Step 2: Assign "Read Only" permissions to parent tenancy.

Navigate to Policies > Create Policy

Enter Policy Name > Description.
Select the root compartment
Enable the manual editor.
Paste the below script and replace the Group name with the ones you copied in the previous steps.

define tenancy cu-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
Allow group 'Default'/'<Group-name>' to read all-resources in tenancy
endorse group 'Default'/'<Group-name>' to read objects in tenancy cu-report

Click on Create button.