Oracle Cloud Infrastructure
TMA-OCI-1.1
Ensure service level admins are created to manage resources of particular service
説明
To apply least-privilege security principle, one can create service-level administrators in corresponding groups and assigning specific users to each service-level administrative group in a tenancy. This limits administrative access in a tenancy. Creating service-level administrators helps in tightly controlling access to Oracle Cloud Infrastructure (OCI) services to implement the least-privileged security principle. Reported as a manual review item: the benchmark audit needs console review or organisational judgement.
チェック方法
監査方法: 手動レビュー
From CLI: 1. Set up OCI CLI with an IAM administrator user who has read access to IAM resources such as groups and policies. 2. Run OCI CLI command providing the root_compartment_OCID Get the list of groups in a tenancy oci iam group list --compartment-id <root_compartment_OCID> | grep name A tenancy with identity domains : The above CLI commands work with the default identity domain only. For IaaS resource management, users and groups created in the default domain are sufficient. 3.
修正方法
修正方法: ガイダンスまたは IaC パッチ
Refer to the policy syntax document and create new policies if the audit results indicate that the required policies are missing. This can be done via OCI console or OCI CLI/SDK or API. Creating a new policy: From CLI: oci iam policy create [OPTIONS] Creates a new policy in the specified compartment (either the tenancy or another of your compartments). If you're new to policies, see Getting Started with Policies You must specify a name for the policy, which must be unique across all policies in your tenancy and cannot be changed. You must also specify a description for the policy (although it can be an empty string).
プロパティ
- オペレーティングシステム
- すべて
- タグ
- ociiam
- 参照
- CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.1 Ensure service level admins are created to manage resources of particular service