OCI IAM Password Policy Should Require Lowercase Characters

Using Console

To require lowercase characters in your OCI IAM password policy using the OCI Console:

Sign in to the OCI Console with a user that has tenancy-level IAM admin privileges (e.g., Administrator policy).
In the left navigation menu, go to:
Identity & Security → Identity → Domains (or Identity > Password Policy if using older UI).
If using Domains (default in newer tenancies):
- Click on your primary domain (or the domain where the users reside).
- In the left pane, select Security (or Password Policy, depending on UI version).
- Click Edit (or Edit Password Policy).
Locate the setting for Require lowercase characters.
Set this to Enabled / Yes (or check the checkbox).
Review other password policy settings if needed (length, uppercase, numbers, special chars, etc.).
Click Save changes (or Update).

This will remediate the finding “OCI IAM Password Policy Should Require Lowercase Characters” for IAM in that domain. If you have multiple domains, repeat the steps for each domain where the policy should apply.

Using CLI

To enforce lowercase characters in the OCI IAM password policy using the OCI CLI, do the following:

1. Prerequisites

OCI CLI installed and configured (oci setup config)
You have tenancy-level IAM permissions:
- PASSWORD_POLICY_UPDATE
- PASSWORD_POLICY_READ
Tenancy OCID (root compartment OCID), usually found in the console under:
- Identity & Security → Tenancy Details

2. Get your tenancy OCID (root compartment)

If you don’t already have it:

oci iam compartment list --compartment-id-in-subtree false --all \
  --query "data[?\"compartment-name\"=='<your-tenancy-name>'].id | [0]" \
  --raw-output

Or copy it from the console as ocid1.tenancy.oc1..xxxxx.Let’s call it:

TENANCY_OCID="ocid1.tenancy.oc1..xxxxx"

3. Check the current password policy

oci iam password-policy get --compartment-id "$TENANCY_OCID"

Look at the field:

isLowercaseCharactersRequired (or similar, depending on CLI version)

4. Update the password policy to require lowercase characters

You can update just this field while leaving others unchanged, or set all explicitly.

Option A – Minimal update (only set lowercase requirement)

If your CLI version supports partial updates:

oci iam password-policy update \
  --compartment-id "$TENANCY_OCID" \
  --is-lowercase-characters-required true

Option B – Explicit full policy update (safer/clearer)

First, get existing policy as JSON:

oci iam password-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data' > password-policy.json

Edit password-policy.json and ensure:

{
  "isLowercaseCharactersRequired": true,
  "isUppercaseCharactersRequired": true,
  "isNumericCharactersRequired": true,
  "isSpecialCharactersRequired": true,
  "minimumPasswordLength": 12,
  "isUsernameContainmentAllowed": false,
  "isPasswordExpirationForced": true,
  "passwordExpirationInDays": 90,
  "isUserNamePolicy": false
}

(adjust values to match your org’s policy; keep existing values you don’t want changed)Then apply:

oci iam password-policy update \
  --compartment-id "$TENANCY_OCID" \
  --from-json file://password-policy.json

5. Verify the change

oci iam password-policy get --compartment-id "$TENANCY_OCID" \
  --query 'data."isLowercaseCharactersRequired"' --raw-output

You should see:

true

This will satisfy the “OCI IAM Password Policy Should Require Lowercase Characters” requirement, and any IAM monitoring or compliance tooling querying the tenancy password policy (including via OCI CLI) will now see that lowercase characters are enforced.

Using Python

To enforce lowercase characters in the OCI IAM password policy using Python, you can use the OCI Python SDK to update the tenancy’s authentication policy.Below are the minimal, concrete steps.

1. Prerequisites

Install the OCI Python SDK:
pip install oci

Make sure you have a valid OCI config file (usually at ~/.oci/config) with:

[DEFAULT]
user=ocid1.user.oc1..xxxx
fingerprint=xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..xxxx
region=us-phoenix-1

Note your tenancy OCID (from the config as tenancy= or from the console).

2. Python script to require lowercase characters

This script:

Reads the current authentication policy for the tenancy.
Sets is_lowercase_characters_required = True.
Leaves other fields unchanged if they already exist; otherwise, they stay None.

import oci

# 1. Load config
config = oci.config.from_file("~/.oci/config", "DEFAULT")

# 2. Create Identity client
identity_client = oci.identity.IdentityClient(config)

# 3. Tenancy OCID
tenancy_id = config["tenancy"]

# 4. Get current authentication (password) policy
current_policy_response = identity_client.get_authentication_policy(tenancy_id)
current_policy = current_policy_response.data

# 5. Prepare updated password policy
password_policy = current_policy.password_policy

# If there is no password policy object yet, create one
if password_policy is None:
    password_policy = oci.identity.models.PasswordPolicy()

# Ensure lowercase characters are required
password_policy.is_lowercase_characters_required = True

# 6. Build the update details object
update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
    password_policy=password_policy
)

# 7. Update the authentication policy
update_response = identity_client.update_authentication_policy(
    tenancy_id,
    update_details
)

print("Updated authentication policy:")
print(update_response.data)

3. Notes for “monitoring + remediation” scenarios

Monitoring:

You can regularly run a script that calls get_authentication_policy and checks:

if not password_policy.is_lowercase_characters_required:
    # trigger remediation (call update_authentication_policy as above)

Integration:
- Wire this into your monitoring stack (OCI Events + OCI Functions, or an external scheduler like cron/GitHub Actions/Jenkins) to automatically remediate when a drift is detected.

This fulfills the CIS-style control “Password Policy Should Require Lowercase Characters” for OCI IAM via Python.

Using Terraform

# As of the current OCI Terraform provider, the IAM password policy
# settings (including requiring lowercase characters) are not exposed
# as Terraform-manageable resources or arguments. This cannot be fixed
# in Terraform on resource type oci-identitymanagement-iam-passwordpolicy.

# To remediate, update the password policy in the OCI Console:
# 1. Go to Identity & Security -> (IAM Domain / Tenancy as appropriate) -> Password Policies.
# 2. Edit the password policy.
# 3. Enable "Require at least one lowercase character" (or equivalent option).
# 4. Save the changes.

terraform plan will show no changes related to the IAM password policy, because it is not managed through the provider.

OCI Misconfigurations

OCI IAM Password Policy Should Require Lowercase Characters

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Get your tenancy OCID (root compartment)

3. Check the current password policy

4. Update the password policy to require lowercase characters

Option A – Minimal update (only set lowercase requirement)

Option B – Explicit full policy update (safer/clearer)

5. Verify the change

1. Prerequisites

2. Python script to require lowercase characters

3. Notes for “monitoring + remediation” scenarios

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prerequisites

​2. Get your tenancy OCID (root compartment)

​3. Check the current password policy

​4. Update the password policy to require lowercase characters

​Option A – Minimal update (only set lowercase requirement)

​Option B – Explicit full policy update (safer/clearer)

​5. Verify the change

​1. Prerequisites

​2. Python script to require lowercase characters

​3. Notes for “monitoring + remediation” scenarios

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Get your tenancy OCID (root compartment)

3. Check the current password policy

4. Update the password policy to require lowercase characters

Option A – Minimal update (only set lowercase requirement)

Option B – Explicit full policy update (safer/clearer)

5. Verify the change

1. Prerequisites

2. Python script to require lowercase characters

3. Notes for “monitoring + remediation” scenarios