> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI IAM Password Policy Should Enforce Yearly Rotation

### More Info:

The IAM password policy should enforce password expiration within 365 days. Passwords that never expire remain vulnerable indefinitely if compromised without detection.

### Risk Level

High

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To enforce yearly password rotation in OCI IAM using the Console, you need to update the password policy for your identity domain (or for the tenancy if you’re still using the classic model).

        Below are the steps for both models—use the one that matches what you see in your Console.

        ***

        ## 1. For **Identity Domains** (most new tenancies)

        1. **Sign in to OCI Console** with a user that has `identity-domain-admin` or tenancy admin privileges.
        2. In the left hamburger menu, go to:\
           **Identity & Security → Domains**.
        3. Click the **Identity Domain** you want to configure (e.g., “Default”).
        4. In the domain page, under **Security**, click **Password Policy** (or **Security → Password policy**, depending on UI version).
        5. Edit the policy:
           * Locate **Maximum password age** (or similar field).
           * Set it to **365 days** (or 12 months, as allowed by UI).
        6. Review other parameters (optional) such as:
           * Password history
           * Minimum password length
           * Complexity requirements
        7. Click **Save** or **Update** to apply the changes.

        This will enforce that all local users in that identity domain must change their passwords at least once every year.

        ***

        ## 2. For **Classic IAM (Tenancy-level password policy)**

        If you don’t see “Domains” and instead work with “Users, Groups, Policies” directly:

        1. **Sign in to OCI Console** with tenancy admin privileges.
        2. Go to:\
           **Identity & Security → Administration → Security** (or directly **Identity → Security** depending on UI).
        3. Click **Password Policy**.
        4. Click **Edit**.
        5. Set:
           * **Maximum password age (days)** = **365**.
        6. Save/apply the configuration.

        This applies to all local IAM users in the tenancy using the classic IAM model.

        ***

        If you tell me whether you see “Identity Domains” or just “Users/Groups/Policies,” I can tailor the exact menu path for your specific layout.
      </Accordion>

      <Accordion title="Using CLI">
        Below are the exact steps to enforce yearly password rotation in OCI IAM using the OCI CLI.

        ### 1. Prerequisites

        * OCI CLI installed and configured (`oci setup config`)
        * You must be in the home region
        * You need your **tenancy OCID** (root compartment OCID)

        If you don’t know it:

        ```bash theme={null}
        oci iam tenancy get --tenancy-id <tenancy_ocid>
        ```

        (You can also copy it from the console under “Tenancy Information”.)

        ***

        ### 2. Check the Current Password Policy

        ```bash theme={null}
        oci iam authentication-policy get \
          --compartment-id <tenancy_ocid> \
          --query "data.password-policy" \
          --output table
        ```

        This shows current settings, including `isPasswordExpiryEnabled` and `passwordExpiryInDays`.

        ***

        ### 3. Update Policy to Enforce Yearly Rotation (365 Days)

        Run this command, adjusting other fields as needed. The key change for yearly rotation is:

        * `"isPasswordExpiryEnabled": true`
        * `"passwordExpiryInDays": 365`

        ```bash theme={null}
        oci iam authentication-policy update \
          --compartment-id <tenancy_ocid> \
          --password-policy '{
            "isLowercaseCharactersRequired": true,
            "isUppercaseCharactersRequired": true,
            "isNumericCharactersRequired": true,
            "isSpecialCharactersRequired": true,
            "isPasswordExpiryEnabled": true,
            "passwordExpiryInDays": 365,
            "isPasswordReusePreventionEnabled": true,
            "minimumPasswordLength": 12,
            "isUsernameContainmentAllowed": false
          }'
        ```

        Notes:

        * Include all required fields in `--password-policy` (not just the ones you’re changing), otherwise some may reset.
        * Adjust `minimumPasswordLength` and the character requirements to your organization’s standards.

        ***

        ### 4. Verify the Change

        ```bash theme={null}
        oci iam authentication-policy get \
          --compartment-id <tenancy_ocid> \
          --query "data.password-policy" \
          --output table
        ```

        Confirm:

        * `isPasswordExpiryEnabled = true`
        * `passwordExpiryInDays = 365`

        This will satisfy the “OCI IAM Password Policy Should Enforce Yearly Rotation” requirement for IAM monitoring / Cloud Guard.
      </Accordion>

      <Accordion title="Using Python">
        To enforce yearly password rotation for OCI IAM using Python, you’ll:

        1. **Check the current password policy**
        2. **Update it so `password_lifetime` = 365 days**
        3. Optionally **turn this into a “monitor + auto-remediate” script**

        Below are the concrete steps and Python code.

        ***

        ## 1. Prerequisites

        1. Install OCI Python SDK:
           ```bash theme={null}
           pip install oci
           ```

        2. Make sure you have an OCI config file (usually `~/.oci/config`) with:
           ```ini theme={null}
           [DEFAULT]
           user=ocid1.user.oc1..
           fingerprint=xx:xx:xx:...
           key_file=/path/to/oci_api_key.pem
           tenancy=ocid1.tenancy.oc1..
           region=us-ashburn-1
           ```

        You need permissions like:

        * `identity-domains-authentication-policies Manage`
          or equivalent in your tenancy (typically via `manage authentication-policies` on tenancy).

        ***

        ## 2. Get Current Authentication (Password) Policy

        ```python theme={null}
        import oci

        config = oci.config.from_file("~/.oci/config", "DEFAULT")

        identity_client = oci.identity.IdentityClient(config)

        # Tenancy OCID from config
        tenancy_id = config["tenancy"]

        # Fetch current password/authentication policy
        current_policy = identity_client.get_authentication_policy(tenancy_id).data
        print("Current password_lifetime:", current_policy.password_policy.password_lifetime)
        ```

        `password_lifetime` is in days (or `None` if not set).

        ***

        ## 3. Enforce Yearly Rotation (365 Days)

        ```python theme={null}
        import oci

        config = oci.config.from_file("~/.oci/config", "DEFAULT")
        identity_client = oci.identity.IdentityClient(config)
        tenancy_id = config["tenancy"]

        # Get existing policy object
        authn_policy = identity_client.get_authentication_policy(tenancy_id).data

        # Copy current password policy and adjust lifetime
        password_policy = authn_policy.password_policy

        # Set to 365 days (yearly rotation)
        password_policy.password_lifetime = 365

        update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
            password_policy=password_policy
        )

        response = identity_client.update_authentication_policy(
            tenancy_id,
            update_details
        )

        print("Updated password_lifetime to:", response.data.password_policy.password_lifetime)
        ```

        This directly remediates the misconfiguration by enforcing yearly rotation.

        ***

        ## 4. Turn It into “Monitoring + Auto-Remediation”

        A minimal monitoring script that:

        * Checks if `password_lifetime` is 365
        * If not, sets it to 365 and logs the action

        ```python theme={null}
        import oci
        import datetime

        TARGET_LIFETIME = 365

        def enforce_password_rotation(config_profile="DEFAULT"):
            config = oci.config.from_file("~/.oci/config", config_profile)
            identity_client = oci.identity.IdentityClient(config)
            tenancy_id = config["tenancy"]

            authn_policy = identity_client.get_authentication_policy(tenancy_id).data
            password_policy = authn_policy.password_policy

            current_lifetime = password_policy.password_lifetime
            print(f"[{datetime.datetime.utcnow().isoformat()}] Current password_lifetime: {current_lifetime}")

            if current_lifetime == TARGET_LIFETIME:
                print("Compliant. No change needed.")
                return

            password_policy.password_lifetime = TARGET_LIFETIME
            update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
                password_policy=password_policy
            )

            response = identity_client.update_authentication_policy(
                tenancy_id,
                update_details
            )

            print(f"Updated password_lifetime to {response.data.password_policy.password_lifetime}")

        if __name__ == "__main__":
            enforce_password_rotation()
        ```

        Run this script on a schedule (e.g., cron, OCI Scheduled Tasks via Functions/Events) to continuously monitor and auto-remediate the password policy.

        If you want, I can adapt this into an OCI Function (with `func.yaml` and handler) for fully managed monitoring.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_identity_password_policy" "iam_password_policy" {
          # Replace with your tenancy OCID
          compartment_id = "TENANCY_OCID"

          # Existing settings (examples – keep or adjust to match your policy)
          minimum_password_length          = 14
          is_lowercase_characters_required = true
          is_uppercase_characters_required = true
          is_numeric_characters_required   = true
          is_special_characters_required   = true
          is_username_containment_allowed  = false
          allowed_attempts                 = 5
          is_password_reset_required       = false

          # Fix: enforce password expiration within 365 days
          is_password_expires     = true
          password_expires_in_days = 365
        }
        ```

        This change updates the existing IAM password policy in place (no resource replacement or outage). After applying, `terraform plan` should show an in-place update to `is_password_expires = true` and `password_expires_in_days = 365` on `oci_identity_password_policy.iam_password_policy`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>