Description

Ensure policy statements that grant manage or use on users or groups at the tenancy level are given only to the Administrators group. If another group, such as a user management team, needs these permissions, the statement must include a condition that stops it from changing the Administrators group.

Rationale

Permission to manage users or groups lets a person add themselves or others to any group, including Administrators. This is a direct path to taking over the tenancy. Restricting these permissions to the Administrators group, or adding a condition that protects the Administrators group, prevents unauthorized privilege escalation.

Impact

  • Prevents non-admins from adding themselves to Administrators

  • Protects the Administrators group membership

  • User management teams need a restricted condition in their policies

Default Value

By default, only the Tenant Admin Policy grants these permissions, through manage all-resources for the Administrators group.

Pre-Requisites

  • Tenancy administrator access

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Review each policy for statements that grant manage users, manage groups, use users, or use groups in tenancy.

  4. Flag any such statement granted to a group other than Administrators without a condition protecting the Administrators group.

  5. If any are found, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open the flagged policy and select Edit policy statements.

  4. Remove the statement, or add a condition that protects the Administrators group, for example: Allow group UserAdmins to use groups in tenancy where target.group.name != 'Administrators'

  5. Select Save changes.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open the policy, select Edit policy statements, restore the previous statement, and select Save changes.

Reference