update \
  --policy-id "<policy-ocid>" \
  --statements '[
    "Allow group '"$GROUP_NAME"' to manage users in tenancy",
    "Allow group '"$GROUP_NAME"' to manage groups in tenancy",
    "Allow group '"$GROUP_NAME"' to manage policies in tenancy",
    "Allow group '"$GROUP_NAME"' to inspect compartments in tenancy"
  ]'

5. Add appropriate users to the IAM Service Administrator group

List users to identify the ones to add:

oci iam user list --compartment-id "$TENANCY_OCID" --all

Add a user to the group:

USER_OCID="<user-ocid-to-add>"

oci iam group membership create \
  --group-id "$GROUP_OCID" \
  --user-id "$USER_OCID"

Repeat for each IAM administrator.

6. Validate for monitoring / compliance

Re-list the group and its memberships (for evidence/monitoring):

# Confirm group
oci iam group list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?name=='$GROUP_NAME']"

# Confirm memberships
oci iam group membership list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?\"group-id\"=='$GROUP_OCID']"

# Confirm policy
oci iam policy list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?name=='$POLICY_NAME']"

These commands and configuration will satisfy a control such as “OCI IAM Service Administrator Group Should Be Defined” for IAM monitoring.

Using Python

Below is how you can automatically check and remediate the “OCI IAM Service Administrator Group Should Be Defined” issue using Python + OCI SDK.

1. What needs to exist

Typically the check means:

There should be an IAM Group for service admins (e.g., Service-Admins).
There should be an IAM Policy attached at the tenancy level that grants the group appropriate permissions, for example:

Allow group Service-Admins to manage all-resources in tenancy

(Adjust the policy statement to your org’s standard if needed.)

2. Prerequisites

Install OCI Python SDK:

pip install oci

Configure OCI CLI/SDK credentials on the machine running the script:

~/.oci/config with a profile, e.g. [DEFAULT], including:
- tenancy=ocid1.tenancy.oc1...
- user=ocid1.user.oc1...
- fingerprint=...
- key_file=/path/to/private_key.pem
- region=...

The principal running the script needs IAM permissions to:
- manage groups in tenancy
- manage policies in tenancy

3. Python script: detect & remediate

This script will:

Connect using the SDK.
Check if the Service-Admins group exists; create it if missing.
Check if a policy granting appropriate privileges exists; create it if missing.

import oci
from oci.identity.models import CreateGroupDetails, CreatePolicyDetails

# ----- CONFIGURE THESE -----
PROFILE_NAME = "DEFAULT"  # OCI config profile
SERVICE_ADMIN_GROUP_NAME = "Service-Admins"
SERVICE_ADMIN_GROUP_DESC = "Group for IAM Service Administrators"
POLICY_NAME = "Service-Admins-Policy"
POLICY_DESC = "Policy for Service Administrators group"
# Example policy statement; adjust to your org’s standard
POLICY_STATEMENTS = [
    "Allow group Service-Admins to manage all-resources in tenancy"
]
# ---------------------------

def get_identity_client(profile_name: str = "DEFAULT"):
    config = oci.config.from_file("~/.oci/config", profile_name)
    identity_client = oci.identity.IdentityClient(config)
    tenancy_id = config["tenancy"]
    return identity_client, tenancy_id

def get_group_by_name(identity_client, tenancy_id, group_name):
    groups = oci.pagination.list_call_get_all_results(
        identity_client.list_groups,
        compartment_id=tenancy_id
    ).data

    for g in groups:
        if g.name == group_name:
            return g
    return None

def create_service_admin_group(identity_client, tenancy_id):
    details = CreateGroupDetails(
        compartment_id=tenancy_id,
        name=SERVICE_ADMIN_GROUP_NAME,
        description=SERVICE_ADMIN_GROUP_DESC
    )
    response = identity_client.create_group(details)
    return response.data

def get_policy_by_name(identity_client, tenancy_id, policy_name):
    policies = oci.pagination.list_call_get_all_results(
        identity_client.list_policies,
        compartment_id=tenancy_id
    ).data

    for p in policies:
        if p.name == policy_name:
            return p
    return None

def create_service_admin_policy(identity_client, tenancy_id, group_name):
    details = CreatePolicyDetails(
        compartment_id=tenancy_id,
        name=POLICY_NAME,
        description=POLICY_DESC,
        statements=POLICY_STATEMENTS,
        version_date=None  # optional
    )
    response = identity_client.create_policy(details)
    return response.data

def main():
    identity_client, tenancy_id = get_identity_client(PROFILE_NAME)

    # 1. Ensure Service-Admins group exists
    group = get_group_by_name(identity_client, tenancy_id, SERVICE_ADMIN_GROUP_NAME)
    if group is None:
        print(f"Group '{SERVICE_ADMIN_GROUP_NAME}' not found; creating...")
        group = create_service_admin_group(identity_client, tenancy_id)
        print(f"Created group: {group.name} (OCID: {group.id})")
    else:
        print(f"Group '{SERVICE_ADMIN_GROUP_NAME}' already exists (OCID: {group.id})")

    # 2. Ensure Service-Admins policy exists
    policy = get_policy_by_name(identity_client, tenancy_id, POLICY_NAME)
    if policy is None:
        print(f"Policy '{POLICY_NAME}' not found; creating...")
        policy = create_service_admin_policy(identity_client, tenancy_id, SERVICE_ADMIN_GROUP_NAME)
        print(f"Created policy: {policy.name} (OCID: {policy.id})")
    else:
        print(f"Policy '{POLICY_NAME}' already exists (OCID: {policy.id})")
        # Optional: verify/adjust statements if needed

if __name__ == "__main__":
    main()

4. How to use for monitoring

Run this script periodically (e.g., via cron, OCI Functions, or a CI pipeline).
It acts as both monitoring (detecting missing group/policy) and auto-remediation (creating them when absent).
If you only want monitoring, remove the create_* calls and just alert/log when group or policy is missing.

Using Terraform

resource "oci_identity_group" "service_admins" {
  # Replace with your tenancy OCID (root compartment)
  compartment_id = "OCID_OF_TENANCY"

  # Name visible in IAM; adjust if your org uses another standard name
  name        = "service-admins"
  description = "Service Administrators group for managing OCI services"
}

resource "oci_identity_user_group_membership" "service_admins_member" {
  # Replace with the OCID of an existing IAM user who should be a service admin
  user_id  = "OCID_OF_SERVICE_ADMIN_USER"
  group_id = oci_identity_group.service_admins.id
}

Changing the name of oci_identity_group.service_admins later will force replacement of the group (and thus memberships), which can briefly impact access.Verify with terraform plan showing creation of oci_identity_group.service_admins and at least one oci_identity_user_group_membership.service_admins_member.

OCI Misconfigurations

OCI IAM Service Administrator Group Should Be Defined

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the Relevant Compartment / Domain

2. Create an “IAM Service Administrators” Group

3. Attach Policies Granting IAM Service Admin Rights

4. Add Users to the IAM Service Admin Group

5. Confirm the Misconfiguration Clears in Monitoring

1. Set common variables (optional, for convenience)

2. Check if the IAM Service Administrator group already exists

3. Create the IAM Service Administrator group (if missing)

4. Create / ensure an IAM policy for Service Administrators

5. Add appropriate users to the IAM Service Administrator group

6. Validate for monitoring / compliance

1. What needs to exist

2. Prerequisites

3. Python script: detect & remediate

4. How to use for monitoring

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Identify the Relevant Compartment / Domain

​2. Create an “IAM Service Administrators” Group

​3. Attach Policies Granting IAM Service Admin Rights

​4. Add Users to the IAM Service Admin Group

​5. Confirm the Misconfiguration Clears in Monitoring

​1. Set common variables (optional, for convenience)

​2. Check if the IAM Service Administrator group already exists

​3. Create the IAM Service Administrator group (if missing)

​4. Create / ensure an IAM policy for Service Administrators

​5. Add appropriate users to the IAM Service Administrator group

​6. Validate for monitoring / compliance

​1. What needs to exist

​2. Prerequisites

​3. Python script: detect & remediate

​4. How to use for monitoring

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the Relevant Compartment / Domain

2. Create an “IAM Service Administrators” Group

3. Attach Policies Granting IAM Service Admin Rights

4. Add Users to the IAM Service Admin Group

5. Confirm the Misconfiguration Clears in Monitoring

1. Set common variables (optional, for convenience)

2. Check if the IAM Service Administrator group already exists

3. Create the IAM Service Administrator group (if missing)

4. Create / ensure an IAM policy for Service Administrators

5. Add appropriate users to the IAM Service Administrator group

6. Validate for monitoring / compliance

1. What needs to exist

2. Prerequisites

3. Python script: detect & remediate

4. How to use for monitoring