Check ID: identity_tenancy_admin_users_no_api_keys
Provider: Oracle Cloud (OCI)
Service: identity
Severity: HIGH
Categories: identity-access, secrets
Resource type: User

​
What this check verifies

OCI tenancy administrator accounts (members of the Administrators group) are inspected for configured user API keys tied to those identities.

​
Risk

Admin API keys are long-lived secrets that can be stolen from endpoints or repos, enabling non-interactive, MFA-less access. Attackers could run privileged API calls, exfiltrate data, modify policies, or delete resources, impacting confidentiality, integrity, and availability.

​
Recommendation

Do not issue API keys to tenancy administrators. Apply least privilege and separation of duties: use non-admin service accounts or principals with narrowly scoped rights and short-lived credentials. Require SSO/MFA for admin access, and enforce rapid key revocation and rotation for any programmatic identities.

​
Remediation

Dashboard steps
  1. Sign in to the Oracle Cloud Console
  2. Open the navigation menu and go to Identity & Security > Domains
  3. Select your domain (<example_resource_name>), then click Users
  4. Click the tenancy administrator user (<example_resource_name>)
  5. Open the API Keys tab
  6. For each API key, click Actions > Delete and confirm
  7. Repeat until the API Keys list is empty

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_tenancy_admin_users_no_api_keys. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks