TMA-OCI-1.12

Ensure API keys are not created for tenancy administrator users

높음레벨 1자동oci

설명

Tenancy administrator users have full access to the organization's OCI tenancy. API keys associated with user accounts are used for invoking the OCI APIs via custom programs or clients like CLI/SDKs. The clients are typically used for performing day-to-day operations and should never require full tenancy access. For performing day-to-day operations tenancy administrator access is not needed. Service-level administrative users with API keys should be used to apply privileged security principle. Members of the tenancy Administrators group may not have ACTIVE API keys. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

점검 방법

감사 방식: 셸 명령

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
g=$(oci iam group list --compartment-id "$t" --all --query 'data[?name==`"Administrators"`].id | [0]' --raw-output 2>/dev/null) || exit 1
[ -n "$g" ] || exit 1
ms=$(oci iam group list-users --group-id "$g" --all --query 'data[].id' --raw-output 2>/dev/null) || exit 1
for u in $(printf '%s\n' "$ms" | grep -o 'ocid1\.user\.[^"]*'); do
  n=$(oci iam user api-key list --user-id "$u" --query 'length(data[?"lifecycle-state"==`"ACTIVE"`])' --raw-output 2>/dev/null) || exit 1
  [ "${n:-0}" -eq 0 ] || { echo "administrator with API key: $u"; bad=1; }
done
[ "$bad" -eq 0 ] && echo compliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Delete API keys of Administrators group members (oci iam user api-key delete) and run automation as dedicated service users or instance/resource principals with least privilege.

속성

운영 체제: 모두
태그: ociiam
참고 자료: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.12 Ensure API keys are not created for tenancy administrator users

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oci