Description

Ensure users who are members of the tenancy Administrators group do not have any API signing keys. Administrators should use the Console with MFA for administrative work, and automation should use separate service users or instance principals with only the permissions they need.

Rationale

An API key for an administrator gives full programmatic control of the tenancy without MFA. If the private key is leaked from a laptop, repository, or CI system, an attacker can take over the entire tenancy. Removing API keys from administrators removes this high-risk path and moves automation to safer, least-privilege identities.

Impact

  • Removes full-admin programmatic access without MFA

  • Reduces the impact of a leaked key

  • Automation using an admin key must move to another identity

Default Value

By default, users have no API keys until one is added.

Pre-Requisites

  • Tenancy administrator access

  • An alternative identity (service user or instance principal) for any automation that uses an admin key

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, find the Groups section, and select the Administrators group to see its members.

  4. For each member, open the user, select the Tokens and keys tab, and check the API keys section.

  5. If any administrator has API keys, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Move any automation that uses an administrator's API key to a separate service user or instance principal with only the required permissions.

  4. Open the administrator user, select the Tokens and keys tab, and find the API keys section.

  5. Open the Actions menu for each key, select Delete, and confirm.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Open the administrator user, select the Tokens and keys tab, and select Add API key to add a key back if it is required.

Reference