OCI IAM Password Policy Should Require Minimum 14 Characters

Using Console

Here’s how to set the IAM password policy to require a minimum of 14 characters in OCI using the Console:

Sign in to OCI Console
Log in to the Oracle Cloud Console with an account that has tenancy-level IAM admin privileges (e.g., Administrator group).
Go to Identity & Security
- Open the Navigation menu (≡) in the top left.
- Under Identity & Security, click Domains (or Identity > Domains depending on your Console layout).
Select the Target Domain
- You’ll see a list of identity domains (or the default one if you’re using the older model).
- Click the identity domain where your users are managed (often Default).
Open Security Settings
- In the domain page, in the left-hand menu, click Security.
- Under Security, click Password Policies (or Password policy).
Edit the Password Policy
- On the Password Policy page, click Edit (or the pencil icon).
Set Minimum Password Length to 14
- Find the field Minimum password length (or similar).
- Change the value to 14.
- Review other password policy settings (complexity, reuse, lockout) as needed, but not required for this specific control.
Save the Policy
- Click Save or Save changes.
- The new minimum length applies to all new password changes and resets in that identity domain.
(Optional) Re-check in Monitoring/Cloud Guard
- If you’re using Cloud Guard or another OCI monitoring tool/policy that flagged this misconfiguration, wait a few minutes and re-run the check or assessment to confirm the issue is resolved.

If your tenancy still uses the older “Identity > Security > Password Policy” layout at tenancy level, the steps are the same conceptually:
Navigation menu → Identity & Security → Security → Password Policy → Edit → Set minimum length to 14 → Save.

Using CLI

To enforce a minimum 14-character password policy in OCI IAM using the OCI CLI, do the following:

1. Prerequisites

OCI CLI installed and configured (oci setup config)
You have permission to manage the tenancy’s authentication policy (e.g., identity-domains-authentication-policies or tenancy admin).

2. Get Your Tenancy OCID

If you don’t already have it:

oci iam tenancy get --tenancy-id <your-tenancy-ocid>

(or copy it from the Console: Profile → Tenancy: <name> → OCID)

3. View Current Authentication Policy

oci iam authentication-policy get \
  --compartment-id <your-tenancy-ocid>

Look at the output under passwordPolicy. You’ll see fields like minimumPasswordLength, isLowercaseCharactersRequired, etc.

4. Update Password Policy to Require Minimum 14 Characters

You can either:

Option A – Provide full password policy JSON inline

If you want to explicitly define the full policy (recommended when you know the desired settings):

oci iam authentication-policy update \
  --compartment-id <your-tenancy-ocid> \
  --password-policy '{
    "isLowercaseCharactersRequired": true,
    "isUppercaseCharactersRequired": true,
    "isNumericCharactersRequired": true,
    "isSpecialCharactersRequired": true,
    "minimumPasswordLength": 14,
    "isUsernameContainmentAllowed": false
  }'

Adjust booleans as needed, but keep "minimumPasswordLength": 14.

Option B – Modify only the minimum length (using a file)

Save the existing policy from step 3 into a file (for example, auth-policy.json) and edit it:
- Under "passwordPolicy", set:
  "minimumPasswordLength": 14

Apply the updated policy:

oci iam authentication-policy update \
  --compartment-id <your-tenancy-ocid> \
  --from-json file://auth-policy.json

5. Verify the Change

Run:

oci iam authentication-policy get \
  --compartment-id <your-tenancy-ocid> \
  --query "authenticationPolicy.passwordPolicy.minimumPasswordLength" \
  --raw-output

This should return:

That enforces a minimum 14-character password policy in OCI IAM via OCI CLI.

Using Python

To enforce a minimum 14-character password policy in OCI IAM using Python, you need to update the tenancy’s Authentication Policy via the OCI Python SDK.

1. Prerequisites

Install OCI Python SDK (if not already):
pip install oci
Configure OCI CLI/SDK config (tenancy OCID, user OCID, key, region, etc.), usually at: ~/.oci/config with a profile, e.g. [DEFAULT].

Your user must have IAM permissions similar to:

ALLOW GROUP <Your-Admin-Group> TO MANAGE authentication-policies IN TENANCY

2. Find Your Tenancy OCID

You can get it from the OCI Console:

Profile (top-right) → Tenancy: click it → copy OCID.

Or from your config file:

[DEFAULT]
tenancy=ocid1.tenancy.oc1......

3. Python Code: Update Password Policy to Minimum 14 Characters

import oci

# 1. Load config and create Identity client
config = oci.config.from_file("~/.oci/config", "DEFAULT")  # adjust path/profile as needed
identity_client = oci.identity.IdentityClient(config)

tenancy_id = config["tenancy"]

# 2. Get existing authentication policy (optional but recommended)
current_policy = identity_client.get_authentication_policy(tenancy_id).data

# 3. Prepare updated password policy
password_policy = current_policy.password_policy or oci.identity.models.PasswordPolicy()

# Set minimum length to 14
password_policy.minimum_password_length = 14

# (Optional) Leave other existing fields intact, e.g.:
# password_policy.is_numeric_characters_required = current_policy.password_policy.is_numeric_characters_required
# password_policy.is_uppercase_characters_required = current_policy.password_policy.is_uppercase_characters_required
# etc.

# 4. Build update payload
update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
    password_policy=password_policy
)

# 5. Call update_authentication_policy
response = identity_client.update_authentication_policy(
    tenancy_id=tenancy_id,
    update_authentication_policy_details=update_details
)

print("Updated password minimum length to:",
      response.data.password_policy.minimum_password_length)

4. Notes for “Monitoring / Auto-remediation”

If this is driven by a monitoring system (e.g., a Cloud Security Posture tool) and you want auto-remediation:

Wrap this script into:
- An OCI Function, or
- A scheduled OCI DevOps/cron job, or
- An external scheduler (Jenkins, GitHub Actions, etc.)
Trigger it whenever a misconfiguration is detected (e.g., from a security scan event, webhook, or scheduled check).
Optionally first check and only update if minimum_password_length < 14.

Example quick check:

current_min = current_policy.password_policy.minimum_password_length
if current_min is None or current_min < 14:
    # run the update code shown above

This ensures your OCI IAM password policy always requires at least 14 characters.

Using Terraform

resource "oci_identity_authentication_policy" "iam_password_policy" {
  # Replace with your tenancy OCID (password policy is defined at the tenancy level)
  compartment_id = TENANCY_OCID

  password_policy {
    # Enforce minimum password length of 14 characters
    minimum_password_length = 14

    # Keep or adjust any other existing settings as needed, for example:
    # is_numeric_characters_required      = true
    # is_lowercase_characters_required    = true
    # is_uppercase_characters_required    = true
    # is_special_characters_required      = true
    # is_username_containment_allowed     = false
    # is_password_reuse_prevented         = true
    # password_lockout_duration           = 30
    # max_login_attempts                  = 5
  }
}

This updates the tenancy-level IAM password policy without forcing replacement of the resource; it will be an in‑place update.Verification with terraform plan should show an in-place update in-place on oci_identity_authentication_policy.iam_password_policy with minimum_password_length changing from its current value to 14.

OCI Misconfigurations

OCI IAM Password Policy Should Require Minimum 14 Characters

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Get Your Tenancy OCID

3. View Current Authentication Policy

4. Update Password Policy to Require Minimum 14 Characters

Option A – Provide full password policy JSON inline

Option B – Modify only the minimum length (using a file)

5. Verify the Change

1. Prerequisites

2. Find Your Tenancy OCID

3. Python Code: Update Password Policy to Minimum 14 Characters

4. Notes for “Monitoring / Auto-remediation”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prerequisites

​2. Get Your Tenancy OCID

​3. View Current Authentication Policy

​4. Update Password Policy to Require Minimum 14 Characters

​Option A – Provide full password policy JSON inline

​Option B – Modify only the minimum length (using a file)

​5. Verify the Change

​1. Prerequisites

​2. Find Your Tenancy OCID

​3. Python Code: Update Password Policy to Minimum 14 Characters

​4. Notes for “Monitoring / Auto-remediation”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Get Your Tenancy OCID

3. View Current Authentication Policy

4. Update Password Policy to Require Minimum 14 Characters

Option A – Provide full password policy JSON inline

Option B – Modify only the minimum length (using a file)

5. Verify the Change

1. Prerequisites

2. Find Your Tenancy OCID

3. Python Code: Update Password Policy to Minimum 14 Characters

4. Notes for “Monitoring / Auto-remediation”