> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Excessive number of owners

### More Info:

Having too many owners of a Git organization increases the risk of a serious compromise from lost credentials.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are step‑by‑step instructions to reduce the number of **Owners** in a GitHub organization using the **GitHub web console (UI)**.

        ***

        ### 1. Prerequisites and planning

        1. Ensure you are currently an **Owner** of the organization.
        2. Decide:
           * Who should remain as **Owners** (usually 2–3 trusted admins, for redundancy).
           * Which users should be **downgraded** to:
             * **Member**, or
             * **Team maintainer** (via teams) if they only need repo-level admin capabilities.

        ***

        ### 2. List and review current Owners

        1. Sign in to GitHub: `https://github.com`.
        2. In the upper-right corner, click your profile picture → **Your organizations**.
        3. Click the organization name you want to manage.
        4. In the org view, click the **People** tab.
        5. Filter by role:
           * On the right side (or top filters), use **Role** filter and select **Owner**.
           * This shows all current Owners.

        Review each Owner and confirm who truly needs org‑wide admin rights (billing, SSO, security policies, app installation, etc.).

        ***

        ### 3. Change a user from Owner to Member

        For each user who should no longer be an Owner:

        1. On the **People** tab (with **Owner** filtered), find the specific user.
        2. On the right side of that row, click the **…** (actions) menu.
        3. Click **Change role** (or similar wording depending on UI version).
        4. In the role selection dialog:
           * Change role from **Owner** to **Member**.
        5. Click **Save** or **Update role**.

        Repeat this for every user you want to downgrade from Owner to Member, ensuring you keep at least one or two Owners.

        ***

        ### 4. Use Teams instead of more Owners (optional but recommended)

        For users who previously were Owners only to manage repositories:

        1. Still in your organization, click the **Teams** tab.
        2. Either:
           * Create a new team: **New team** → give it a name (e.g., `org-admins`, `platform-team`) → set appropriate repository access; or
           * Use an existing team.
        3. Add the downgraded users as **Maintainers** of that team:
           * Open the team → **Members** → **Add a member**.
           * After adding, change their role in the team to **Maintainer** if they need to manage team members and repo access.

        This lets them manage repos and teams without needing full Owner rights.

        ***

        ### 5. Verify minimum Owners and test

        1. Go back to **People** → filter by **Owner** and confirm:
           * Only the intended small set of users remain as **Owners**.
        2. Validate:
           * Owners can still manage billing, security settings, and org‑level apps.
           * Former Owners (now Members) can still perform their daily tasks via:
             * Repo admin permissions, and/or
             * Team maintainer roles.

        ***

        These steps fully remediate the “excessive number of owners” issue using the GitHub web console.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a concrete, minimal workflow to reduce excessive GitHub organization owners using the GitHub CLI (`gh`).

        ### 0. Prerequisites

        1. You are currently an **organization owner**.
        2. You have `gh` installed and authenticated:
           ```bash theme={null}
           gh auth login --scopes admin:org,read:org
           ```

        ***

        ### 1. Identify all organization owners

        Replace `ORG_NAME` with your org:

        ```bash theme={null}
        ORG="ORG_NAME"

        # List all owners (role=admin)
        gh api \
          -H "Accept: application/vnd.github+json" \
          /orgs/$ORG/members --paginate -f role=admin \
          --jq '.[].login'
        ```

        Save them for reference:

        ```bash theme={null}
        gh api \
          -H "Accept: application/vnd.github+json" \
          /orgs/$ORG/members --paginate -f role=admin \
          --jq '.[].login' > owners.txt
        ```

        ***

        ### 2. Decide who should remain owner

        Manually edit `owners.txt` into two files:

        * `owners_to_keep.txt` – minimal set of true owners (e.g., 2–3 people, break-glass account).
        * `owners_to_downgrade.txt` – everyone else.

        Example (bash):

        ```bash theme={null}
        # create empty file, then manually edit/populate
        cp owners.txt owners_to_keep.txt
        touch owners_to_downgrade.txt
        # edit both files in your editor
        ```

        ***

        ### 3. (Optional) Validate each user still needs org access

        If you want to completely remove some users from the org, list all members:

        ```bash theme={null}
        gh api \
          -H "Accept: application/vnd.github+json" \
          /orgs/$ORG/members --paginate \
          --jq '.[].login' > all_members.txt
        ```

        Create a `members_to_remove.txt` with logins that should be removed entirely (not just downgraded).

        ***

        ### 4. Downgrade unnecessary owners to members

        This keeps them in the org but removes owner privileges:

        ```bash theme={null}
        ORG="ORG_NAME"

        while read USER; do
          echo "Downgrading $USER to member in $ORG..."
          gh api \
            -X PUT \
            -H "Accept: application/vnd.github+json" \
            /orgs/$ORG/memberships/$USER \
            -f role=member
        done < owners_to_downgrade.txt
        ```

        Verify:

        ```bash theme={null}
        gh api \
          -H "Accept: application/vnd.github+json" \
          /orgs/$ORG/members --paginate -f role=admin \
          --jq '.[].login'
        ```

        Ensure only the expected minimal set of owners remains.

        ***

        ### 5. (Optional) Remove users from the org completely

        If some users no longer need any access:

        ```bash theme={null}
        ORG="ORG_NAME"

        while read USER; do
          echo "Removing $USER from $ORG..."
          gh api \
            -X DELETE \
            -H "Accept: application/vnd.github+json" \
            /orgs/$ORG/members/$USER
        done < members_to_remove.txt
        ```

        ***

        ### 6. Enforce stricter process for new owners (policy level)

        Not CLI-enforced, but recommended:

        * Document criteria and approval path for making someone an owner.
        * Restrict changes to owners via change management / tickets.
        * Periodically re-run step 1 and review owners.
      </Accordion>

      <Accordion title="Using Python">
        Below is a concise, step‑by‑step approach to remediate “excessive number of owners” in a GitHub organization using Python.

        Assumptions:

        * You’re working with a **GitHub organization**, and “owners” = members with the **`admin` (owner)** role in that org.
        * You have a **Personal Access Token (PAT)** with at least `admin:org` scope.
        * You want to enumerate all owners, then demote selected ones to regular members.

        ***

        ## 1. Plan and prerequisites

        1. Identify which users must remain owners (e.g., 2–3 primary admins, break-glass accounts).
        2. Get a GitHub PAT with:
           * `admin:org` (Organization members and teams)
        3. Install PyGithub:
           ```bash theme={null}
           pip install PyGithub
           ```

        ***

        ## 2. List all organization owners with Python

        ```python theme={null}
        from github import Github

        GITHUB_TOKEN = "YOUR_PAT"
        ORG_NAME = "your-org-name"

        g = Github(GITHUB_TOKEN)
        org = g.get_organization(ORG_NAME)

        # List all owners (role='admin')
        owners = org.get_members(role="admin")

        print("Current organization owners:")
        for owner in owners:
            print("-", owner.login)
        ```

        Use this to review who currently has owner rights.

        ***

        ## 3. Define who should stay as owners

        Create a Python list of logins that **must remain owners** (never demote them):

        ```python theme={null}
        # Only these users will remain owners
        ALLOWED_OWNERS = {"primary-admin-1", "primary-admin-2"}  # set of GitHub usernames
        ```

        ***

        ## 4. Demote excessive owners to members

        ```python theme={null}
        from github import Github, GithubException

        GITHUB_TOKEN = "YOUR_PAT"
        ORG_NAME = "your-org-name"
        ALLOWED_OWNERS = {"primary-admin-1", "primary-admin-2"}

        g = Github(GITHUB_TOKEN)
        org = g.get_organization(ORG_NAME)

        owners = list(org.get_members(role="admin"))

        for owner in owners:
            username = owner.login
            if username in ALLOWED_OWNERS:
                print(f"Keeping {username} as owner.")
                continue

            try:
                print(f"Demoting {username} from owner to member...")
                # Update membership role to 'member'
                org.update_membership(owner, role="member")
                print(f"Successfully demoted {username}.")
            except GithubException as e:
                print(f"Failed to demote {username}: {e}")
        ```

        Notes:

        * `org.update_membership(user, role="member")` changes a user’s role from owner (admin) to regular member.
        * You must keep at least one owner; GitHub will not allow an org without any owners.

        ***

        ## 5. Optional: Dry run mode (safety check)

        Before actually changing roles, you can run a dry run:

        ```python theme={null}
        DRY_RUN = True  # set False to actually demote

        owners = list(org.get_members(role="admin"))

        for owner in owners:
            username = owner.login
            if username in ALLOWED_OWNERS:
                print(f"[DRY RUN] Would keep {username} as owner.")
            else:
                if DRY_RUN:
                    print(f"[DRY RUN] Would demote {username} to member.")
                else:
                    org.update_membership(owner, role="member")
                    print(f"Demoted {username} to member.")
        ```

        ***

        ## 6. Post‑remediation validation

        1. Re‑list owners to confirm:

           ```python theme={null}
           owners = org.get_members(role="admin")
           print("Final owners:")
           for owner in owners:
               print("-", owner.login)
           ```

        2. Ensure:
           * Only the intended minimal set of owners remains.
           * Other users still have appropriate team/repo permissions (e.g., `maintain`, `write`) instead of org‑wide owner.

        ***

        If you share your org name pattern and whether you’re on GitHub.com or GitHub Enterprise Server, I can adjust the script to fit that environment exactly.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Reduce GitHub organization owners by changing unnecessary admins to members.
        # Substitute YOUR_GITHUB_ORG and USERNAME_* with your actual org and users.

        provider "github" {
          owner = "YOUR_GITHUB_ORG"
        }

        # Keep only the minimal set of owners you actually need:
        resource "github_membership" "essential_owner_1" {
          username = "ESSENTIAL_OWNER_USERNAME_1"
          role     = "admin"  # remains an org owner
        }

        # Demote previous owners to regular members:
        resource "github_membership" "former_owner_1" {
          username = "FORMER_OWNER_USERNAME_1"
          role     = "member" # was "admin" before; apply will remove org-owner rights
        }

        resource "github_membership" "former_owner_2" {
          username = "FORMER_OWNER_USERNAME_2"
          role     = "member" # was "admin" before; apply will remove org-owner rights
        }
        ```

        Changing `role` from `"admin"` to `"member"` does not force resource replacement; Terraform will plan an in-place update showing `role: "admin" => "member"` for each demoted user.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://help.github.com/en/github/setting-up-and-managing-organizations-and-teams/permission-levels-for-an-organization](https://help.github.com/en/github/setting-up-and-managing-organizations-and-teams/permission-levels-for-an-organization)