> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI IAM Password Policy Should Require Lowercase Characters

### More Info:

The OCI IAM password policy should require at least one lowercase character. Passwords without character diversity are significantly easier to crack

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To require lowercase characters in your OCI IAM password policy using the OCI Console:

        1. **Sign in** to the OCI Console with a user that has tenancy-level IAM admin privileges (e.g., `Administrator` policy).
        2. In the left navigation menu, go to:\
           **Identity & Security** → **Identity** → **Domains** (or **Identity > Password Policy** if using older UI).
        3. If using **Domains** (default in newer tenancies):
           * Click on your **primary domain** (or the domain where the users reside).
           * In the left pane, select **Security** (or **Password Policy**, depending on UI version).
           * Click **Edit** (or **Edit Password Policy**).
        4. Locate the setting for **Require lowercase characters**.
        5. Set this to **Enabled / Yes** (or check the checkbox).
        6. Review other password policy settings if needed (length, uppercase, numbers, special chars, etc.).
        7. Click **Save changes** (or **Update**).

        This will remediate the finding “OCI IAM Password Policy Should Require Lowercase Characters” for IAM in that domain. If you have multiple domains, repeat the steps for each domain where the policy should apply.
      </Accordion>

      <Accordion title="Using CLI">
        To enforce lowercase characters in the OCI IAM password policy using the OCI CLI, do the following:

        ***

        ### 1. Prerequisites

        * OCI CLI installed and configured (`oci setup config`)
        * You have tenancy-level IAM permissions:
          * `PASSWORD_POLICY_UPDATE`
          * `PASSWORD_POLICY_READ`
        * Tenancy OCID (root compartment OCID), usually found in the console under:
          * **Identity & Security → Tenancy Details**

        ***

        ### 2. Get your tenancy OCID (root compartment)

        If you don’t already have it:

        ```bash theme={null}
        oci iam compartment list --compartment-id-in-subtree false --all \
          --query "data[?\"compartment-name\"=='<your-tenancy-name>'].id | [0]" \
          --raw-output
        ```

        Or copy it from the console as `ocid1.tenancy.oc1..xxxxx`.

        Let’s call it:

        ```bash theme={null}
        TENANCY_OCID="ocid1.tenancy.oc1..xxxxx"
        ```

        ***

        ### 3. Check the current password policy

        ```bash theme={null}
        oci iam password-policy get --compartment-id "$TENANCY_OCID"
        ```

        Look at the field:

        * `isLowercaseCharactersRequired` (or similar, depending on CLI version)

        ***

        ### 4. Update the password policy to require lowercase characters

        You can update just this field while leaving others unchanged, or set all explicitly.

        #### Option A – Minimal update (only set lowercase requirement)

        If your CLI version supports partial updates:

        ```bash theme={null}
        oci iam password-policy update \
          --compartment-id "$TENANCY_OCID" \
          --is-lowercase-characters-required true
        ```

        #### Option B – Explicit full policy update (safer/clearer)

        First, get existing policy as JSON:

        ```bash theme={null}
        oci iam password-policy get \
          --compartment-id "$TENANCY_OCID" \
          --query 'data' > password-policy.json
        ```

        Edit `password-policy.json` and ensure:

        ```json theme={null}
        {
          "isLowercaseCharactersRequired": true,
          "isUppercaseCharactersRequired": true,
          "isNumericCharactersRequired": true,
          "isSpecialCharactersRequired": true,
          "minimumPasswordLength": 12,
          "isUsernameContainmentAllowed": false,
          "isPasswordExpirationForced": true,
          "passwordExpirationInDays": 90,
          "isUserNamePolicy": false
        }
        ```

        (adjust values to match your org’s policy; keep existing values you don’t want changed)

        Then apply:

        ```bash theme={null}
        oci iam password-policy update \
          --compartment-id "$TENANCY_OCID" \
          --from-json file://password-policy.json
        ```

        ***

        ### 5. Verify the change

        ```bash theme={null}
        oci iam password-policy get --compartment-id "$TENANCY_OCID" \
          --query 'data."isLowercaseCharactersRequired"' --raw-output
        ```

        You should see:

        ```text theme={null}
        true
        ```

        ***

        This will satisfy the “OCI IAM Password Policy Should Require Lowercase Characters” requirement, and any IAM monitoring or compliance tooling querying the tenancy password policy (including via OCI CLI) will now see that lowercase characters are enforced.
      </Accordion>

      <Accordion title="Using Python">
        To enforce lowercase characters in the OCI IAM password policy using Python, you can use the OCI Python SDK to update the tenancy’s authentication policy.

        Below are the minimal, concrete steps.

        ***

        ## 1. Prerequisites

        1. Install the OCI Python SDK:
           ```bash theme={null}
           pip install oci
           ```

        2. Make sure you have a valid OCI config file (usually at `~/.oci/config`) with:
           ```ini theme={null}
           [DEFAULT]
           user=ocid1.user.oc1..xxxx
           fingerprint=xx:xx:xx:xx
           key_file=/path/to/oci_api_key.pem
           tenancy=ocid1.tenancy.oc1..xxxx
           region=us-phoenix-1
           ```

        3. Note your **tenancy OCID** (from the config as `tenancy=` or from the console).

        ***

        ## 2. Python script to require lowercase characters

        This script:

        * Reads the current authentication policy for the tenancy.
        * Sets `is_lowercase_characters_required = True`.
        * Leaves other fields unchanged if they already exist; otherwise, they stay `None`.

        ```python theme={null}
        import oci

        # 1. Load config
        config = oci.config.from_file("~/.oci/config", "DEFAULT")

        # 2. Create Identity client
        identity_client = oci.identity.IdentityClient(config)

        # 3. Tenancy OCID
        tenancy_id = config["tenancy"]

        # 4. Get current authentication (password) policy
        current_policy_response = identity_client.get_authentication_policy(tenancy_id)
        current_policy = current_policy_response.data

        # 5. Prepare updated password policy
        password_policy = current_policy.password_policy

        # If there is no password policy object yet, create one
        if password_policy is None:
            password_policy = oci.identity.models.PasswordPolicy()

        # Ensure lowercase characters are required
        password_policy.is_lowercase_characters_required = True

        # 6. Build the update details object
        update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
            password_policy=password_policy
        )

        # 7. Update the authentication policy
        update_response = identity_client.update_authentication_policy(
            tenancy_id,
            update_details
        )

        print("Updated authentication policy:")
        print(update_response.data)
        ```

        ***

        ## 3. Notes for “monitoring + remediation” scenarios

        * **Monitoring**:
          * You can regularly run a script that calls `get_authentication_policy` and checks:
            ```python theme={null}
            if not password_policy.is_lowercase_characters_required:
                # trigger remediation (call update_authentication_policy as above)
            ```
        * **Integration**:
          * Wire this into your monitoring stack (OCI Events + OCI Functions, or an external scheduler like cron/GitHub Actions/Jenkins) to automatically remediate when a drift is detected.

        This fulfills the CIS-style control “Password Policy Should Require Lowercase Characters” for OCI IAM via Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # As of the current OCI Terraform provider, the IAM password policy
        # settings (including requiring lowercase characters) are not exposed
        # as Terraform-manageable resources or arguments. This cannot be fixed
        # in Terraform on resource type oci-identitymanagement-iam-passwordpolicy.

        # To remediate, update the password policy in the OCI Console:
        # 1. Go to Identity & Security -> (IAM Domain / Tenancy as appropriate) -> Password Policies.
        # 2. Edit the password policy.
        # 3. Enable "Require at least one lowercase character" (or equivalent option).
        # 4. Save the changes.
        ```

        `terraform plan` will show no changes related to the IAM password policy, because it is not managed through the provider.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>