> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI IAM Password Policy Should Require Minimum 14 Characters

### More Info:

The OCI IAM password policy should enforce a minimum password length of 14 characters. Short passwords are vulnerable to brute-force attacks and dictionary-based cracking

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Here’s how to set the IAM password policy to require a minimum of 14 characters in OCI using the Console:

        1. **Sign in to OCI Console**\
           Log in to the Oracle Cloud Console with an account that has tenancy-level IAM admin privileges (e.g., `Administrator` group).

        2. **Go to Identity & Security**
           * Open the **Navigation menu** (≡) in the top left.
           * Under **Identity & Security**, click **Domains** (or **Identity > Domains** depending on your Console layout).

        3. **Select the Target Domain**
           * You’ll see a list of identity domains (or the default one if you’re using the older model).
           * Click the **identity domain** where your users are managed (often `Default`).

        4. **Open Security Settings**
           * In the domain page, in the left-hand menu, click **Security**.
           * Under Security, click **Password Policies** (or **Password policy**).

        5. **Edit the Password Policy**
           * On the Password Policy page, click **Edit** (or the pencil icon).

        6. **Set Minimum Password Length to 14**
           * Find the field **Minimum password length** (or similar).
           * Change the value to **14**.
           * Review other password policy settings (complexity, reuse, lockout) as needed, but not required for this specific control.

        7. **Save the Policy**
           * Click **Save** or **Save changes**.
           * The new minimum length applies to all new password changes and resets in that identity domain.

        8. **(Optional) Re-check in Monitoring/Cloud Guard**
           * If you’re using **Cloud Guard** or another OCI monitoring tool/policy that flagged this misconfiguration, wait a few minutes and re-run the check or assessment to confirm the issue is resolved.

        If your tenancy still uses the older **“Identity > Security > Password Policy”** layout at tenancy level, the steps are the same conceptually:\
        Navigation menu → **Identity & Security** → **Security** → **Password Policy** → **Edit** → Set minimum length to 14 → Save.
      </Accordion>

      <Accordion title="Using CLI">
        To enforce a **minimum 14-character password policy** in OCI IAM using the **OCI CLI**, do the following:

        ### 1. Prerequisites

        * OCI CLI installed and configured (`oci setup config`)
        * You have permission to manage the tenancy’s authentication policy (e.g., `identity-domains-authentication-policies` or tenancy admin).

        ### 2. Get Your Tenancy OCID

        If you don’t already have it:

        ```bash theme={null}
        oci iam tenancy get --tenancy-id <your-tenancy-ocid>
        ```

        (or copy it from the Console: Profile → Tenancy: `<name>` → OCID)

        ### 3. View Current Authentication Policy

        ```bash theme={null}
        oci iam authentication-policy get \
          --compartment-id <your-tenancy-ocid>
        ```

        Look at the output under `passwordPolicy`. You’ll see fields like `minimumPasswordLength`, `isLowercaseCharactersRequired`, etc.

        ### 4. Update Password Policy to Require Minimum 14 Characters

        You can either:

        #### Option A – Provide full password policy JSON inline

        If you want to explicitly define the full policy (recommended when you know the desired settings):

        ```bash theme={null}
        oci iam authentication-policy update \
          --compartment-id <your-tenancy-ocid> \
          --password-policy '{
            "isLowercaseCharactersRequired": true,
            "isUppercaseCharactersRequired": true,
            "isNumericCharactersRequired": true,
            "isSpecialCharactersRequired": true,
            "minimumPasswordLength": 14,
            "isUsernameContainmentAllowed": false
          }'
        ```

        Adjust booleans as needed, but keep `"minimumPasswordLength": 14`.

        #### Option B – Modify only the minimum length (using a file)

        1. Save the existing policy from step 3 into a file (for example, `auth-policy.json`) and edit it:
           * Under `"passwordPolicy"`, set:
             ```json theme={null}
             "minimumPasswordLength": 14
             ```
        2. Apply the updated policy:
           ```bash theme={null}
           oci iam authentication-policy update \
             --compartment-id <your-tenancy-ocid> \
             --from-json file://auth-policy.json
           ```

        ### 5. Verify the Change

        Run:

        ```bash theme={null}
        oci iam authentication-policy get \
          --compartment-id <your-tenancy-ocid> \
          --query "authenticationPolicy.passwordPolicy.minimumPasswordLength" \
          --raw-output
        ```

        This should return:

        ```text theme={null}
        14
        ```

        That enforces a minimum 14-character password policy in OCI IAM via OCI CLI.
      </Accordion>

      <Accordion title="Using Python">
        To enforce a **minimum 14-character password policy** in OCI IAM using **Python**, you need to update the tenancy’s **Authentication Policy** via the OCI Python SDK.

        ### 1. Prerequisites

        1. Install OCI Python SDK (if not already):
           ```bash theme={null}
           pip install oci
           ```

        2. Configure OCI CLI/SDK config (tenancy OCID, user OCID, key, region, etc.), usually at:
           `~/.oci/config` with a profile, e.g. `[DEFAULT]`.

        3. Your user must have IAM permissions similar to:
           ```text theme={null}
           ALLOW GROUP <Your-Admin-Group> TO MANAGE authentication-policies IN TENANCY
           ```

        ***

        ### 2. Find Your Tenancy OCID

        You can get it from the OCI Console:

        * Profile (top-right) → Tenancy: click it → copy **OCID**.

        Or from your config file:

        ```ini theme={null}
        [DEFAULT]
        tenancy=ocid1.tenancy.oc1......
        ```

        ***

        ### 3. Python Code: Update Password Policy to Minimum 14 Characters

        ```python theme={null}
        import oci

        # 1. Load config and create Identity client
        config = oci.config.from_file("~/.oci/config", "DEFAULT")  # adjust path/profile as needed
        identity_client = oci.identity.IdentityClient(config)

        tenancy_id = config["tenancy"]

        # 2. Get existing authentication policy (optional but recommended)
        current_policy = identity_client.get_authentication_policy(tenancy_id).data

        # 3. Prepare updated password policy
        password_policy = current_policy.password_policy or oci.identity.models.PasswordPolicy()

        # Set minimum length to 14
        password_policy.minimum_password_length = 14

        # (Optional) Leave other existing fields intact, e.g.:
        # password_policy.is_numeric_characters_required = current_policy.password_policy.is_numeric_characters_required
        # password_policy.is_uppercase_characters_required = current_policy.password_policy.is_uppercase_characters_required
        # etc.

        # 4. Build update payload
        update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
            password_policy=password_policy
        )

        # 5. Call update_authentication_policy
        response = identity_client.update_authentication_policy(
            tenancy_id=tenancy_id,
            update_authentication_policy_details=update_details
        )

        print("Updated password minimum length to:",
              response.data.password_policy.minimum_password_length)
        ```

        ***

        ### 4. Notes for “Monitoring / Auto-remediation”

        If this is driven by a monitoring system (e.g., a Cloud Security Posture tool) and you want **auto-remediation**:

        * Wrap this script into:
          * An OCI **Function**, or
          * A scheduled **OCI DevOps/cron job**, or
          * An external scheduler (Jenkins, GitHub Actions, etc.)
        * Trigger it whenever a misconfiguration is detected (e.g., from a security scan event, webhook, or scheduled check).
        * Optionally first **check** and only update if `minimum_password_length < 14`.

        Example quick check:

        ```python theme={null}
        current_min = current_policy.password_policy.minimum_password_length
        if current_min is None or current_min < 14:
            # run the update code shown above
        ```

        This ensures your OCI IAM password policy always requires at least **14 characters**.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_identity_authentication_policy" "iam_password_policy" {
          # Replace with your tenancy OCID (password policy is defined at the tenancy level)
          compartment_id = TENANCY_OCID

          password_policy {
            # Enforce minimum password length of 14 characters
            minimum_password_length = 14

            # Keep or adjust any other existing settings as needed, for example:
            # is_numeric_characters_required      = true
            # is_lowercase_characters_required    = true
            # is_uppercase_characters_required    = true
            # is_special_characters_required      = true
            # is_username_containment_allowed     = false
            # is_password_reuse_prevented         = true
            # password_lockout_duration           = 30
            # max_login_attempts                  = 5
          }
        }
        ```

        This updates the tenancy-level IAM password policy without forcing replacement of the resource; it will be an in‑place update.

        Verification with `terraform plan` should show an in-place `update in-place` on `oci_identity_authentication_policy.iam_password_policy` with `minimum_password_length` changing from its current value to `14`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>