Back to Checks
oraclecloud

OCI IAM policy does not grant 'manage all-resources in tenancy' unless it is the Tenant Admin Policy

identity_tenancy_admin_permissions_limited
Service: identitySeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Policy

OCI IAM policies are analyzed for statements granting manage all-resources in tenancy to groups. Only the Tenant Admin Policy for the Administrators group should include this broad verb. Any other active policy containing this tenancy-wide permission is identified.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Tenancy-wide manage rights for non-admins allow complete control of identities and resources. A compromised account can escalate privileges, exfiltrate data across compartments, alter or delete workloads and backups, and disable monitoring-impacting confidentiality, integrity, and availability of the entire tenancy.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks identity_tenancy_admin_permissions_limited

Recommendation

Restrict manage all-resources in tenancy to the Administrators group only. Apply least privilege by scoping access to compartments and specific resource families, using conditions to narrow rights. Enforce separation of duties, maintain a break-glass admin model, and review policies regularly to prevent privilege drift.

Remediation

CLI

oci iam policy delete --policy-id <POLICY_OCID> --force

Terraform

resource "oci_identity_policy" "<example_resource_name>" {
  name           = "<POLICY_NAME>"
  compartment_id = "<example_compartment_id>"
  description    = "Replace tenancy-wide admin with scoped permissions"

  statements = [
    # FIX: Replace "in tenancy" with compartment scope to remove overly broad permission
    "allow group <group_name> to manage all-resources in compartment <compartment_name>"
  ]
}

Other

1In OCI Console, go to Identity & Security > Policies
2Open each ACTIVE policy that is NOT named "Tenant Admin Policy"
3Click Edit policy
4Remove any statement containing: to manage all-resources in tenancy; or change it to: in compartment <compartment_name>
5Click Save

Check Code

"""Check Ensure permissions on all resources are given only to the tenancy administrator group."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
    identity_client,
)


class identity_tenancy_admin_permissions_limited(Check):
    """Check Ensure permissions on all resources are given only to the tenancy administrator group."""

    def execute(self) -> Check_Report_OCI:
        """Execute the identity_tenancy_admin_permissions_limited check.

        Ensure permissions on all resources are given only to the tenancy administrator group.
        This check verifies that only the 'Tenant Admin Policy' grants 'manage all-resources in tenancy' permissions.
        Other policies should not have such broad permissions.
        """
        findings = []

        # Check for policies that grant "manage all-resources in tenancy"
        for policy in identity_client.policies:
            # Skip non-active policies
            if policy.lifecycle_state != "ACTIVE":
                continue

            region = policy.region if hasattr(policy, "region") else "global"

            has_violation = False
            for statement in policy.statements:
                statement_upper = statement.upper()

                # Check for "allow group ... to manage all-resources in tenancy"
                # This should only be in "Tenant Admin Policy"
                if (
                    "ALLOW GROUP" in statement_upper
                    and "TO MANAGE ALL-RESOURCES IN TENANCY" in statement_upper
                ):
                    # If this is not the Tenant Admin Policy, it's a violation
                    if policy.name.upper() != "TENANT ADMIN POLICY":
                        has_violation = True
                    break

            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=policy,
                region=region,
                resource_name=policy.name,
                resource_id=policy.id,
                compartment_id=policy.compartment_id,
            )

            if has_violation:
                report.status = "FAIL"
                report.status_extended = f"Policy '{policy.name}' grants 'manage all-resources in tenancy' permissions to groups other than the Administrators group. Only the tenancy administrator group should have such broad permissions."
            else:
                report.status = "PASS"
                report.status_extended = f"Policy '{policy.name}' does not grant overly broad tenancy-wide permissions to non-administrator groups."

            findings.append(report)

        # If no policies found, that's a PASS (no violations)
        if not findings:
            region = (
                identity_client.audited_regions[0].key
                if identity_client.audited_regions
                else "global"
            )
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region=region,
                resource_name="Tenancy",
                resource_id=identity_client.audited_tenancy,
                compartment_id=identity_client.audited_tenancy,
            )
            report.status = "PASS"
            report.status_extended = "No active policies found granting overly broad tenancy-wide permissions to non-administrator groups."
            findings.append(report)

        return findings

References