Back to Checks
oraclecloud

Tenancy administrator user has no API keys

identity_tenancy_admin_users_no_api_keys
Service: identitySeverity: high
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:User

OCI tenancy administrator accounts (members of the Administrators group) are inspected for configured user API keys tied to those identities.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Admin API keys are long-lived secrets that can be stolen from endpoints or repos, enabling non-interactive, MFA-less access. Attackers could run privileged API calls, exfiltrate data, modify policies, or delete resources, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks identity_tenancy_admin_users_no_api_keys

Recommendation

Do not issue API keys to tenancy administrators. Apply least privilege and separation of duties: use non-admin service accounts or principals with narrowly scoped rights and short-lived credentials. Require SSO/MFA for admin access, and enforce rapid key revocation and rotation for any programmatic identities.

Remediation

Other

1Sign in to the Oracle Cloud Console
2Open the navigation menu and go to Identity & Security > Domains
3Select your domain (<example_resource_name>), then click Users
4Click the tenancy administrator user (<example_resource_name>)
5Open the API Keys tab
6For each API key, click Actions > Delete and confirm
7Repeat until the API Keys list is empty

Check Code

"""Check Ensure API keys are not created for tenancy administrator users."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
    identity_client,
)


class identity_tenancy_admin_users_no_api_keys(Check):
    """Check Ensure API keys are not created for tenancy administrator users."""

    def execute(self) -> Check_Report_OCI:
        """Execute the identity_tenancy_admin_users_no_api_keys check."""
        findings = []

        # Check tenancy admin users for API keys
        for user in identity_client.users:
            # Check if user is in Administrators group
            is_admin = False
            for group_id in user.groups:
                for group in identity_client.groups:
                    if group.id == group_id and "Administrators" in group.name:
                        is_admin = True
                        break

            if is_admin:
                report = Check_Report_OCI(
                    metadata=self.metadata(),
                    resource=user,
                    region=user.region,
                    resource_name=user.name,
                    resource_id=user.id,
                    compartment_id=user.compartment_id,
                )

                if user.api_keys:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Tenancy administrator user {user.name} has API keys."
                    )
                else:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Tenancy administrator user {user.name} has no API keys."
                    )

                findings.append(report)

        return findings

References