Skip to main content

OCI IAM Service Administrator Group Should Be Defined

More Info:​

A service administrators group should be defined with active members. Without dedicated service admin roles, access management lacks proper segregation of duties.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate “OCI IAM Service Administrator Group Should Be Defined” using the OCI Console, you essentially need to:

  1. Create (or verify) a group for IAM Service Administrators
  2. Attach the correct policies to that group
  3. (Optionally) Assign users to the group

Below are the step‑by‑step instructions in the OCI Console.

1. Identify the Relevant Compartment / Domain​

  1. Sign in to the OCI Console.
  2. In the top-left, open the Navigation menu.
  3. Go to Identity & Security →
    • If you use OCI IAM Identity Domains: choose Identity Domains → select your domain.
    • If you use the classic IAM model: choose Identity (or Identity & Security → Users, Groups & Policies depending on your tenancy view).

Use the same scope (tenancy/compartment/domain) where you manage IAM and security policies.

2. Create an “IAM Service Administrators” Group​

For IAM Identity Domains

  1. In your identity domain, go to Groups.
  2. Click Create group.
  3. Name it something like: IAM-Service-Admins (or the name required by your policy/standard).
  4. Add a description, e.g. “Group for IAM Service Administrators with permissions to manage IAM resources.”
  5. Click Create.

For Classic IAM (Tenancy-level Groups)

  1. Under Identity & Security → Identity → Groups.
  2. Click Create Group.
  3. Enter:
    • Name: IAM-Service-Admins
    • Description: “Group for IAM Service Administrators with permissions to manage IAM resources.”
  4. Click Create.

3. Attach Policies Granting IAM Service Admin Rights​

You need tenancy-level (or appropriate compartment-level) policies allowing management of IAM resources. Typically this is at the tenancy level for central IAM administration.

  1. Go to Identity & Security → Identity → Policies.
  2. In the Compartment selector, choose the tenancy (root) compartment (unless your org uses a different pattern).
  3. Click Create Policy.

Example policy (tenancy-level) for a strong IAM Service Admin role:

  • Name: iam-service-admin-policy
  • Description: Policy granting IAM service admin rights to IAM-Service-Admins group
  • Compartment: tenancy/root
  • Statements (start with these and tighten as needed):
Allow group IAM-Service-Admins to manage users in tenancy
Allow group IAM-Service-Admins to manage groups in tenancy
Allow group IAM-Service-Admins to manage policies in tenancy
Allow group IAM-Service-Admins to manage dynamic-groups in tenancy
Allow group IAM-Service-Admins to manage compartments in tenancy
Allow group IAM-Service-Admins to manage authentication-policies in tenancy
Allow group IAM-Service-Admins to manage identity-providers in tenancy
Allow group IAM-Service-Admins to manage tag-namespaces in tenancy
Allow group IAM-Service-Admins to manage tag-defaults in tenancy
Allow group IAM-Service-Admins to manage domains in tenancy
  1. Click Create.

Adjust statements if your security baseline prescribes a narrower scope (for example, only specific IAM resources).

4. Add Users to the IAM Service Admin Group​

Identity Domains

  1. Within the identity domain, open Groups.
  2. Click the IAM-Service-Admins group.
  3. Go to Members → Add members.
  4. Select the appropriate users.
  5. Click Add / Save.

Classic IAM

  1. Go to Identity → Users.
  2. For each user who should be an IAM Service Administrator:
    • Click the user name.
    • Go to Groups tab.
    • Click Add User to Group.
    • Select IAM-Service-Admins.
    • Click Add.

5. Confirm the Misconfiguration Clears in Monitoring​

  1. Wait for your OCI Security Zones / Cloud Guard / IAM Monitoring (depending on what you use) to re-evaluate.
  2. In the service that raised “OCI IAM Service Administrator Group Should Be Defined,” check that:
    • A group exists with the intended name/role, and
    • Policies granting IAM admin permissions are attached.

If your monitoring tool expects a specific group name or exact policy pattern, align your group name and policy statements to that standard, then re-run the compliance check.

Using CLI

Below are concise, step‑by‑step OCI CLI instructions to ensure an IAM Service Administrator group exists and is properly configured for monitoring.

Assumptions:

  • You have OCI CLI configured with appropriate tenancy-level permissions.
  • You know your tenancy OCID: ocid1.tenancy.oc1...
  • You want a group named IAM-Service-Admins (change as needed).

1. Set common variables (optional, for convenience)​

TENANCY_OCID="<your-tenancy-ocid>"
COMPARTMENT_OCID="$TENANCY_OCID"   # IAM resources are at tenancy level
GROUP_NAME="IAM-Service-Admins"

2. Check if the IAM Service Administrator group already exists​

oci iam group list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?name=='$GROUP_NAME']"
  • If this returns an object, the group exists—note its id and skip to step 4.
  • If it returns [], create it.

3. Create the IAM Service Administrator group (if missing)​

oci iam group create \
  --compartment-id "$TENANCY_OCID" \
  --name "$GROUP_NAME" \
  --description "Group for IAM Service Administrators"
  • Capture the group OCID from the output:
GROUP_OCID="<returned-group-ocid>"

(If you already had the group from step 2, set GROUP_OCID to that ID instead.)

4. Create / ensure an IAM policy for Service Administrators​

Example: full IAM admin at tenancy level (adjust to your policy standard / CIS profile).

POLICY_NAME="IAM-Service-Admins-Policy"

oci iam policy list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?name=='$POLICY_NAME']"

If empty, create:

oci iam policy create \
  --compartment-id "$TENANCY_OCID" \
  --name "$POLICY_NAME" \
  --description "Policy granting IAM administration to IAM-Service-Admins group" \
  --statements '[
    "Allow group '"$GROUP_NAME"' to manage users in tenancy",
    "Allow group '"$GROUP_NAME"' to manage groups in tenancy",
    "Allow group '"$GROUP_NAME"' to manage policies in tenancy",
    "Allow group '"$GROUP_NAME"' to inspect compartments in tenancy"
  ]'

If the policy exists but needs updating, edit the JSON statements and run:

oci iam policy update \
  --policy-id "<policy-ocid>" \
  --statements '[
    "Allow group '"$GROUP_NAME"' to manage users in tenancy",
    "Allow group '"$GROUP_NAME"' to manage groups in tenancy",
    "Allow group '"$GROUP_NAME"' to manage policies in tenancy",
    "Allow group '"$GROUP_NAME"' to inspect compartments in tenancy"
  ]'

5. Add appropriate users to the IAM Service Administrator group​

List users to identify the ones to add:

oci iam user list --compartment-id "$TENANCY_OCID" --all

Add a user to the group:

USER_OCID="<user-ocid-to-add>"

oci iam group membership create \
  --group-id "$GROUP_OCID" \
  --user-id "$USER_OCID"

Repeat for each IAM administrator.

6. Validate for monitoring / compliance​

Re-list the group and its memberships (for evidence/monitoring):

# Confirm group
oci iam group list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?name=='$GROUP_NAME']"

# Confirm memberships
oci iam group membership list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?\"group-id\"=='$GROUP_OCID']"

# Confirm policy
oci iam policy list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?name=='$POLICY_NAME']"

These commands and configuration will satisfy a control such as “OCI IAM Service Administrator Group Should Be Defined” for IAM monitoring.

Using Python

Below is how you can automatically check and remediate the “OCI IAM Service Administrator Group Should Be Defined” issue using Python + OCI SDK.

1. What needs to exist​

Typically the check means:

  1. There should be an IAM Group for service admins (e.g., Service-Admins).
  2. There should be an IAM Policy attached at the tenancy level that grants the group appropriate permissions, for example:
Allow group Service-Admins to manage all-resources in tenancy

(Adjust the policy statement to your org’s standard if needed.)

2. Prerequisites​

  1. Install OCI Python SDK:
pip install oci
  1. Configure OCI CLI/SDK credentials on the machine running the script:
  • ~/.oci/config with a profile, e.g. [DEFAULT], including:
    • tenancy=ocid1.tenancy.oc1...
    • user=ocid1.user.oc1...
    • fingerprint=...
    • key_file=/path/to/private_key.pem
    • region=...
  1. The principal running the script needs IAM permissions to:
    • manage groups in tenancy
    • manage policies in tenancy

3. Python script: detect & remediate​

This script will:

  1. Connect using the SDK.
  2. Check if the Service-Admins group exists; create it if missing.
  3. Check if a policy granting appropriate privileges exists; create it if missing.
import oci
from oci.identity.models import CreateGroupDetails, CreatePolicyDetails

# ----- CONFIGURE THESE -----
PROFILE_NAME = "DEFAULT"  # OCI config profile
SERVICE_ADMIN_GROUP_NAME = "Service-Admins"
SERVICE_ADMIN_GROUP_DESC = "Group for IAM Service Administrators"
POLICY_NAME = "Service-Admins-Policy"
POLICY_DESC = "Policy for Service Administrators group"
# Example policy statement; adjust to your org’s standard
POLICY_STATEMENTS = [
    "Allow group Service-Admins to manage all-resources in tenancy"
]
# ---------------------------

def get_identity_client(profile_name: str = "DEFAULT"):
    config = oci.config.from_file("~/.oci/config", profile_name)
    identity_client = oci.identity.IdentityClient(config)
    tenancy_id = config["tenancy"]
    return identity_client, tenancy_id

def get_group_by_name(identity_client, tenancy_id, group_name):
    groups = oci.pagination.list_call_get_all_results(
        identity_client.list_groups,
        compartment_id=tenancy_id
    ).data

    for g in groups:
        if g.name == group_name:
            return g
    return None

def create_service_admin_group(identity_client, tenancy_id):
    details = CreateGroupDetails(
        compartment_id=tenancy_id,
        name=SERVICE_ADMIN_GROUP_NAME,
        description=SERVICE_ADMIN_GROUP_DESC
    )
    response = identity_client.create_group(details)
    return response.data

def get_policy_by_name(identity_client, tenancy_id, policy_name):
    policies = oci.pagination.list_call_get_all_results(
        identity_client.list_policies,
        compartment_id=tenancy_id
    ).data

    for p in policies:
        if p.name == policy_name:
            return p
    return None

def create_service_admin_policy(identity_client, tenancy_id, group_name):
    details = CreatePolicyDetails(
        compartment_id=tenancy_id,
        name=POLICY_NAME,
        description=POLICY_DESC,
        statements=POLICY_STATEMENTS,
        version_date=None  # optional
    )
    response = identity_client.create_policy(details)
    return response.data

def main():
    identity_client, tenancy_id = get_identity_client(PROFILE_NAME)

    # 1. Ensure Service-Admins group exists
    group = get_group_by_name(identity_client, tenancy_id, SERVICE_ADMIN_GROUP_NAME)
    if group is None:
        print(f"Group '{SERVICE_ADMIN_GROUP_NAME}' not found; creating...")
        group = create_service_admin_group(identity_client, tenancy_id)
        print(f"Created group: {group.name} (OCID: {group.id})")
    else:
        print(f"Group '{SERVICE_ADMIN_GROUP_NAME}' already exists (OCID: {group.id})")

    # 2. Ensure Service-Admins policy exists
    policy = get_policy_by_name(identity_client, tenancy_id, POLICY_NAME)
    if policy is None:
        print(f"Policy '{POLICY_NAME}' not found; creating...")
        policy = create_service_admin_policy(identity_client, tenancy_id, SERVICE_ADMIN_GROUP_NAME)
        print(f"Created policy: {policy.name} (OCID: {policy.id})")
    else:
        print(f"Policy '{POLICY_NAME}' already exists (OCID: {policy.id})")
        # Optional: verify/adjust statements if needed

if __name__ == "__main__":
    main()

4. How to use for monitoring​

  • Run this script periodically (e.g., via cron, OCI Functions, or a CI pipeline).
  • It acts as both monitoring (detecting missing group/policy) and auto-remediation (creating them when absent).
  • If you only want monitoring, remove the create_* calls and just alert/log when group or policy is missing.
Using Terraform
resource "oci_identity_group" "service_admins" {
  # Replace with your tenancy OCID (root compartment)
  compartment_id = "OCID_OF_TENANCY"

  # Name visible in IAM; adjust if your org uses another standard name
  name        = "service-admins"
  description = "Service Administrators group for managing OCI services"
}

resource "oci_identity_user_group_membership" "service_admins_member" {
  # Replace with the OCID of an existing IAM user who should be a service admin
  user_id  = "OCID_OF_SERVICE_ADMIN_USER"
  group_id = oci_identity_group.service_admins.id
}

Changing the name of oci_identity_group.service_admins later will force replacement of the group (and thus memberships), which can briefly impact access.

Verify with terraform plan showing creation of oci_identity_group.service_admins and at least one oci_identity_user_group_membership.service_admins_member.