# Ensure OCI IAM storage service-level admin policies exclude delete permissions

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698515373453-ensure-oci-iam-storage-service-level-admin-policies-exclude-delete-permissions
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure IAM policies that make a group an administrator of a storage service, such as Object Storage, Block Volume, or File Storage, exclude the delete permissions for that service. Deleting storage resources should be limited to a separate, tightly controlled group.

**Rationale**

Storage administrators often need to create and manage buckets, volumes, and file systems, but the ability to delete them can cause permanent data loss through mistakes or a compromised account. Separating delete permissions follows the principle of separation of duties and protects critical data from being removed by a single person.

**Impact**

-   Protects storage from accidental or malicious deletion
    
-   Separates everyday management from destructive actions
    
-   Deletions must be done by a separate authorized group
    

**Default Value**

By default, a policy that grants manage on a storage family includes delete permissions unless a condition removes them.

**Pre-Requisites**

-   Tenancy administrator access
    
-   A separate group for approved storage deletions
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Review policies that grant manage on object-family, volume-family, or file-family, or on buckets, objects, volumes, or file-systems.
    
4.  Check whether each statement has a where condition that excludes delete permissions, such as request.permission != 'BUCKET\_DELETE'.
    
5.  If a storage admin statement allows delete, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Open the flagged policy and select Edit policy statements.
    
4.  For Object Storage, use a statement such as: Allow group ObjectStorageAdmins to manage object-family in tenancy where all {request.permission != 'OBJECT\_DELETE', request.permission != 'BUCKET\_DELETE'}
    
5.  For Block Volume, use a statement such as: Allow group VolumeAdmins to manage volume-family in tenancy where all {request.permission != 'VOLUME\_DELETE', request.permission != 'VOLUME\_BACKUP\_DELETE', request.permission != 'BOOT\_VOLUME\_BACKUP\_DELETE'}
    
6.  For File Storage, use a statement such as: Allow group FileStorageAdmins to manage file-family in tenancy where all {request.permission != 'FILE\_SYSTEM\_DELETE', request.permission != 'MOUNT\_TARGET\_DELETE', request.permission != 'EXPORT\_SET\_DELETE', request.permission != 'FILE\_SYSTEM\_DELETE\_SNAPSHOT'}
    
7.  Select Save changes.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Open the policy, select Edit policy statements, remove the added conditions, and select Save changes.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/policyreference.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Reference/policyreference.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Security/Reference/iam\_security.htm](https://docs.oracle.com/en-us/iaas/Content/Security/Reference/iam_security.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.