Query: 1.1 Ensure service level admins are created to manage resources of particular service

Description

To apply least-privilege security principle, one can create service-level administrators in corresponding groups and assigning specific users to each service-level administrative group in a tenancy. This limits administrative access in a tenancy.

Query

Tables used in this query:

• oci_identity_tenancy

Controls using this query:

• 1.1 Ensure service level admins are created to manage resources of particular service
• 1.1 Ensure service level admins are created to manage resources of particular service
• 1.1 Ensure service level admins are created to manage resources of particular service
• 1.1 Ensure service level admins are created to manage resources of particular service
• 1.13 Ensure Dynamic Groups are used for OCI instances, OCI Cloud Databases and OCI Function to access OCI resources
• 1.14 Ensure Instance Principal authentication is used for OCI instances, OCI Cloud Databases and OCI Functions to access OCI resources
• 1.14 Ensure Instance Principal authentication is used for OCI instances, OCI Cloud Databases and OCI Functions to access OCI resources
• 1.14 Ensure storage service-level admins cannot delete resources they manage
• 1.15 Ensure storage service-level admins cannot delete resources they manage
• 1.15 Ensure storage service-level admins cannot delete resources they manage
• 1.5 Ensure IAM password policy expires passwords within 365 days
• 1.5 Ensure IAM password policy expires passwords within 365 days
• 1.5 Ensure IAM password policy expires passwords within 365 days
• 1.6 Ensure IAM password policy prevents password reuse
• 1.6 Ensure IAM password policy prevents password reuse
• 1.6 Ensure IAM password policy prevents password reuse
• 2.6 Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources
• 2.6 Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources
• 2.6 Ensure Oracle Integration Cloud (OIC) access is restricted to allowed sources
• 2.7 Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network
• 2.7 Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network
• 2.7 Ensure Oracle Analytics Cloud (OAC) access is restricted to allowed sources or deployed within a Virtual Cloud Network
• 3.17 Ensure write level Object Storage logging is enabled for all buckets
• 3.17 Ensure write level Object Storage logging is enabled for all buckets
• 4.17 Ensure write level Object Storage logging is enabled for all buckets
• 5.2 Ensure no resources are created in the root compartment
• 5.2 Ensure no resources are created in the root compartment
• 6.2 Ensure no resources are created in the root compartment

SQL