OCI IAM Password Policy Should Require Special Characters

Using Console

To require special characters in the OCI IAM password policy via the OCI Console:

Sign in
Log in to the OCI Console with a user that has tenancy-level IAM admin permissions.
Go to Identity Domains
- In the left navigation menu, click Identity & Security.
- Click Domains (or Identity Domains, depending on your console view).
Select the domain
- Click your main identity domain (often named Default or similar, where your IAM users reside).
Open the Password Policy
- In the domain details page, go to Security.
- Click Password Policy (or similar “Password” / “Authentication” settings option).
Edit the policy
- Click Edit (or the equivalent action button for modifying the password policy).
- Locate the setting for special characters, often labeled like:
  - Require special characters or
  - Minimum number of special characters
Enable special characters requirement
- Check Require special characters (or set the Minimum number of special characters to at least 1).
- Optionally, review and adjust other password settings if needed (length, numbers, uppercase, etc.).
Save changes
- Click Save or Update to apply the new password policy.
Confirm application
- Verify the updated policy is visible in the Password Policy page.
- New password changes/resets will now require special characters for users in this identity domain.

Using CLI

Below is how to enforce “special characters required” in the OCI IAM password policy using the OCI CLI.

1. Prerequisites

OCI CLI installed and configured (oci setup config)
You have the tenancy OCID and permissions to modify IAM authentication policy.

Tenancy OCID is usually in your config file as tenancy= or visible in the console under: Profile → Tenancy Information.

2. (Optional) View the current password policy

TENANCY_OCID="<your-tenancy-ocid>"

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID"

Look at the passwordPolicy block to see current settings.

3. Update the password policy to require special characters

You must submit the full passwordPolicy object, not just the changed field. Example with strong defaults:

TENANCY_OCID="<your-tenancy-ocid>"

oci iam authentication-policy update \
  --compartment-id "$TENANCY_OCID" \
  --authentication-policy '{
    "passwordPolicy": {
      "isLowercaseCharactersRequired": true,
      "isUppercaseCharactersRequired": true,
      "isNumericCharactersRequired": true,
      "isSpecialCharactersRequired": true,
      "minimumPasswordLength": 14,
      "isUsernameContainmentAllowed": false
    }
  }'

Key field for your finding:

"isSpecialCharactersRequired": true

Adjust other fields (length, numeric, etc.) as needed for your environment.

4. Confirm the change

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query "data.\"authentication-policy\".passwordPolicy" \
  --output table

Verify isSpecialCharactersRequired is true.

Using Python

Below is a minimal, end‑to‑end way to check and remediate the OCI IAM password policy so that special characters are required, using Python and the OCI SDK.

1. Prerequisites

Install the OCI Python SDK:
pip install oci
Ensure you have an OCI config file (usually at ~/.oci/config) with:
- user
- fingerprint
- key_file
- tenancy
- region
And a profile (e.g., DEFAULT).

The user/principal running this must have permission to:

identity-domains UPDATE_AUTHENTICATION_POLICY
identity-domains READ_AUTHENTICATION_POLICY

or equivalent IAM policies, e.g.:

Allow group <your-group> to manage authentication-policies in tenancy

2. Python Script: Monitor & Remediate Special Character Requirement

This script:

Reads the current authentication (password) policy at the tenancy level.
Checks whether is_special_characters_required is True.
If not, updates the policy to set it to True (leaving other settings unchanged).

import oci

def main():
    # Load config
    config = oci.config.from_file("~/.oci/config", "DEFAULT")
    tenancy_id = config["tenancy"]

    identity_client = oci.identity.IdentityClient(config)

    # 1. Get current authentication policy
    auth_policy = identity_client.get_authentication_policy(tenancy_id).data
    current_password_policy = auth_policy.password_policy

    # If there's no password policy yet, create a default one object
    if current_password_policy is None:
        from oci.identity.models import PasswordPolicy
        current_password_policy = PasswordPolicy()

    # 2. Check if special characters are already required
    if getattr(current_password_policy, "is_special_characters_required", None):
        print("Password policy already requires special characters. No change needed.")
        return

    print("Special characters are NOT required. Remediating...")

    # 3. Build a new password policy object, keeping existing values
    from oci.identity.models import AuthenticationPolicy, PasswordPolicy

    new_password_policy = PasswordPolicy(
        # Keep current values if present, otherwise leave as None
        minimum_password_length=current_password_policy.minimum_password_length,
        is_uppercase_characters_required=current_password_policy.is_uppercase_characters_required,
        is_lowercase_characters_required=current_password_policy.is_lowercase_characters_required,
        is_numeric_characters_required=current_password_policy.is_numeric_characters_required,

        # This is the key remediation:
        is_special_characters_required=True,

        is_username_containment_allowed=current_password_policy.is_username_containment_allowed,
        is_password_expires=current_password_policy.is_password_expires,
        password_expires_in_days=current_password_policy.password_expires_in_days,
        is_lockout_enabled=current_password_policy.is_lockout_enabled,
        maximum_failed_login_attempts=current_password_policy.maximum_failed_login_attempts,
    )

    # 4. Build the authentication policy details
    auth_policy_details = AuthenticationPolicy(
        password_policy=new_password_policy
    )

    # 5. Update the authentication policy
    response = identity_client.update_authentication_policy(
        tenancy_id,
        update_authentication_policy_details=auth_policy_details
    )

    print("Updated authentication policy. Special characters are now required.")
    print("New policy:", response.data.password_policy)


if __name__ == "__main__":
    main()

3. Turn This Into “Monitoring + Auto-Remediation”

To use this as a monitoring/remediation job:

Run it on a schedule (e.g., OCI Functions, OCI DevOps Pipeline, or a cron job on a bastion/CI server).
Optionally:
- Log when a remediation is performed.
- Send notifications (via OCI Notifications/Email) when a change was needed.

This ensures your OCI IAM password policy always enforces special characters.

Using Terraform

resource "oci_identity_authentication_policy" "iam_password_policy" {
  # Replace with your root compartment (tenancy) OCID, or the compartment whose policy you manage
  compartment_id = "OCID_OF_TENANCY_OR_COMPARTMENT"

  password_policy {
    # Keep existing requirements as they are; only set this to true to meet the finding
    is_special_characters_required = true

    # Example of other commonly-used settings (leave as-is if you already manage them):
    # is_lowercase_characters_required = true
    # is_uppercase_characters_required = true
    # is_numeric_characters_required  = true
    # minimum_password_length         = 14
    # is_username_containment_allowed = false
    # is_first_name_containment_allowed = false
    # is_last_name_containment_allowed  = false
  }
}

This updates the IAM password policy so that passwords must include at least one special character; it is an in-place update and does not replace the resource.After you add or modify this resource, terraform plan should show an in-place update to oci_identity_authentication_policy.iam_password_policy with is_special_characters_required changing from false (or unset) to true.

OCI Misconfigurations

OCI IAM Password Policy Should Require Special Characters

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. (Optional) View the current password policy

3. Update the password policy to require special characters

4. Confirm the change

1. Prerequisites

2. Python Script: Monitor & Remediate Special Character Requirement

3. Turn This Into “Monitoring + Auto-Remediation”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prerequisites

​2. (Optional) View the current password policy

​3. Update the password policy to require special characters

​4. Confirm the change

​1. Prerequisites

​2. Python Script: Monitor & Remediate Special Character Requirement

​3. Turn This Into “Monitoring + Auto-Remediation”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. (Optional) View the current password policy

3. Update the password policy to require special characters

4. Confirm the change

1. Prerequisites

2. Python Script: Monitor & Remediate Special Character Requirement

3. Turn This Into “Monitoring + Auto-Remediation”