Ensure service level admins are created to manage resources of particular service

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

From CLI: 1. Set up OCI CLI with an IAM administrator user who has read access to IAM resources such as groups and policies. 2. Run OCI CLI command providing the root_compartment_OCID Get the list of groups in a tenancy oci iam group list --compartment-id <root_compartment_OCID> | grep name A tenancy with identity domains : The above CLI commands work with the default identity domain only. For IaaS resource management, users and groups created in the default domain are sufficient. 3.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Refer to the policy syntax document and create new policies if the audit results indicate that the required policies are missing. This can be done via OCI console or OCI CLI/SDK or API. Creating a new policy: From CLI: oci iam policy create [OPTIONS] Creates a new policy in the specified compartment (either the tenancy or another of your compartments). If you're new to policies, see Getting Started with Policies You must specify a name for the policy, which must be unique across all policies in your tenancy and cannot be changed. You must also specify a description for the policy (although it can be an empty string).