Instance principal authentication is configured

Check ID: identity_instance_principal_used
Provider: Oracle Cloud (OCI)
Service: identity
Severity: MEDIUM
Categories: identity-access
Resource type: DynamicResourceGroup

What this check verifies

OCI dynamic groups configured for instance principal access to workloads like Compute instances, Functions, and Autonomous Databases. The evaluation looks for matching rules that target these resources (e.g., instance, fnfunc, autonomousdatabase) to confirm workload identity usage.

Risk

Using user credentials or long-lived keys instead of instance principals exposes secrets and weakens least privilege and accountability. Stolen keys from code or pipelines enable unauthorized API calls, data exfiltration, and privilege abuse, impacting confidentiality and integrity of OCI resources.

Recommendation

Adopt workload identities with instance principals and granular dynamic groups. Apply least privilege policies to those groups, avoid long-lived user keys, and remove embedded credentials from code and CI/CD. Monitor access patterns and favor short-lived, auditable tokens as part of a zero trust approach.

Remediation

CLI
Terraform
Dashboard steps

oci iam dynamic-group create --compartment-id <example_resource_id> --name <example_resource_name> --matching-rule "ALL {resource.type = 'instance'}"

resource "oci_identity_dynamic_group" "dg" {
  compartment_id = "<example_resource_id>"
  name           = "<example_resource_name>"
  description    = "Enable instance principals"
  matching_rule  = "ALL {resource.type = 'instance'}" # Critical: creates a Dynamic Group for instances to enable instance principal auth
}

References

https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_instance_principal_used. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

IAM policies on groups and users exclude Administrators No resources exist in the root compartment

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires