Skip to main content

OCI IAM Only Administrators Should Manage All Resources

More Info:​

Only administrator groups should have manage all-resources privileges. Policies granting any-user the ability to manage all resources violate least-privilege and create uncontrolled access.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are concise, console‑based steps to remediate the “OCI IAM Only Administrators Should Manage All Resources” problem and monitor it in OCI.

1. Identify Who Currently Has Broad (“Manage All-Resources”) Access​

  1. Sign in to the OCI Console.
  2. Open the Navigation Menu → Identity & Security → Identity & Access Management (IAM) → Policies.
  3. For each compartment (especially root compartment):
    • Select the compartment in the left filter.
    • Review each policy for statements containing:
      • manage all-resources in tenancy
      • manage all-resources in compartment <name>
  4. List all groups in those statements that have manage all-resources (e.g. Group DevOps).

You want only your dedicated admin group (e.g. Administrators) to have this level.

2. Define / Verify the Administrator Group​

  1. In the Console, go to: Identity & Security → Identity & Access Management (IAM) → Groups.
  2. Ensure you have a single, clearly named group for full admins, e.g. Administrators.
    • If not, click Create Group, name it Administrators, and add a description such as “Full tenancy administrators”.

3. Restrict “Manage All Resources” to Administrators Only​

3.1. Update Existing Policies​

For each policy that grants manage all-resources:

  1. Open IAM → Policies.
  2. Click the policy name.
  3. Click Edit Policy Statements.
  4. Find statements like: 
    Allow group DevOps to manage all-resources in tenancy
    Allow group DevTeam to manage all-resources in compartment <compartment-name>
  5. Change them to something more restrictive, for example:
    • For full admins only: 
      Allow group Administrators to manage all-resources in tenancy
    • For non-admins, grant least privilege, e.g. only required services: 
      Allow group DevOps to manage instance-family in compartment Dev
      Allow group DevTeam to use object-family in compartment Dev
  6. Save the updated policy.

3.2. Ensure Only Administrators Have Full-Tenancy Admin Rights​

  1. Still under Policies, verify that:
    • The only policy with manage all-resources in tenancy references the Administrators group (or equivalent).
    • No other group is given manage all-resources in tenancy or wide manage all-resources in root compartment.

4. Clean Up User Membership​

  1. Go to Identity & Security → IAM → Users.
  2. For each user:
    • Open the user → Groups tab.
    • Confirm only true admins are members of Administrators.
    • Remove non‑admins from any group that has broad (manage all-resources) privileges:
      • Click Remove next to the group membership.

5. Enable / Verify IAM Monitoring (Audit + Cloud Guard)​

5.1. Ensure Audit is Enabled​

Audit is on by default but verify:

  1. Go to Identity & Security → Audit.
  2. Confirm you can see events for compartments (no extra steps usually needed).

You can query for high‑risk IAM changes, e.g. events where policies are created/updated or group membership changes.

5.2. Enable Cloud Guard (If Not Already)​

  1. Go to Identity & Security → Cloud Guard.
  2. If not enabled:
    • Click Enable Cloud Guard.
    • Choose:
      • Target: typically the tenancy for full coverage.
      • Detector Recipe: use the Oracle-Managed default, then customize as needed.
  3. Save.

6. Configure Cloud Guard for “Only Admins Manage All Resources”​

  1. In Cloud Guard, open:
    • Detector Recipes → find your Configuration or Identity detector recipe.
  2. Click the recipe → View Details → Detector Rules.
  3. Look for a rule related to:
    • “Overly permissive IAM policy”, “All-resources permissions”, or similar wording (names can vary by version/region).
  4. Ensure the rule is:
    • Enabled.
    • Severity set appropriately (High/Critical).
  5. Attach the recipe to your Cloud Guard Target (the tenancy or key compartments):
    • Go to Targets.
    • Click your target.
    • Confirm your updated detector recipe is associated.

This makes Cloud Guard raise problems whenever non‑admin groups get broad manage‑all access.

7. (Optional) Create Notifications for Violations​

  1. Go to Developer Services → Notifications.
  2. Create a Topic (e.g., cloud-guard-alerts).
  3. Subscribe your email or PagerDuty/Slack endpoint.
  4. Back in Cloud Guard:
    • Go to Responder Recipes or Rules.
    • Configure a responder that:
      • Triggers on the IAM “overly permissive policy” problem.
      • Sends notification to the topic you created.

8. Validate​

  1. Try to add a test policy for a non‑admin group with: 
    Allow group TestGroup to manage all-resources in compartment Dev
  2. Confirm:
    • Non‑admin users still can’t manage resources outside their scope.
    • Cloud Guard shows a Problem for the over‑permissive IAM policy (if you enabled that rule).

This configuration ensures only your administrator group can manage all resources, and IAM changes are monitored via Audit and Cloud Guard from the OCI Console.

Using CLI

Below is a minimal, CLI-focused way to remediate “Only Administrators Should Manage All Resources” in OCI IAM, assuming:

  • You already know which group is your “Administrators” group (or you will create one).
  • You want to ensure that only this group has manage all-resources privileges in the tenancy or compartments.

1. Identify Existing “Over-Privileged” Policies​

You’re looking for any policy that grants manage all-resources (or similarly broad verbs like manage instance-family at the tenancy level) to non-admin groups.

1.1 List all policies in the tenancy​

oci iam policy list \
  --compartment-id <TENANCY_OCID> \
  --all \
  --output table

Replace <TENANCY_OCID> with your root tenancy OCID.

1.2 Get details for a specific policy​

For each suspicious policy, get full details:

oci iam policy get \
  --policy-id <POLICY_OCID> \
  --query 'data.{name:"name", statements:"statements"}'

Look for statements like:

Allow group <NonAdminGroup> to manage all-resources in tenancy
Allow group <NonAdminGroup> to manage all-resources in compartment <name>

2. Ensure You Have a Designated Admin Group​

2.1 Create an Administrators group (if not already present)​

oci iam group create \
  --name Administrators \
  --description "Administrators with full access to manage all resources"

Record the returned ocid if needed.

2.2 Add admin users to the Administrators group​

oci iam group add-user \
  --group-id <ADMIN_GROUP_OCID> \
  --user-id <USER_OCID>

Repeat as needed for each admin.

3. Create/Verify the Correct Admin Policy​

You want a single clear policy that grants the admin group full rights.

3.1 Create an admin policy (if missing)​

oci iam policy create \
  --compartment-id <TENANCY_OCID> \
  --name AdminsManageAllResources \
  --description "Allow Administrators to manage all resources in tenancy" \
  --statements '["Allow group Administrators to manage all-resources in tenancy"]'

If you prefer per-compartment instead of tenancy-wide, scope it accordingly:

--statements '["Allow group Administrators to manage all-resources in compartment <COMPARTMENT_NAME>"]'

4. Remove or Tighten Non-Admin “Manage All-Resources” Policies​

For each policy that grants manage all-resources to a non-admin group:

4.1 Download current policy for editing​

oci iam policy get \
  --policy-id <POLICY_OCID> \
  --query 'data.statements' \
  --raw-output > current_policy_statements.json

This will produce something like:

[
  "Allow group Devs to manage all-resources in tenancy",
  "Allow group Devs to read audit-events in tenancy"
]

4.2 Edit the JSON file locally​

  • Remove or narrow the manage all-resources line.
  • Replace with least-privilege statements (for example):
[
  "Allow group Devs to use instances in compartment Dev-Compartment",
  "Allow group Devs to read audit-events in tenancy"
]

4.3 Update the policy in OCI​

oci iam policy update \
  --policy-id <POLICY_OCID> \
  --statements file://current_policy_statements.json \
  --force

Repeat for each policy that grants broad rights to non-admin groups.

5. (Optional) Disable or Delete Unused Broad Policies​

If a policy is purely obsolete and only grants over-broad permissions:

5.1 Delete the policy​

oci iam policy delete \
  --policy-id <POLICY_OCID> \
  --force

6. Validate via CLI​

6.1 List policies again and search for “manage all-resources”​

oci iam policy list \
  --compartment-id <TENANCY_OCID> \
  --all \
  --query "data[?contains(join(' ', statements), 'manage all-resources')].{name:name, statements:statements}" \
  --output table

Verify that:

  • Only the Administrators group is granted manage all-resources (tenancy or compartments as per your design).
  • Other groups have more granular permissions (e.g., use, inspect, or specific resource-family manage).

If you share an example of a current policy statement, I can give you the exact replacement statements and the precise oci iam policy update command.

Using Python

Below is a concrete way to monitor and remediate the issue “Only Administrators Should Manage All Resources” in OCI IAM using Python and the OCI Python SDK.

Goal​

Identify IAM policies that grant manage all-resources and ensure that:

  • Only approved admin groups/compartments have that level of access.
  • Any non‑admin principal with manage all-resources is flagged (and optionally auto‑remediated).

1. Prerequisites​

  1. Install OCI SDK: 
    pip install oci
  2. Configure your OCI CLI profile (usually ~/.oci/config) with a user that has permission to:
    • INSPECT/READ/MANAGE policies.
    • Optionally UPDATE policies (for automated remediation).

2. Define Allowed Admin Principals​

Decide which IAM groups are allowed to have full access, e.g.:

ALLOWED_ADMIN_GROUPS = {
    "Administrators",
    "SecurityAdmins"
}

If you use dynamic groups or compartments instead, add rules accordingly.

3. Python Script: Monitor Policies for manage all-resources​

This script:

  • Lists all compartments and all IAM policies.
  • Parses each policy statement.
  • Finds statements that grant manage all-resources.
  • Flags if the principal is not in ALLOWED_ADMIN_GROUPS.

You can run this periodically (e.g., as an OCI Function or scheduled job).

import oci
import re

# ------------- CONFIG ----------------
PROFILE_NAME = "DEFAULT"          # OCI CLI profile
ALLOWED_ADMIN_GROUPS = {
    "Administrators",             # Example admin group(s)
    "SecurityAdmins"
}
# ------------------------------------


def get_all_compartments(identity_client, tenancy_id):
    """
    Recursively gets all compartments under the tenancy.
    """
    compartments = []

    def _list_compartments(parent_id):
        response = oci.pagination.list_call_get_all_results(
            identity_client.list_compartments,
            tenancy_id,
            compartment_id_in_subtree=True,
            access_level="ANY"
        )
        for c in response.data:
            if c.lifecycle_state == "ACTIVE":
                compartments.append(c)

    _list_compartments(tenancy_id)
    return compartments


def extract_principals_from_statement(statement):
    """
    Very simple parsing for common patterns like:
      'Allow group X to manage all-resources in tenancy'
      'Allow dynamic-group DG1 to manage all-resources in tenancy'
    This is not a full IAM policy parser but works for typical cases.
    """
    # Normalize
    s = " ".join(statement.split()).lower()

    # We'll return a list of dicts, e.g. [{'type': 'group', 'name': 'Administrators'}]
    principals = []

    # Match 'allow group <name> to manage all-resources'
    group_match = re.findall(r"allow group ([a-z0-9_\-]+) to manage all-resources", s)
    for g in group_match:
        principals.append({"type": "group", "name": g})

    # Match 'allow dynamic-group <name> to manage all-resources'
    dg_match = re.findall(r"allow dynamic-group ([a-z0-9_\-]+) to manage all-resources", s)
    for dg in dg_match:
        principals.append({"type": "dynamic-group", "name": dg})

    return principals


def statement_grants_manage_all_resources(statement):
    """
    Checks if the statement includes 'manage all-resources'.
    """
    s = statement.lower()
    return "manage all-resources" in s


def main():
    # Load config & clients
    config = oci.config.from_file(profile_name=PROFILE_NAME)
    identity_client = oci.identity.IdentityClient(config)
    tenancy_id = config["tenancy"]

    # Get all compartments (including root)
    compartments = get_all_compartments(identity_client, tenancy_id)
    compartments.append(identity_client.get_compartment(tenancy_id).data)  # add tenancy root

    print("Scanning policies for 'manage all-resources'...")

    violations = []

    for compartment in compartments:
        # List policies in this compartment
        policies = oci.pagination.list_call_get_all_results(
            identity_client.list_policies,
            compartment.id
        ).data

        for policy in policies:
            for stmt in policy.statements:
                if not statement_grants_manage_all_resources(stmt):
                    continue

                principals = extract_principals_from_statement(stmt)
                for p in principals:
                    # Only enforce for groups here; you can extend for dynamic-groups
                    if p["type"] == "group":
                        group_name = p["name"]
                        # Compare case-insensitively with allowed admin groups
                        if group_name not in {g.lower() for g in ALLOWED_ADMIN_GROUPS}:
                            violations.append({
                                "policy_id": policy.id,
                                "policy_name": policy.name,
                                "compartment_id": compartment.id,
                                "compartment_name": compartment.name,
                                "statement": stmt,
                                "principal_type": p["type"],
                                "principal_name": group_name
                            })

    # Report
    if not violations:
        print("No violations found. Only allowed admin groups manage all-resources.")
    else:
        print("Found the following non-admin principals with 'manage all-resources':\n")
        for v in violations:
            print(f"- Policy: {v['policy_name']} (ID: {v['policy_id']})")
            print(f"  Compartment: {v['compartment_name']} ({v['compartment_id']})")
            print(f"  Principal: {v['principal_type']} '{v['principal_name']}'")
            print(f"  Statement: {v['statement']}\n")


if __name__ == "__main__":
    main()

4. Optional: Automated Remediation​

Once you’ve identified violating policies, you have two main choices:

  1. Edit the policy statements to:

    • Remove manage all-resources for non‑admin groups.
    • Replace with narrower verbs/resources (e.g., read, use, or specific services).

  2. Delete the entire policy if it’s not needed.

Example pattern to update a policy (manual & careful):

def remediate_policy(identity_client, policy, bad_statement):
    """
    Remove the violating statement from the policy.
    """
    new_statements = [s for s in policy.statements if s != bad_statement]

    update_details = oci.identity.models.UpdatePolicyDetails(
        description=policy.description,
        statements=new_statements,
        version_date=policy.version_date
    )

    response = identity_client.update_policy(
        policy_id=policy.id,
        update_policy_details=update_details
    )
    return response.data

You’d call remediate_policy for each specific violating statement after reviewing it.

5. Operationalizing as Monitoring​

  • Run this Python script:
    • As an OCI Function triggered by a scheduled job (via OCI DevOps or an external scheduler).
    • Or as a CI job in your security pipeline.
  • Export findings to:
    • OCI Logging / Object Storage / SIEM.
    • Email / Slack / ticketing system.

This gives you continuous OCI IAM monitoring that enforces “only administrators manage all resources” using Python.

Using Terraform
resource "oci_identity_policy" "iam_monitoring_admin_only" {
  # Replace with your compartment OCID (for root, use the tenancy OCID)
  compartment_id = "OCID_OF_TENANCY_OR_COMPARTMENT"

  # Replace with your policy name
  name        = "IAM_MONITORING_ADMIN_ONLY_POLICY"
  description = "Restrict manage all-resources to administrator group only"

  # Replace ADMIN_GROUP_NAME with the actual OCI IAM group that should have full admin
  statements = [
    # This is the remediated form:
    # previously something like:
    #   "allow any-user to manage all-resources in tenancy"
    # is TOO permissive and must be removed/replaced.
    "Allow group ADMIN_GROUP_NAME to manage all-resources in tenancy"
  ]
}

Substitute:

  • OCID_OF_TENANCY_OR_COMPARTMENT with your tenancy or compartment OCID where the policy is defined.
  • IAM_MONITORING_ADMIN_ONLY_POLICY with your existing policy name if you are remediating an existing policy, not creating a new one.
  • ADMIN_GROUP_NAME with the actual administrator group that should manage all resources (for example, Administrators).

This change updates the existing policy in place and does not force its replacement; it is a safe apply from a resource lifecycle perspective, but it will immediately revoke manage all-resources from any-user.

For verification, terraform plan should show the oci_identity_policy with its statements changing from a line granting manage all-resources to any-user (or another overly broad principal) to the restricted Allow group ADMIN_GROUP_NAME to manage all-resources in tenancy.