🛡️ Oracle IAM Administrator User has an active API key🟢

• Contextual name: 🛡️ IAM Administrator User has an active API key🟢
• ID: /ce/ca/oracle/iam/administrator-user-has-active-api-key
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Oracle IAM User
  • 🔌 Oracle IAM Group - object.extracts.yaml
  • 🔌 Oracle IAM User API Key - object.extracts.yaml
  • 🔌 Oracle IAM User - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies active Oracle IAM users that are members of the tenancy Administrators group and have at least one active API key. OCI API keys are long-term credentials used to sign programmatic requests to Oracle Cloud Infrastructure APIs.

Rationale

Tenancy administrator users have broad control over OCI resources and identity configuration. Keeping active API keys on these users creates durable programmatic access that can bypass interactive session controls and remain usable until the key is deleted. Removing API keys from administrator users reduces the impact of credential disclosure and encourages privileged operations to use tightly scoped identities.

Impact

Deleting an API key can disrupt applications, scripts, integrations, or users that still depend on that key for OCI API access. Before deleting the key, identify its owner and consumers, move required automation to a least-privileged user, instance principal, resource principal, or dynamic group, and confirm that access remains functional.

... see more

Remediation

Open File

Remediation

Remove API Keys From Tenancy Administrator Users

Delete active API keys from users in the tenancy Administrators group. If programmatic access is required, move the workload to a dedicated least-privileged identity, such as a scoped IAM user, instance principal, resource principal, or dynamic group.

From Oracle Cloud Console

1. Open Identity & Security.
2. Open Domains, select the relevant identity domain if applicable, and open Users.
3. Select the reported administrator user.
4. Open API Keys.
5. Delete each active API key that is no longer required.
6. Confirm that required automation has been moved to a least-privileged identity.

From OCI CLI

List the user's API keys:

oci iam api-key list --user-id {{user-ocid}} --all

Delete each active key by fingerprint after confirming that it is no longer required:

oci iam api-key delete \
    --user-id {{user-ocid}} \
    --fingerprint {{fingerprint}}

Run the list command again and confirm that no API keys remain in the ACTIVE lifecycle state for the tenancy administrator user.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Oracle v3.1.0 → 💼 1.12 Ensure API keys are not created for tenancy administrator users - Level 1 (Automated)			1		no data
💼 Cloudaware Framework → 💼 Credential Lifecycle Management			32		no data