OCI IAM Password Policy Should Require Numeric Characters

Using Console

To require numeric characters in the OCI IAM password policy using the OCI Console:

Sign in to the OCI Console
Log in with an account that has tenancy-level administrator or security admin privileges.
Go to Identity Domains
- Open the navigation menu (☰).
- Select Identity & Security (or Identity & Security → Identity depending on your console layout).
- Click Domains.
- Click the identity domain where your IAM users reside (often named Default).
Open Password Policy Settings
Inside the selected domain:
- In the left-hand menu, go to Security.
- Click Password policy (or Authentication settings → Password policy if shown that way).
Enable Numeric Character Requirement
In the password policy configuration:
- Locate the option similar to Require numbers in passwords or Must contain at least one number.
- Check or toggle this option ON.
- Confirm or adjust related fields if present (for example, minimum password length, uppercase, lowercase, special characters) to match your security standards.
Save the Policy
- Click Save, Update, or Apply (button text may vary slightly).
- Confirm any prompt indicating that the new policy will apply to all future password changes/resets for users in this domain.
(Optional) Validate via IAM Monitoring / Security Posture
- If you use OCI Cloud Guard or Security Zones for monitoring:
  - Go to Navigation menu → Identity & Security → Cloud Guard.
  - Ensure the target (tenancy/compartment) including this identity domain is monitored.
  - Check that the IAM Password Policy detector family (or equivalent) is enabled so future drift (e.g., disabling numeric requirement) will raise a new problem.

Once saved, new and changed passwords must include at least one numeric character, resolving the “OCI IAM Password Policy Should Require Numeric Characters” finding.

Using CLI

To require numeric characters in OCI IAM passwords via OCI CLI, update the tenancy’s authentication policy.

1. Prereqs

OCI CLI configured (oci setup config)
Your tenancy OCID (from Console: Profile → Tenancy Information).

2. Get current password policy

TENANCY_OCID="<your_tenancy_ocid>"

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data."authentication-policy"' \
  --output json > current-auth-policy.json

This file will contain something like:

{
  "passwordPolicy": {
    "isLowercaseCharactersRequired": true,
    "isUppercaseCharactersRequired": true,
    "isNumericCharactersRequired": false,
    "isSpecialCharactersRequired": false,
    "isUserNameContainmentAllowed": false,
    "minimumPasswordLength": 12,
    "isFirstNameContainmentAllowed": false,
    "isLastNameContainmentAllowed": false
  }
}

3. Edit the policy to require numeric characters

Open current-auth-policy.json and set:

"isNumericCharactersRequired": true

Ensure you keep all other existing fields as they are; OCI expects the full object.The final file should look like:

{
  "passwordPolicy": {
    "isLowercaseCharactersRequired": true,
    "isUppercaseCharactersRequired": true,
    "isNumericCharactersRequired": true,
    "isSpecialCharactersRequired": false,
    "isUserNameContainmentAllowed": false,
    "minimumPasswordLength": 12,
    "isFirstNameContainmentAllowed": false,
    "isLastNameContainmentAllowed": false
  }
}

Save as updated-auth-policy.json.

4. Apply the updated authentication policy

oci iam authentication-policy update \
  --compartment-id "$TENANCY_OCID" \
  --authentication-policy file://updated-auth-policy.json

5. Verify

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data."authentication-policy".passwordPolicy.isNumericCharactersRequired'

Should return true.This change will cause new/changed passwords in that tenancy to require at least one numeric character, which will clear the related IAM monitoring / compliance finding.

Using Python

To require numeric characters in the OCI IAM password policy using Python, you need to update the tenancy’s Authentication Policy via the OCI Python SDK.Below are the minimal, step‑by‑step instructions.

1. Prerequisites

Install OCI Python SDK:

pip install oci

Ensure you have an OCI config file (usually ~/.oci/config) with:

Tenancy OCID
User OCID
API key + fingerprint
Region
A profile name (e.g., DEFAULT)

2. Get Your Tenancy OCID

You can find it in:

OCI Console → Governance & Administration → Tenancy details
or in your ~/.oci/config as tenancy=.

You must pass this tenancy OCID to the script.

3. Python Script to Enable Numeric Characters in Password Policy

This script:

Fetches the current authentication policy
Sets is_numeric_characters_required = True
Preserves all other existing password-policy settings

import oci

# Change if you use a non-default profile
OCI_PROFILE = "DEFAULT"

# Replace with your tenancy OCID
TENANCY_OCID = "<your-tenancy-ocid>"

def main():
    # Create config & client
    config = oci.config.from_file("~/.oci/config", OCI_PROFILE)
    identity_client = oci.identity.IdentityClient(config)

    # 1. Get current authentication policy
    current_policy = identity_client.get_authentication_policy(TENANCY_OCID).data

    # 2. Build updated password policy, preserving current values
    current_pw = current_policy.password_policy

    updated_password_policy = oci.identity.models.UpdatePasswordPolicyDetails(
        minimum_password_length=current_pw.minimum_password_length,
        is_uppercase_characters_required=current_pw.is_uppercase_characters_required,
        is_lowercase_characters_required=current_pw.is_lowercase_characters_required,
        is_numeric_characters_required=True,  # <-- ENFORCE NUMERIC CHARACTERS
        is_special_characters_required=current_pw.is_special_characters_required,
        is_username_containment_allowed=current_pw.is_username_containment_allowed,
        is_password_expiration_enabled=current_pw.is_password_expiration_enabled,
        password_expiration_in_days=current_pw.password_expiration_in_days,
        is_password_expiration_warning_enabled=current_pw.is_password_expiration_warning_enabled,
        password_expiration_warning_in_days=current_pw.password_expiration_warning_in_days,
        is_lockout_enabled=current_pw.is_lockout_enabled,
        lockout_duration_in_seconds=current_pw.lockout_duration_in_seconds,
        max_login_attempts=current_pw.max_login_attempts,
    )

    # 3. Build full authentication policy update
    update_auth_policy_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
        password_policy=updated_password_policy
    )

    # 4. Update the tenancy authentication policy
    response = identity_client.update_authentication_policy(
        TENANCY_OCID,
        update_auth_policy_details
    )

    print("Updated authentication policy:")
    print(response.data)

if __name__ == "__main__":
    main()

4. Verification

In the OCI Console, go to:
- Identity & Security → Domains (or Identity → Authentication Policy, depending on tenancy type)
- Check the password policy for the tenancy.
Confirm “Require numbers” / numeric characters is enabled.

5. Integrating with Monitoring / Compliance

If you’re using a monitoring/compliance tool (e.g., custom script, Cloud Guard target):

Run this Python code as a remediation step when a rule detects that is_numeric_characters_required is False.
Optional: add a pre-check snippet that only calls update_authentication_policy if the flag is currently False (to keep it idempotent).

Using Terraform

resource "oci_identity_password_policy" "iam_password_policy" {
  # Replace with your tenancy OCID (root compartment)
  compartment_id = "OCID_OF_TENANCY"

  # Existing / required settings (examples – keep your current values)
  minimum_password_length          = 12
  is_lowercase_characters_required = true
  is_uppercase_characters_required = true
  is_special_characters_required   = true

  # Fix: require at least one numeric character in passwords
  is_numeric_characters_required = true

  # Other optional settings – include as needed, matching your current policy
  # is_username_containment_allowed = false
  # is_reuse_prevention             = 5
}

This change does not force replacement of the resource; it updates the existing tenancy password policy in place.To verify, terraform plan should show an in‑place update (~) of oci_identity_password_policy.iam_password_policy with is_numeric_characters_required changing from false (or unset) to true.

OCI Misconfigurations

OCI IAM Password Policy Should Require Numeric Characters

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prereqs

2. Get current password policy

3. Edit the policy to require numeric characters

4. Apply the updated authentication policy

5. Verify

1. Prerequisites

2. Get Your Tenancy OCID

3. Python Script to Enable Numeric Characters in Password Policy

4. Verification

5. Integrating with Monitoring / Compliance

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prereqs

​2. Get current password policy

​3. Edit the policy to require numeric characters

​4. Apply the updated authentication policy

​5. Verify

​1. Prerequisites

​2. Get Your Tenancy OCID

​3. Python Script to Enable Numeric Characters in Password Policy

​4. Verification

​5. Integrating with Monitoring / Compliance

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prereqs

2. Get current password policy

3. Edit the policy to require numeric characters

4. Apply the updated authentication policy

5. Verify

1. Prerequisites

2. Get Your Tenancy OCID

3. Python Script to Enable Numeric Characters in Password Policy

4. Verification

5. Integrating with Monitoring / Compliance