# Ensure tenancy administrator user has no API keys

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698514778631-ensure-tenancy-administrator-user-has-no-api-keys
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure users who are members of the tenancy Administrators group do not have any API signing keys. Administrators should use the Console with MFA for administrative work, and automation should use separate service users or instance principals with only the permissions they need.

**Rationale**

An API key for an administrator gives full programmatic control of the tenancy without MFA. If the private key is leaked from a laptop, repository, or CI system, an attacker can take over the entire tenancy. Removing API keys from administrators removes this high-risk path and moves automation to safer, least-privilege identities.

**Impact**

-   Removes full-admin programmatic access without MFA
    
-   Reduces the impact of a leaked key
    
-   Automation using an admin key must move to another identity
    

**Default Value**

By default, users have no API keys until one is added.

**Pre-Requisites**

-   Tenancy administrator access
    
-   An alternative identity (service user or instance principal) for any automation that uses an admin key
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, find the Groups section, and select the Administrators group to see its members.
    
4.  For each member, open the user, select the Tokens and keys tab, and check the API keys section.
    
5.  If any administrator has API keys, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Move any automation that uses an administrator's API key to a separate service user or instance principal with only the required permissions.
    
4.  Open the administrator user, select the Tokens and keys tab, and find the API keys section.
    
5.  Open the Actions menu for each key, select Delete, and confirm.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Open the administrator user, select the Tokens and keys tab, and select Add API key to add a key back if it is required.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Security/Reference/iam\_security.htm](https://docs.oracle.com/en-us/iaas/Content/Security/Reference/iam_security.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.