Description

Ensure IAM policies that make a group an administrator of a storage service, such as Object Storage, Block Volume, or File Storage, exclude the delete permissions for that service. Deleting storage resources should be limited to a separate, tightly controlled group.

Rationale

Storage administrators often need to create and manage buckets, volumes, and file systems, but the ability to delete them can cause permanent data loss through mistakes or a compromised account. Separating delete permissions follows the principle of separation of duties and protects critical data from being removed by a single person.

Impact

  • Protects storage from accidental or malicious deletion

  • Separates everyday management from destructive actions

  • Deletions must be done by a separate authorized group

Default Value

By default, a policy that grants manage on a storage family includes delete permissions unless a condition removes them.

Pre-Requisites

  • Tenancy administrator access

  • A separate group for approved storage deletions

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Review policies that grant manage on object-family, volume-family, or file-family, or on buckets, objects, volumes, or file-systems.

  4. Check whether each statement has a where condition that excludes delete permissions, such as request.permission != 'BUCKET_DELETE'.

  5. If a storage admin statement allows delete, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open the flagged policy and select Edit policy statements.

  4. For Object Storage, use a statement such as: Allow group ObjectStorageAdmins to manage object-family in tenancy where all {request.permission != 'OBJECT_DELETE', request.permission != 'BUCKET_DELETE'}

  5. For Block Volume, use a statement such as: Allow group VolumeAdmins to manage volume-family in tenancy where all {request.permission != 'VOLUME_DELETE', request.permission != 'VOLUME_BACKUP_DELETE', request.permission != 'BOOT_VOLUME_BACKUP_DELETE'}

  6. For File Storage, use a statement such as: Allow group FileStorageAdmins to manage file-family in tenancy where all {request.permission != 'FILE_SYSTEM_DELETE', request.permission != 'MOUNT_TARGET_DELETE', request.permission != 'EXPORT_SET_DELETE', request.permission != 'FILE_SYSTEM_DELETE_SNAPSHOT'}

  7. Select Save changes.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open the policy, select Edit policy statements, remove the added conditions, and select Save changes.

Reference