Description

Ensure that the statement allowing a group to manage all-resources in tenancy appears only in the built-in Tenant Admin Policy, which grants it to the Administrators group. No other IAM policy should give a group full control over every resource in the tenancy.

Rationale

The manage all-resources in tenancy permission gives complete control of every resource, including the ability to change IAM, delete data, and remove security controls. Each extra policy that grants it creates another group whose members can take over the tenancy. Keeping it only in the Tenant Admin Policy enforces least privilege and makes full-admin access easy to review.

Impact

  • Only the Administrators group has full tenancy access

  • Reduces the number of accounts that can take over the tenancy

  • Affected groups need new, narrower policies

Default Value

By default, a new tenancy has only the Tenant Admin Policy, which grants manage all-resources in tenancy to the Administrators group.

Pre-Requisites

  • Tenancy administrator access

  • A list of the permissions each affected group really needs

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open each policy and review its statements.

  4. Flag any statement containing manage all-resources in tenancy in a policy other than Tenant Admin Policy.

  5. If any are found, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open the flagged policy and select Edit policy statements.

  4. Replace the manage all-resources in tenancy statement with narrower statements for only the resource types and compartments the group needs.

  5. Select Save changes.

  6. If the group really needs full administration, add its members to the Administrators group instead.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open the policy, select Edit policy statements, restore the previous statement, and select Save changes.

Reference