01 Run iam policy get command (Windows/macOS/Linux) to describe the policy statements defined for the access policy that grants tenancy-wide resource access to non-admin groups:
oci iam policy get
--policy-id 'ocid1.policy.oc1..aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234'
--query 'data."statements"'
02 The command output should return the requested policy statements:
[
"Allow group <group-name> to inspect users in tenancy",
"Allow group <group-name> to use users in tenancy",
"Allow group <group-name> to inspect groups in tenancy",
"Allow group <group-name> to use groups in tenancy"
]
03 Identify the policy statements that allows service administrators to update the tenancy "Administrators" group, i.e., Allow group \<group-name\> to use users in tenancy and/or Allow group \<group-name\> to use groups in tenancy, and replace them with the following statements: Allow group \<group-name\> to use users in tenancy where target.group.name !='Administrators' and Allow group \<group-name\> to use groups in tenancy where target.group.name !='Administrators', as shown in the example below:
[
"Allow group <group-name> to inspect users in tenancy"
"Allow group <group-name> to use users in tenancy where target.group.name !='Administrators'"
"Allow group <group-name> to inspect groups in tenancy"
"Allow group <group-name> to use groups in tenancy where target.group.name !='Administrators'"
]
04 Run iam policy update command (Windows/macOS/Linux) to update the specified access policy with the statements modified in the previous step. IMPORTANT: The value passed to --statements parameter will overwrite all existing statements for the selected policy, therefore, ensure that you add all the existing policy statements to the --statements parameter value. Replace \<group-name\> with the name of your service administrator group:
oci iam policy update
--policy-id 'ocid1.policy.oc1..aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234'
--statements '["Allow group <group-name> to inspect users in tenancy","Allow group <group-name> to use users in tenancy where target.group.name !='Administrators'","Allow group <group-name> to inspect groups in tenancy","Allow group <group-name> to use groups in tenancy where target.group.name !='Administrators'"]'
--version-date '2025-03-08'
05 Type y and press Enter to confirm the policy changes:
WARNING: The value passed to statements will overwrite all existing statements for this policy. The existing statements are:
[
"Allow group <group-name> to inspect users in tenancy",
"Allow group <group-name> to use users in tenancy",
"Allow group <group-name> to inspect groups in tenancy",
"Allow group <group-name> to use groups in tenancy"
]
Are you sure you want to continue? [y/N]: y
06 The command output should return the resource information available for the modified access policy:
{
"data": {
"compartment-id": "ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
"description": "Access Policy For IAM Admins",
"freeform-tags": {},
"id": "ocid1.policy.oc1..aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234",
"inactive-status": null,
"lifecycle-state": "ACTIVE",
"name": "cc-project5-iam-admin-policy",
"statements": [
"Allow group <group-name> to inspect users in tenancy",
"Allow group <group-name> to use users in tenancy where target.group.name !=Administrators",
"Allow group <group-name> to inspect groups in tenancy",
"Allow group <group-name> to use groups in tenancy where target.group.name !=Administrators"
],
"time-created": "2025-03-08T11:05:42.290000+00:00",
"version-date": "2025-03-08T00:00:00+00:00"
},
"etag": "abcd1234abcd1234abcd1234abcd1234abcd1234"
}
07 Repeat steps no. 1 - 6 for each access policy that you want to configure, available within the selected Oracle Cloud Infrastructure (OCI) compartment.
08 Repeat steps no. 1 – 7 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.
Security