TMA-OCI-1.3

Ensure IAM administrators cannot update tenancy Administrators group

YüksekDüzey 1Otomatikoci

Açıklama

Tenancy administrators can create more users, groups, and policies to provide other service administrators access to OCI resources. For example, an IAM administrator will need to have access to manage resources like compartments, users, groups, dynamic-groups, policies, identity-providers, tenancy tag-namespaces ... These policy statements ensure that no other group can manage tenancy administrator users or the membership to the 'Administrators' group thereby gain or remove tenancy administrator access. Flags root-compartment statements that grant use/manage users or groups in tenancy without a target.group.name != 'Administrators' condition (statements for the Administrators group itself are ignored). Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
out=$(oci iam policy list --compartment-id "$t" --all --query 'data[].statements[]' --raw-output 2>/dev/null) || exit 1
b=$(printf '%s\n' "$out" | grep -Ei "to[[:space:]]+(use|manage)[[:space:]]+(users|groups)[[:space:]]+in[[:space:]]+tenancy" | grep -Eiv "allow[[:space:]]+group[[:space:]]+('?default'?/)?'?administrators'?[[:space:]]+to" | grep -Eiv "target\.group\.name[[:space:]]*!=[[:space:]]*'?administrators'?" || true)
[ -z "$b" ] && echo compliant || printf '%s\n' "$b"

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

Add a condition to each listed statement, e.g. Allow group IAMAdmins to use users in tenancy where target.group.name != 'Administrators' (and likewise for groups).

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: ociiam
Referans: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 1.3 Ensure IAM administrators cannot update tenancy Administrators group

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target oci