Back to Checks
oraclecloud

Identity policy does not grant broad 'manage all-resources' permissions

identity_service_level_admins_exist
Service: identitySeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Policy

OCI IAM policies are reviewed for overly broad entitlements, specifically statements granting manage all-resources without scoping to particular services or compartments. Only active policies are considered; the default tenant admin policy is excluded.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Broad manage all-resources grants erode least privilege, enabling access across the tenancy. A compromised user or misused token could cause privilege escalation, data exfiltration, destructive changes, and service disruption, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks identity_service_level_admins_exist

Recommendation

Apply least privilege and separation of duties:

  • Replace manage all-resources with service-scoped permissions and compartment limits
  • Create service-level admin groups for specific families
  • Use tags/regions for conditions, when applicable
  • Employ time-bound elevation and periodic reviews

Remediation

CLI

oci iam policy update --policy-id <policy-ocid> --statements '["Allow group <GroupName> to manage instance-family in compartment <CompartmentName>"]'

Terraform

resource "oci_identity_policy" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  name           = "<example_resource_name>"
  description    = "<policy-description>"

  # Critical: restrict to a specific service family to avoid broad 'manage all-resources'
  statements = [
    "Allow group <GroupName> to manage instance-family in compartment <CompartmentName>"
  ]
}

Other

1In OCI Console, go to Identity & Security > Policies
2Open the policy that contains a statement with "manage all-resources"
3Click Edit policy statements
4Remove the statement(s) containing "manage all-resources"
5Add a service-specific statement, e.g.: Allow group <GroupName> to manage instance-family in compartment <CompartmentName>
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
    identity_client,
)


class identity_service_level_admins_exist(Check):
    """Ensure service level admins are created to manage resources of particular service (CIS 1.1)"""

    def execute(self):
        """Ensure service level admins are created to manage resources of particular service.

        This check ensures that policies don't grant overly broad permissions like "manage all-resources"
        without being restricted to specific services or compartments.
        """
        findings = []

        # Check for policies that violate least privilege by granting manage all-resources
        for policy in identity_client.policies:
            # Skip non-active policies
            if policy.lifecycle_state != "ACTIVE":
                continue

            # Skip default tenant admin policy
            if policy.name.upper() == "TENANT ADMIN POLICY":
                continue

            region = policy.region if hasattr(policy, "region") else "global"

            has_violation = False
            for statement in policy.statements:
                statement_upper = statement.upper()

                # Check for "allow group ... to manage all-resources" (not specific to service/compartment)
                if (
                    "ALLOW GROUP" in statement_upper
                    and "TO MANAGE ALL-RESOURCES" in statement_upper
                ):
                    has_violation = True
                    break

            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=policy,
                region=region,
                resource_id=policy.id,
                resource_name=policy.name,
                compartment_id=policy.compartment_id,
            )

            if has_violation:
                report.status = "FAIL"
                report.status_extended = f"Policy '{policy.name}' grants 'manage all-resources' permissions. Service-level administrators should be created with permissions limited to specific services (e.g., manage instance-family, manage volume-family) in specific compartments."
            else:
                report.status = "PASS"
                report.status_extended = f"Policy '{policy.name}' follows least privilege principle by not granting broad 'manage all-resources' permissions."

            findings.append(report)

        # If no policies found, that's also a finding
        if not findings:
            region = (
                identity_client.audited_regions[0].key
                if identity_client.audited_regions
                else "global"
            )
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region=region,
                resource_id=identity_client.audited_tenancy,
                resource_name="Tenancy",
                compartment_id=identity_client.audited_tenancy,
            )
            report.status = "PASS"
            report.status_extended = (
                "No active policies found with overly broad permissions."
            )
            findings.append(report)

        return findings

References