Ensure service level admins are created to manage resources of particular service

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

From CLI: 1. Set up OCI CLI with an IAM administrator user who has read access to IAM resources such as groups and policies. 2. Run OCI CLI command providing the root_compartment_OCID Get the list of groups in a tenancy oci iam group list --compartment-id <root_compartment_OCID> | grep name A tenancy with identity domains : The above CLI commands work with the default identity domain only. For IaaS resource management, users and groups created in the default domain are sufficient. 3.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Refer to the policy syntax document and create new policies if the audit results indicate that the required policies are missing. This can be done via OCI console or OCI CLI/SDK or API. Creating a new policy: From CLI: oci iam policy create [OPTIONS] Creates a new policy in the specified compartment (either the tenancy or another of your compartments). If you're new to policies, see Getting Started with Policies You must specify a name for the policy, which must be unique across all policies in your tenancy and cannot be changed. You must also specify a description for the policy (although it can be an empty string).