# Ensure identity policy does not grant broad 'manage all-resources' permissions

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698516707981-ensure-identity-policy-does-not-grant-broad-manage-all-resources-permissions
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure no identity policy, other than the Tenant Admin Policy, grants a group manage all-resources, whether in the tenancy or in a compartment. Groups should receive only the specific resource types and actions they need, such as manage instance-family or read buckets.

**Rationale**

The manage all-resources permission gives complete control over every resource type in its scope, including policies in that compartment and the ability to delete any data. Granting it broadly makes the impact of a compromised account very large. Replacing it with specific permissions enforces least privilege and reduces the blast radius of any single account.

**Impact**

-   Limits each group to the resources it needs
    
-   Reduces damage from a compromised account
    
-   Affected groups need new, specific policy statements
    

**Default Value**

By default, only the Tenant Admin Policy grants manage all-resources, to the Administrators group.

**Pre-Requisites**

-   Tenancy administrator access
    
-   A list of the permissions each affected group needs
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Review policies in the root compartment and in each child compartment (change the Compartment filter).
    
4.  Flag any statement containing manage all-resources outside the Tenant Admin Policy.
    
5.  If any are found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Open the flagged policy and select Edit policy statements.
    
4.  Replace manage all-resources with specific statements, for example: Allow group AppTeam to manage instance-family in compartment AppCompartment
    
5.  Select Save changes and confirm the group can still do its required work.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Policies. In the Compartment filter, select the root compartment (tenancy).
    
3.  Open the policy, select Edit policy statements, restore the previous statement, and select Save changes.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/policieshow/how-policies-work.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/policieshow/how-policies-work.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/Identity/policiescommon/commonpolicies.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/policiescommon/commonpolicies.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.