IAM policies on groups and users exclude Administrators

Check ID: identity_iam_admins_cannot_update_tenancy_admins
Provider: Oracle Cloud (OCI)
Service: identity
Severity: CRITICAL
Categories: identity-access
Resource type: Policy

What this check verifies

OCI IAM policies granting manage/use on groups or users in the tenancy are evaluated for a condition that excludes the Administrators group, such as target.group.name != 'Administrators'. Policies missing this restriction are identified.

Risk

Ability to modify the Administrators group enables privilege escalation to full tenancy control. This threatens confidentiality (broad data access), integrity (policy/user changes), and availability (resource deletion). Attackers could add persistence accounts, disable safeguards, and evade oversight.

Recommendation

Apply least privilege: avoid tenancy-wide manage/use on groups or users. When delegation is required, include a condition excluding the Administrators group (e.g., target.group.name != 'Administrators'). Enforce segregation of duties, require approvals for group changes, and monitor/audit identity policy activity.

Remediation

CLI
Terraform
Dashboard steps

oci iam policy update --policy-id <example_resource_id> --statements "[\"Allow group <example_resource_name> to manage groups, users in tenancy where target.group.name != 'Administrators'\"]"

resource "oci_identity_policy" "<example_resource_name>" {
  name           = "<example_resource_name>"
  compartment_id = "<example_resource_id>"
  description    = "<example_resource_name>"
  statements = [
    # Critical: Protect the Administrators group from modification by this policy
    # Adds a where clause so the policy can't target the Administrators group
    "Allow group <example_resource_name> to manage groups, users in tenancy where target.group.name != 'Administrators'"
  ]
}

References

https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_iam_admins_cannot_update_tenancy_admins. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

File Storage file system uses a customer-managed key Instance principal authentication is configured

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires