Only the Tenant Admin Policy manages all tenancy resources

Check ID: identity_tenancy_admin_permissions_limited
Provider: Oracle Cloud (OCI)
Service: identity
Severity: CRITICAL
Categories: identity-access
Resource type: Policy

What this check verifies

OCI IAM policies are analyzed for statements granting manage all-resources in tenancy to groups. Only the Tenant Admin Policy for the Administrators group should include this broad verb. Any other active policy containing this tenancy-wide permission is identified.

Risk

Tenancy-wide manage rights for non-admins allow complete control of identities and resources. A compromised account can escalate privileges, exfiltrate data across compartments, alter or delete workloads and backups, and disable monitoring-impacting confidentiality, integrity, and availability of the entire tenancy.

Recommendation

Restrict manage all-resources in tenancy to the Administrators group only. Apply least privilege by scoping access to compartments and specific resource families, using conditions to narrow rights. Enforce separation of duties, maintain a break-glass admin model, and review policies regularly to prevent privilege drift.

Remediation

CLI
Terraform
Dashboard steps

oci iam policy delete —policy-id <POLICY_OCID> —force

resource "oci_identity_policy" "<example_resource_name>" {
  name           = "<POLICY_NAME>"
  compartment_id = "<example_compartment_id>"
  description    = "Replace tenancy-wide admin with scoped permissions"

  statements = [
    # FIX: Replace "in tenancy" with compartment scope to remove overly broad permission
    "allow group <group_name> to manage all-resources in compartment <compartment_name>"
  ]
}

References

https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_tenancy_admin_permissions_limited. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Identity policy grants no broad manage-all permissions Tenancy administrator user has no API keys

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires