Description

Ensure no identity policy, other than the Tenant Admin Policy, grants a group manage all-resources, whether in the tenancy or in a compartment. Groups should receive only the specific resource types and actions they need, such as manage instance-family or read buckets.

Rationale

The manage all-resources permission gives complete control over every resource type in its scope, including policies in that compartment and the ability to delete any data. Granting it broadly makes the impact of a compromised account very large. Replacing it with specific permissions enforces least privilege and reduces the blast radius of any single account.

Impact

  • Limits each group to the resources it needs

  • Reduces damage from a compromised account

  • Affected groups need new, specific policy statements

Default Value

By default, only the Tenant Admin Policy grants manage all-resources, to the Administrators group.

Pre-Requisites

  • Tenancy administrator access

  • A list of the permissions each affected group needs

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Review policies in the root compartment and in each child compartment (change the Compartment filter).

  4. Flag any statement containing manage all-resources outside the Tenant Admin Policy.

  5. If any are found, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open the flagged policy and select Edit policy statements.

  4. Replace manage all-resources with specific statements, for example: Allow group AppTeam to manage instance-family in compartment AppCompartment

  5. Select Save changes and confirm the group can still do its required work.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).

  3. Open the policy, select Edit policy statements, restore the previous statement, and select Save changes.

Reference