OCI IAM Password Policy Should Enforce Yearly Rotation

Using Console

To enforce yearly password rotation in OCI IAM using the Console, you need to update the password policy for your identity domain (or for the tenancy if you’re still using the classic model).Below are the steps for both models—use the one that matches what you see in your Console.

1. For Identity Domains (most new tenancies)

Sign in to OCI Console with a user that has identity-domain-admin or tenancy admin privileges.
In the left hamburger menu, go to:
Identity & Security → Domains.
Click the Identity Domain you want to configure (e.g., “Default”).
In the domain page, under Security, click Password Policy (or Security → Password policy, depending on UI version).
Edit the policy:
- Locate Maximum password age (or similar field).
- Set it to 365 days (or 12 months, as allowed by UI).
Review other parameters (optional) such as:
- Password history
- Minimum password length
- Complexity requirements
Click Save or Update to apply the changes.

This will enforce that all local users in that identity domain must change their passwords at least once every year.

2. For Classic IAM (Tenancy-level password policy)

If you don’t see “Domains” and instead work with “Users, Groups, Policies” directly:

Sign in to OCI Console with tenancy admin privileges.
Go to:
Identity & Security → Administration → Security (or directly Identity → Security depending on UI).
Click Password Policy.
Click Edit.
Set:
- Maximum password age (days) = 365.
Save/apply the configuration.

This applies to all local IAM users in the tenancy using the classic IAM model.

If you tell me whether you see “Identity Domains” or just “Users/Groups/Policies,” I can tailor the exact menu path for your specific layout.

Using CLI

Below are the exact steps to enforce yearly password rotation in OCI IAM using the OCI CLI.

1. Prerequisites

OCI CLI installed and configured (oci setup config)
You must be in the home region
You need your tenancy OCID (root compartment OCID)

If you don’t know it:

oci iam tenancy get --tenancy-id <tenancy_ocid>

(You can also copy it from the console under “Tenancy Information”.)

2. Check the Current Password Policy

oci iam authentication-policy get \
  --compartment-id <tenancy_ocid> \
  --query "data.password-policy" \
  --output table

This shows current settings, including isPasswordExpiryEnabled and passwordExpiryInDays.

3. Update Policy to Enforce Yearly Rotation (365 Days)

Run this command, adjusting other fields as needed. The key change for yearly rotation is:

"isPasswordExpiryEnabled": true
"passwordExpiryInDays": 365

oci iam authentication-policy update \
  --compartment-id <tenancy_ocid> \
  --password-policy '{
    "isLowercaseCharactersRequired": true,
    "isUppercaseCharactersRequired": true,
    "isNumericCharactersRequired": true,
    "isSpecialCharactersRequired": true,
    "isPasswordExpiryEnabled": true,
    "passwordExpiryInDays": 365,
    "isPasswordReusePreventionEnabled": true,
    "minimumPasswordLength": 12,
    "isUsernameContainmentAllowed": false
  }'

Notes:

Include all required fields in --password-policy (not just the ones you’re changing), otherwise some may reset.
Adjust minimumPasswordLength and the character requirements to your organization’s standards.

4. Verify the Change

oci iam authentication-policy get \
  --compartment-id <tenancy_ocid> \
  --query "data.password-policy" \
  --output table

Confirm:

isPasswordExpiryEnabled = true
passwordExpiryInDays = 365

This will satisfy the “OCI IAM Password Policy Should Enforce Yearly Rotation” requirement for IAM monitoring / Cloud Guard.

Using Python

To enforce yearly password rotation for OCI IAM using Python, you’ll:

Check the current password policy
Update it so password_lifetime = 365 days
Optionally turn this into a “monitor + auto-remediate” script

Below are the concrete steps and Python code.

1. Prerequisites

Install OCI Python SDK:
pip install oci

Make sure you have an OCI config file (usually ~/.oci/config) with:

[DEFAULT]
user=ocid1.user.oc1..
fingerprint=xx:xx:xx:...
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..
region=us-ashburn-1

You need permissions like:

identity-domains-authentication-policies Manage or equivalent in your tenancy (typically via manage authentication-policies on tenancy).

2. Get Current Authentication (Password) Policy

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")

identity_client = oci.identity.IdentityClient(config)

# Tenancy OCID from config
tenancy_id = config["tenancy"]

# Fetch current password/authentication policy
current_policy = identity_client.get_authentication_policy(tenancy_id).data
print("Current password_lifetime:", current_policy.password_policy.password_lifetime)

password_lifetime is in days (or None if not set).

3. Enforce Yearly Rotation (365 Days)

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
identity_client = oci.identity.IdentityClient(config)
tenancy_id = config["tenancy"]

# Get existing policy object
authn_policy = identity_client.get_authentication_policy(tenancy_id).data

# Copy current password policy and adjust lifetime
password_policy = authn_policy.password_policy

# Set to 365 days (yearly rotation)
password_policy.password_lifetime = 365

update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
    password_policy=password_policy
)

response = identity_client.update_authentication_policy(
    tenancy_id,
    update_details
)

print("Updated password_lifetime to:", response.data.password_policy.password_lifetime)

This directly remediates the misconfiguration by enforcing yearly rotation.

4. Turn It into “Monitoring + Auto-Remediation”

A minimal monitoring script that:

Checks if password_lifetime is 365
If not, sets it to 365 and logs the action

import oci
import datetime

TARGET_LIFETIME = 365

def enforce_password_rotation(config_profile="DEFAULT"):
    config = oci.config.from_file("~/.oci/config", config_profile)
    identity_client = oci.identity.IdentityClient(config)
    tenancy_id = config["tenancy"]

    authn_policy = identity_client.get_authentication_policy(tenancy_id).data
    password_policy = authn_policy.password_policy

    current_lifetime = password_policy.password_lifetime
    print(f"[{datetime.datetime.utcnow().isoformat()}] Current password_lifetime: {current_lifetime}")

    if current_lifetime == TARGET_LIFETIME:
        print("Compliant. No change needed.")
        return

    password_policy.password_lifetime = TARGET_LIFETIME
    update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
        password_policy=password_policy
    )

    response = identity_client.update_authentication_policy(
        tenancy_id,
        update_details
    )

    print(f"Updated password_lifetime to {response.data.password_policy.password_lifetime}")

if __name__ == "__main__":
    enforce_password_rotation()

Run this script on a schedule (e.g., cron, OCI Scheduled Tasks via Functions/Events) to continuously monitor and auto-remediate the password policy.If you want, I can adapt this into an OCI Function (with func.yaml and handler) for fully managed monitoring.

Using Terraform

resource "oci_identity_password_policy" "iam_password_policy" {
  # Replace with your tenancy OCID
  compartment_id = "TENANCY_OCID"

  # Existing settings (examples – keep or adjust to match your policy)
  minimum_password_length          = 14
  is_lowercase_characters_required = true
  is_uppercase_characters_required = true
  is_numeric_characters_required   = true
  is_special_characters_required   = true
  is_username_containment_allowed  = false
  allowed_attempts                 = 5
  is_password_reset_required       = false

  # Fix: enforce password expiration within 365 days
  is_password_expires     = true
  password_expires_in_days = 365
}

This change updates the existing IAM password policy in place (no resource replacement or outage). After applying, terraform plan should show an in-place update to is_password_expires = true and password_expires_in_days = 365 on oci_identity_password_policy.iam_password_policy.

OCI Misconfigurations

OCI IAM Password Policy Should Enforce Yearly Rotation

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. For Identity Domains (most new tenancies)

2. For Classic IAM (Tenancy-level password policy)

1. Prerequisites

2. Check the Current Password Policy

3. Update Policy to Enforce Yearly Rotation (365 Days)

4. Verify the Change

1. Prerequisites

2. Get Current Authentication (Password) Policy

3. Enforce Yearly Rotation (365 Days)

4. Turn It into “Monitoring + Auto-Remediation”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. For Identity Domains (most new tenancies)

​2. For Classic IAM (Tenancy-level password policy)

​1. Prerequisites

​2. Check the Current Password Policy

​3. Update Policy to Enforce Yearly Rotation (365 Days)

​4. Verify the Change

​1. Prerequisites

​2. Get Current Authentication (Password) Policy

​3. Enforce Yearly Rotation (365 Days)

​4. Turn It into “Monitoring + Auto-Remediation”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. For Identity Domains (most new tenancies)

2. For Classic IAM (Tenancy-level password policy)

1. Prerequisites

2. Check the Current Password Policy

3. Update Policy to Enforce Yearly Rotation (365 Days)

4. Verify the Change

1. Prerequisites

2. Get Current Authentication (Password) Policy

3. Enforce Yearly Rotation (365 Days)

4. Turn It into “Monitoring + Auto-Remediation”