> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI IAM Service Administrator Group Should Be Defined ### More Info: A service administrators group should be defined with active members. Without dedicated service admin roles, access management lacks proper segregation of duties. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate “OCI IAM Service Administrator Group Should Be Defined” using the OCI Console, you essentially need to: 1. Create (or verify) a group for IAM Service Administrators 2. Attach the correct policies to that group 3. (Optionally) Assign users to the group Below are the step‑by‑step instructions in the OCI Console. *** ### 1. Identify the Relevant Compartment / Domain 1. Sign in to the **OCI Console**. 2. In the top-left, open the **Navigation menu**. 3. Go to **Identity & Security** → * If you use **OCI IAM Identity Domains**: choose **Identity Domains** → select your domain. * If you use the **classic IAM** model: choose **Identity** (or **Identity & Security** → **Users, Groups & Policies** depending on your tenancy view). Use the same scope (tenancy/compartment/domain) where you manage IAM and security policies. *** ### 2. Create an “IAM Service Administrators” Group **For IAM Identity Domains** 1. In your identity domain, go to **Groups**. 2. Click **Create group**. 3. Name it something like: `IAM-Service-Admins` (or the name required by your policy/standard). 4. Add a description, e.g. “Group for IAM Service Administrators with permissions to manage IAM resources.” 5. Click **Create**. **For Classic IAM (Tenancy-level Groups)** 1. Under **Identity & Security** → **Identity** → **Groups**. 2. Click **Create Group**. 3. Enter: * **Name**: `IAM-Service-Admins` * **Description**: “Group for IAM Service Administrators with permissions to manage IAM resources.” 4. Click **Create**. *** ### 3. Attach Policies Granting IAM Service Admin Rights You need tenancy-level (or appropriate compartment-level) policies allowing management of IAM resources. Typically this is at the **tenancy** level for central IAM administration. 1. Go to **Identity & Security** → **Identity** → **Policies**. 2. In the **Compartment** selector, choose the **tenancy (root)** compartment (unless your org uses a different pattern). 3. Click **Create Policy**. Example policy (tenancy-level) for a strong IAM Service Admin role: * **Name**: `iam-service-admin-policy` * **Description**: `Policy granting IAM service admin rights to IAM-Service-Admins group` * **Compartment**: tenancy/root * **Statements** (start with these and tighten as needed): ```text theme={null} Allow group IAM-Service-Admins to manage users in tenancy Allow group IAM-Service-Admins to manage groups in tenancy Allow group IAM-Service-Admins to manage policies in tenancy Allow group IAM-Service-Admins to manage dynamic-groups in tenancy Allow group IAM-Service-Admins to manage compartments in tenancy Allow group IAM-Service-Admins to manage authentication-policies in tenancy Allow group IAM-Service-Admins to manage identity-providers in tenancy Allow group IAM-Service-Admins to manage tag-namespaces in tenancy Allow group IAM-Service-Admins to manage tag-defaults in tenancy Allow group IAM-Service-Admins to manage domains in tenancy ``` 4. Click **Create**. Adjust statements if your security baseline prescribes a narrower scope (for example, only specific IAM resources). *** ### 4. Add Users to the IAM Service Admin Group **Identity Domains** 1. Within the identity domain, open **Groups**. 2. Click the `IAM-Service-Admins` group. 3. Go to **Members** → **Add members**. 4. Select the appropriate users. 5. Click **Add** / **Save**. **Classic IAM** 1. Go to **Identity** → **Users**. 2. For each user who should be an IAM Service Administrator: * Click the user name. * Go to **Groups** tab. * Click **Add User to Group**. * Select `IAM-Service-Admins`. * Click **Add**. *** ### 5. Confirm the Misconfiguration Clears in Monitoring 1. Wait for your **OCI Security Zones / Cloud Guard / IAM Monitoring** (depending on what you use) to re-evaluate. 2. In the service that raised “OCI IAM Service Administrator Group Should Be Defined,” check that: * A group exists with the intended name/role, and * Policies granting IAM admin permissions are attached. If your monitoring tool expects a specific **group name** or exact **policy pattern**, align your group name and policy statements to that standard, then re-run the compliance check. Below are concise, step‑by‑step OCI CLI instructions to ensure an **IAM Service Administrator group** exists and is properly configured for monitoring. Assumptions: * You have OCI CLI configured with appropriate tenancy-level permissions. * You know your **tenancy OCID**: `ocid1.tenancy.oc1...` * You want a group named `IAM-Service-Admins` (change as needed). *** ### 1. Set common variables (optional, for convenience) ```bash theme={null} TENANCY_OCID="" COMPARTMENT_OCID="$TENANCY_OCID" # IAM resources are at tenancy level GROUP_NAME="IAM-Service-Admins" ``` *** ### 2. Check if the IAM Service Administrator group already exists ```bash theme={null} oci iam group list \ --compartment-id "$TENANCY_OCID" \ --all \ --query "data[?name=='$GROUP_NAME']" ``` * If this returns an object, the group exists—note its `id` and skip to step 4. * If it returns `[]`, create it. *** ### 3. Create the IAM Service Administrator group (if missing) ```bash theme={null} oci iam group create \ --compartment-id "$TENANCY_OCID" \ --name "$GROUP_NAME" \ --description "Group for IAM Service Administrators" ``` * Capture the group OCID from the output: ```bash theme={null} GROUP_OCID="" ``` (If you already had the group from step 2, set `GROUP_OCID` to that ID instead.) *** ### 4. Create / ensure an IAM policy for Service Administrators Example: full IAM admin at tenancy level (adjust to your policy standard / CIS profile). ```bash theme={null} POLICY_NAME="IAM-Service-Admins-Policy" oci iam policy list \ --compartment-id "$TENANCY_OCID" \ --all \ --query "data[?name=='$POLICY_NAME']" ``` If empty, create: ```bash theme={null} oci iam policy create \ --compartment-id "$TENANCY_OCID" \ --name "$POLICY_NAME" \ --description "Policy granting IAM administration to IAM-Service-Admins group" \ --statements '[ "Allow group '"$GROUP_NAME"' to manage users in tenancy", "Allow group '"$GROUP_NAME"' to manage groups in tenancy", "Allow group '"$GROUP_NAME"' to manage policies in tenancy", "Allow group '"$GROUP_NAME"' to inspect compartments in tenancy" ]' ``` If the policy exists but needs updating, edit the JSON statements and run: ```bash theme={null} oci iam policy update \ --policy-id "" \ --statements '[ "Allow group '"$GROUP_NAME"' to manage users in tenancy", "Allow group '"$GROUP_NAME"' to manage groups in tenancy", "Allow group '"$GROUP_NAME"' to manage policies in tenancy", "Allow group '"$GROUP_NAME"' to inspect compartments in tenancy" ]' ``` *** ### 5. Add appropriate users to the IAM Service Administrator group List users to identify the ones to add: ```bash theme={null} oci iam user list --compartment-id "$TENANCY_OCID" --all ``` Add a user to the group: ```bash theme={null} USER_OCID="" oci iam group membership create \ --group-id "$GROUP_OCID" \ --user-id "$USER_OCID" ``` Repeat for each IAM administrator. *** ### 6. Validate for monitoring / compliance Re-list the group and its memberships (for evidence/monitoring): ```bash theme={null} # Confirm group oci iam group list \ --compartment-id "$TENANCY_OCID" \ --all \ --query "data[?name=='$GROUP_NAME']" # Confirm memberships oci iam group membership list \ --compartment-id "$TENANCY_OCID" \ --all \ --query "data[?\"group-id\"=='$GROUP_OCID']" # Confirm policy oci iam policy list \ --compartment-id "$TENANCY_OCID" \ --all \ --query "data[?name=='$POLICY_NAME']" ``` These commands and configuration will satisfy a control such as “OCI IAM Service Administrator Group Should Be Defined” for IAM monitoring. Below is how you can automatically **check and remediate** the “OCI IAM Service Administrator Group Should Be Defined” issue using **Python + OCI SDK**. *** ## 1. What needs to exist Typically the check means: 1. There should be an IAM **Group** for service admins (e.g., `Service-Admins`). 2. There should be an IAM **Policy** attached at the tenancy level that grants the group appropriate permissions, for example: ```text theme={null} Allow group Service-Admins to manage all-resources in tenancy ``` (Adjust the policy statement to your org’s standard if needed.) *** ## 2. Prerequisites 1. Install OCI Python SDK: ```bash theme={null} pip install oci ``` 2. Configure OCI CLI/SDK credentials on the machine running the script: * `~/.oci/config` with a profile, e.g. `[DEFAULT]`, including: * `tenancy=ocid1.tenancy.oc1...` * `user=ocid1.user.oc1...` * `fingerprint=...` * `key_file=/path/to/private_key.pem` * `region=...` 3. The principal running the script needs IAM permissions to: * `manage groups in tenancy` * `manage policies in tenancy` *** ## 3. Python script: detect & remediate This script will: 1. Connect using the SDK. 2. Check if the **Service-Admins** group exists; create it if missing. 3. Check if a **policy** granting appropriate privileges exists; create it if missing. ```python theme={null} import oci from oci.identity.models import CreateGroupDetails, CreatePolicyDetails # ----- CONFIGURE THESE ----- PROFILE_NAME = "DEFAULT" # OCI config profile SERVICE_ADMIN_GROUP_NAME = "Service-Admins" SERVICE_ADMIN_GROUP_DESC = "Group for IAM Service Administrators" POLICY_NAME = "Service-Admins-Policy" POLICY_DESC = "Policy for Service Administrators group" # Example policy statement; adjust to your org’s standard POLICY_STATEMENTS = [ "Allow group Service-Admins to manage all-resources in tenancy" ] # --------------------------- def get_identity_client(profile_name: str = "DEFAULT"): config = oci.config.from_file("~/.oci/config", profile_name) identity_client = oci.identity.IdentityClient(config) tenancy_id = config["tenancy"] return identity_client, tenancy_id def get_group_by_name(identity_client, tenancy_id, group_name): groups = oci.pagination.list_call_get_all_results( identity_client.list_groups, compartment_id=tenancy_id ).data for g in groups: if g.name == group_name: return g return None def create_service_admin_group(identity_client, tenancy_id): details = CreateGroupDetails( compartment_id=tenancy_id, name=SERVICE_ADMIN_GROUP_NAME, description=SERVICE_ADMIN_GROUP_DESC ) response = identity_client.create_group(details) return response.data def get_policy_by_name(identity_client, tenancy_id, policy_name): policies = oci.pagination.list_call_get_all_results( identity_client.list_policies, compartment_id=tenancy_id ).data for p in policies: if p.name == policy_name: return p return None def create_service_admin_policy(identity_client, tenancy_id, group_name): details = CreatePolicyDetails( compartment_id=tenancy_id, name=POLICY_NAME, description=POLICY_DESC, statements=POLICY_STATEMENTS, version_date=None # optional ) response = identity_client.create_policy(details) return response.data def main(): identity_client, tenancy_id = get_identity_client(PROFILE_NAME) # 1. Ensure Service-Admins group exists group = get_group_by_name(identity_client, tenancy_id, SERVICE_ADMIN_GROUP_NAME) if group is None: print(f"Group '{SERVICE_ADMIN_GROUP_NAME}' not found; creating...") group = create_service_admin_group(identity_client, tenancy_id) print(f"Created group: {group.name} (OCID: {group.id})") else: print(f"Group '{SERVICE_ADMIN_GROUP_NAME}' already exists (OCID: {group.id})") # 2. Ensure Service-Admins policy exists policy = get_policy_by_name(identity_client, tenancy_id, POLICY_NAME) if policy is None: print(f"Policy '{POLICY_NAME}' not found; creating...") policy = create_service_admin_policy(identity_client, tenancy_id, SERVICE_ADMIN_GROUP_NAME) print(f"Created policy: {policy.name} (OCID: {policy.id})") else: print(f"Policy '{POLICY_NAME}' already exists (OCID: {policy.id})") # Optional: verify/adjust statements if needed if __name__ == "__main__": main() ``` *** ## 4. How to use for monitoring * Run this script periodically (e.g., via cron, OCI Functions, or a CI pipeline). * It acts as both **monitoring** (detecting missing group/policy) and **auto-remediation** (creating them when absent). * If you only want monitoring, remove the `create_*` calls and just alert/log when group or policy is missing. ```hcl theme={null} resource "oci_identity_group" "service_admins" { # Replace with your tenancy OCID (root compartment) compartment_id = "OCID_OF_TENANCY" # Name visible in IAM; adjust if your org uses another standard name name = "service-admins" description = "Service Administrators group for managing OCI services" } resource "oci_identity_user_group_membership" "service_admins_member" { # Replace with the OCID of an existing IAM user who should be a service admin user_id = "OCID_OF_SERVICE_ADMIN_USER" group_id = oci_identity_group.service_admins.id } ``` Changing the `name` of `oci_identity_group.service_admins` later will force replacement of the group (and thus memberships), which can briefly impact access. Verify with `terraform plan` showing creation of `oci_identity_group.service_admins` and at least one `oci_identity_user_group_membership.service_admins_member`.