> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI IAM Password Policy Should Require Numeric Characters

### More Info:

The OCI IAM password policy should require at least one numeric character. Including numbers in passwords increases the keyspace and strengthens protection against brute-force attacks

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Startup Security Baseline
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* GDPR
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIST
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Cyber Security Framework
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To require numeric characters in the OCI IAM password policy using the OCI Console:

        1. **Sign in to the OCI Console**\
           Log in with an account that has tenancy-level administrator or security admin privileges.

        2. **Go to Identity Domains**
           * Open the navigation menu (☰).
           * Select **Identity & Security** (or **Identity & Security → Identity** depending on your console layout).
           * Click **Domains**.
           * Click the **identity domain** where your IAM users reside (often named **Default**).

        3. **Open Password Policy Settings**\
           Inside the selected domain:
           * In the left-hand menu, go to **Security**.
           * Click **Password policy** (or **Authentication settings → Password policy** if shown that way).

        4. **Enable Numeric Character Requirement**\
           In the password policy configuration:
           * Locate the option similar to **Require numbers in passwords** or **Must contain at least one number**.
           * Check or toggle this option **ON**.
           * Confirm or adjust related fields if present (for example, minimum password length, uppercase, lowercase, special characters) to match your security standards.

        5. **Save the Policy**
           * Click **Save**, **Update**, or **Apply** (button text may vary slightly).
           * Confirm any prompt indicating that the new policy will apply to all future password changes/resets for users in this domain.

        6. **(Optional) Validate via IAM Monitoring / Security Posture**
           * If you use OCI Cloud Guard or Security Zones for monitoring:
             * Go to **Navigation menu → Identity & Security → Cloud Guard**.
             * Ensure the target (tenancy/compartment) including this identity domain is *monitored*.
             * Check that the **IAM Password Policy** detector family (or equivalent) is enabled so future drift (e.g., disabling numeric requirement) will raise a new problem.

        Once saved, new and changed passwords must include at least one numeric character, resolving the “OCI IAM Password Policy Should Require Numeric Characters” finding.
      </Accordion>

      <Accordion title="Using CLI">
        To require numeric characters in OCI IAM passwords via OCI CLI, update the tenancy’s authentication policy.

        ### 1. Prereqs

        * OCI CLI configured (`oci setup config`)
        * Your **tenancy OCID** (from Console: Profile → Tenancy Information).

        ### 2. Get current password policy

        ```bash theme={null}
        TENANCY_OCID="<your_tenancy_ocid>"

        oci iam authentication-policy get \
          --compartment-id "$TENANCY_OCID" \
          --query 'data."authentication-policy"' \
          --output json > current-auth-policy.json
        ```

        This file will contain something like:

        ```json theme={null}
        {
          "passwordPolicy": {
            "isLowercaseCharactersRequired": true,
            "isUppercaseCharactersRequired": true,
            "isNumericCharactersRequired": false,
            "isSpecialCharactersRequired": false,
            "isUserNameContainmentAllowed": false,
            "minimumPasswordLength": 12,
            "isFirstNameContainmentAllowed": false,
            "isLastNameContainmentAllowed": false
          }
        }
        ```

        ### 3. Edit the policy to require numeric characters

        Open `current-auth-policy.json` and set:

        ```json theme={null}
        "isNumericCharactersRequired": true
        ```

        Ensure you keep all other existing fields as they are; OCI expects the full object.

        The final file should look like:

        ```json theme={null}
        {
          "passwordPolicy": {
            "isLowercaseCharactersRequired": true,
            "isUppercaseCharactersRequired": true,
            "isNumericCharactersRequired": true,
            "isSpecialCharactersRequired": false,
            "isUserNameContainmentAllowed": false,
            "minimumPasswordLength": 12,
            "isFirstNameContainmentAllowed": false,
            "isLastNameContainmentAllowed": false
          }
        }
        ```

        Save as `updated-auth-policy.json`.

        ### 4. Apply the updated authentication policy

        ```bash theme={null}
        oci iam authentication-policy update \
          --compartment-id "$TENANCY_OCID" \
          --authentication-policy file://updated-auth-policy.json
        ```

        ### 5. Verify

        ```bash theme={null}
        oci iam authentication-policy get \
          --compartment-id "$TENANCY_OCID" \
          --query 'data."authentication-policy".passwordPolicy.isNumericCharactersRequired'
        ```

        Should return `true`.

        This change will cause new/changed passwords in that tenancy to require at least one numeric character, which will clear the related IAM monitoring / compliance finding.
      </Accordion>

      <Accordion title="Using Python">
        To require numeric characters in the OCI IAM password policy using Python, you need to update the tenancy’s **Authentication Policy** via the OCI Python SDK.

        Below are the minimal, step‑by‑step instructions.

        ***

        ### 1. Prerequisites

        1. Install OCI Python SDK:

        ```bash theme={null}
        pip install oci
        ```

        2. Ensure you have an OCI config file (usually `~/.oci/config`) with:

        * Tenancy OCID
        * User OCID
        * API key + fingerprint
        * Region
        * A profile name (e.g., `DEFAULT`)

        ***

        ### 2. Get Your Tenancy OCID

        You can find it in:

        * OCI Console → Governance & Administration → Tenancy details\
          or in your `~/.oci/config` as `tenancy=`.

        You must pass this tenancy OCID to the script.

        ***

        ### 3. Python Script to Enable Numeric Characters in Password Policy

        This script:

        * Fetches the current authentication policy
        * Sets `is_numeric_characters_required = True`
        * Preserves all other existing password-policy settings

        ```python theme={null}
        import oci

        # Change if you use a non-default profile
        OCI_PROFILE = "DEFAULT"

        # Replace with your tenancy OCID
        TENANCY_OCID = "<your-tenancy-ocid>"

        def main():
            # Create config & client
            config = oci.config.from_file("~/.oci/config", OCI_PROFILE)
            identity_client = oci.identity.IdentityClient(config)

            # 1. Get current authentication policy
            current_policy = identity_client.get_authentication_policy(TENANCY_OCID).data

            # 2. Build updated password policy, preserving current values
            current_pw = current_policy.password_policy

            updated_password_policy = oci.identity.models.UpdatePasswordPolicyDetails(
                minimum_password_length=current_pw.minimum_password_length,
                is_uppercase_characters_required=current_pw.is_uppercase_characters_required,
                is_lowercase_characters_required=current_pw.is_lowercase_characters_required,
                is_numeric_characters_required=True,  # <-- ENFORCE NUMERIC CHARACTERS
                is_special_characters_required=current_pw.is_special_characters_required,
                is_username_containment_allowed=current_pw.is_username_containment_allowed,
                is_password_expiration_enabled=current_pw.is_password_expiration_enabled,
                password_expiration_in_days=current_pw.password_expiration_in_days,
                is_password_expiration_warning_enabled=current_pw.is_password_expiration_warning_enabled,
                password_expiration_warning_in_days=current_pw.password_expiration_warning_in_days,
                is_lockout_enabled=current_pw.is_lockout_enabled,
                lockout_duration_in_seconds=current_pw.lockout_duration_in_seconds,
                max_login_attempts=current_pw.max_login_attempts,
            )

            # 3. Build full authentication policy update
            update_auth_policy_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
                password_policy=updated_password_policy
            )

            # 4. Update the tenancy authentication policy
            response = identity_client.update_authentication_policy(
                TENANCY_OCID,
                update_auth_policy_details
            )

            print("Updated authentication policy:")
            print(response.data)

        if __name__ == "__main__":
            main()
        ```

        ***

        ### 4. Verification

        1. In the OCI Console, go to:
           * Identity & Security → Domains (or Identity → Authentication Policy, depending on tenancy type)
           * Check the password policy for the tenancy.
        2. Confirm **“Require numbers” / numeric characters** is enabled.

        ***

        ### 5. Integrating with Monitoring / Compliance

        If you’re using a monitoring/compliance tool (e.g., custom script, Cloud Guard target):

        * Run this Python code as a remediation step when a rule detects that `is_numeric_characters_required` is False.
        * Optional: add a pre-check snippet that only calls `update_authentication_policy` if the flag is currently False (to keep it idempotent).
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_identity_password_policy" "iam_password_policy" {
          # Replace with your tenancy OCID (root compartment)
          compartment_id = "OCID_OF_TENANCY"

          # Existing / required settings (examples – keep your current values)
          minimum_password_length          = 12
          is_lowercase_characters_required = true
          is_uppercase_characters_required = true
          is_special_characters_required   = true

          # Fix: require at least one numeric character in passwords
          is_numeric_characters_required = true

          # Other optional settings – include as needed, matching your current policy
          # is_username_containment_allowed = false
          # is_reuse_prevention             = 5
        }
        ```

        This change does not force replacement of the resource; it updates the existing tenancy password policy in place.

        To verify, `terraform plan` should show an in‑place update (`~`) of `oci_identity_password_policy.iam_password_policy` with `is_numeric_characters_required` changing from `false` (or unset) to `true`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>