Step- 2: Assign "Read Only" permissions to parent tenancy.
- Navigate to Policies > Create Policy 

- Enter Policy Name > Description. 
- Select the root compartment 
- Enable the manual editor. 
- Paste the below script and replace the Group name with the ones you copied in the previous steps. 
        CODE
    
    define tenancy cu-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
Allow group 'Default'/'<Group-name>' to read all-resources in tenancy
endorse group 'Default'/'<Group-name>' to read objects in tenancy cu-report- Click on Create button. 

.png)