Ensure service level admins are created to manage resources of particular service

MediumLevel 1Manual reviewoci

Description

To apply least-privilege security principle, one can create service-level administrators in corresponding groups and assigning specific users to each service-level administrative group in a tenancy. This limits administrative access in a tenancy. Creating service-level administrators helps in tightly controlling access to Oracle Cloud Infrastructure (OCI) services to implement the least-privileged security principle. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

From CLI: 1. Set up OCI CLI with an IAM administrator user who has read access to IAM resources such as groups and policies. 2. Run OCI CLI command providing the root_compartment_OCID Get the list of groups in a tenancy oci iam group list --compartment-id <root_compartment_OCID> | grep name A tenancy with identity domains : The above CLI commands work with the default identity domain only. For IaaS resource management, users and groups created in the default domain are sufficient. 3.

How it is fixed

Fix method: Guidance or infrastructure patch

Refer to the policy syntax document and create new policies if the audit results indicate that the required policies are missing. This can be done via OCI console or OCI CLI/SDK or API. Creating a new policy: From CLI: oci iam policy create [OPTIONS] Creates a new policy in the specified compartment (either the tenancy or another of your compartments). If you're new to policies, see Getting Started with Policies You must specify a name for the policy, which must be unique across all policies in your tenancy and cannot be changed. You must also specify a description for the policy (although it can be an empty string).

Properties

Operating systems: Any
Tags: ociiam
Reference: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.1 Ensure service level admins are created to manage resources of particular service