Step- 2: Assign "Read Only" permissions to parent tenancy.
Navigate to Policies > Create Policy
Enter Policy Name > Description.
Select the root compartment
Enable the manual editor.
Paste the below script and replace the Group name with the ones you copied in the previous steps.
CODE
define tenancy cu-report as ocid1.tenancy.oc1..aaaaaaaaned4fkpkisbwjlr56u7cj63lf3wffbilvqknstgtvzub7vhqkggq
Allow group 'Default'/'<Group-name>' to read all-resources in tenancy
endorse group 'Default'/'<Group-name>' to read objects in tenancy cu-report
Click on Create button.