> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI IAM Password Policy Should Require Special Characters ### More Info: The OCI IAM password policy should require at least one special character (symbol). Special characters dramatically increase password complexity and resistance to automated cracking ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * GDPR * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To require special characters in the OCI IAM password policy via the OCI Console: 1. **Sign in**\ Log in to the OCI Console with a user that has tenancy-level IAM admin permissions. 2. **Go to Identity Domains** * In the left navigation menu, click **Identity & Security**. * Click **Domains** (or **Identity Domains**, depending on your console view). 3. **Select the domain** * Click your main identity domain (often named **Default** or similar, where your IAM users reside). 4. **Open the Password Policy** * In the domain details page, go to **Security**. * Click **Password Policy** (or similar “Password” / “Authentication” settings option). 5. **Edit the policy** * Click **Edit** (or the equivalent action button for modifying the password policy). * Locate the setting for special characters, often labeled like: * **Require special characters** or * **Minimum number of special characters** 6. **Enable special characters requirement** * Check **Require special characters** (or set the **Minimum number of special characters** to at least **1**). * Optionally, review and adjust other password settings if needed (length, numbers, uppercase, etc.). 7. **Save changes** * Click **Save** or **Update** to apply the new password policy. 8. **Confirm application** * Verify the updated policy is visible in the Password Policy page. * New password changes/resets will now require special characters for users in this identity domain. Below is how to enforce “special characters required” in the OCI IAM password policy using the OCI CLI. ### 1. Prerequisites * OCI CLI installed and configured (`oci setup config`) * You have the **tenancy OCID** and permissions to modify IAM authentication policy. Tenancy OCID is usually in your config file as `tenancy=` or visible in the console under: Profile → Tenancy Information. *** ### 2. (Optional) View the current password policy ```bash theme={null} TENANCY_OCID="" oci iam authentication-policy get \ --compartment-id "$TENANCY_OCID" ``` Look at the `passwordPolicy` block to see current settings. *** ### 3. Update the password policy to require special characters You must submit the full `passwordPolicy` object, not just the changed field. Example with strong defaults: ```bash theme={null} TENANCY_OCID="" oci iam authentication-policy update \ --compartment-id "$TENANCY_OCID" \ --authentication-policy '{ "passwordPolicy": { "isLowercaseCharactersRequired": true, "isUppercaseCharactersRequired": true, "isNumericCharactersRequired": true, "isSpecialCharactersRequired": true, "minimumPasswordLength": 14, "isUsernameContainmentAllowed": false } }' ``` Key field for your finding: * `"isSpecialCharactersRequired": true` Adjust other fields (length, numeric, etc.) as needed for your environment. *** ### 4. Confirm the change ```bash theme={null} oci iam authentication-policy get \ --compartment-id "$TENANCY_OCID" \ --query "data.\"authentication-policy\".passwordPolicy" \ --output table ``` Verify `isSpecialCharactersRequired` is `true`. Below is a minimal, end‑to‑end way to **check and remediate** the OCI IAM password policy so that **special characters are required**, using Python and the OCI SDK. *** ## 1. Prerequisites 1. Install the OCI Python SDK: ```bash theme={null} pip install oci ``` 2. Ensure you have an OCI config file (usually at `~/.oci/config`) with: * user * fingerprint * key\_file * tenancy * region And a profile (e.g., `DEFAULT`). 3. The user/principal running this must have permission to: ```text theme={null} identity-domains UPDATE_AUTHENTICATION_POLICY identity-domains READ_AUTHENTICATION_POLICY ``` or equivalent IAM policies, e.g.: ```text theme={null} Allow group to manage authentication-policies in tenancy ``` *** ## 2. Python Script: Monitor & Remediate Special Character Requirement This script: 1. Reads the current authentication (password) policy at the tenancy level. 2. Checks whether `is_special_characters_required` is `True`. 3. If not, updates the policy to set it to `True` (leaving other settings unchanged). ```python theme={null} import oci def main(): # Load config config = oci.config.from_file("~/.oci/config", "DEFAULT") tenancy_id = config["tenancy"] identity_client = oci.identity.IdentityClient(config) # 1. Get current authentication policy auth_policy = identity_client.get_authentication_policy(tenancy_id).data current_password_policy = auth_policy.password_policy # If there's no password policy yet, create a default one object if current_password_policy is None: from oci.identity.models import PasswordPolicy current_password_policy = PasswordPolicy() # 2. Check if special characters are already required if getattr(current_password_policy, "is_special_characters_required", None): print("Password policy already requires special characters. No change needed.") return print("Special characters are NOT required. Remediating...") # 3. Build a new password policy object, keeping existing values from oci.identity.models import AuthenticationPolicy, PasswordPolicy new_password_policy = PasswordPolicy( # Keep current values if present, otherwise leave as None minimum_password_length=current_password_policy.minimum_password_length, is_uppercase_characters_required=current_password_policy.is_uppercase_characters_required, is_lowercase_characters_required=current_password_policy.is_lowercase_characters_required, is_numeric_characters_required=current_password_policy.is_numeric_characters_required, # This is the key remediation: is_special_characters_required=True, is_username_containment_allowed=current_password_policy.is_username_containment_allowed, is_password_expires=current_password_policy.is_password_expires, password_expires_in_days=current_password_policy.password_expires_in_days, is_lockout_enabled=current_password_policy.is_lockout_enabled, maximum_failed_login_attempts=current_password_policy.maximum_failed_login_attempts, ) # 4. Build the authentication policy details auth_policy_details = AuthenticationPolicy( password_policy=new_password_policy ) # 5. Update the authentication policy response = identity_client.update_authentication_policy( tenancy_id, update_authentication_policy_details=auth_policy_details ) print("Updated authentication policy. Special characters are now required.") print("New policy:", response.data.password_policy) if __name__ == "__main__": main() ``` *** ## 3. Turn This Into “Monitoring + Auto-Remediation” To use this as a monitoring/remediation job: * Run it on a schedule (e.g., OCI Functions, OCI DevOps Pipeline, or a cron job on a bastion/CI server). * Optionally: * Log when a remediation is performed. * Send notifications (via OCI Notifications/Email) when a change was needed. This ensures your OCI IAM password policy always enforces special characters. ```hcl theme={null} resource "oci_identity_authentication_policy" "iam_password_policy" { # Replace with your root compartment (tenancy) OCID, or the compartment whose policy you manage compartment_id = "OCID_OF_TENANCY_OR_COMPARTMENT" password_policy { # Keep existing requirements as they are; only set this to true to meet the finding is_special_characters_required = true # Example of other commonly-used settings (leave as-is if you already manage them): # is_lowercase_characters_required = true # is_uppercase_characters_required = true # is_numeric_characters_required = true # minimum_password_length = 14 # is_username_containment_allowed = false # is_first_name_containment_allowed = false # is_last_name_containment_allowed = false } } ``` This updates the IAM password policy so that passwords must include at least one special character; it is an in-place update and does not replace the resource. After you add or modify this resource, `terraform plan` should show an in-place update to `oci_identity_authentication_policy.iam_password_policy` with `is_special_characters_required` changing from `false` (or unset) to `true`.