OCI IAM Password Policy Should Require Uppercase Characters

Using Console

To require uppercase characters in OCI IAM passwords using the OCI Console:

Sign in to OCI Console
Log in with a user that has tenancy-level / domain admin privileges.
Go to Identity Domains
- Open the hamburger menu (☰) in the top-left.
- Navigate to: Identity & Security → Domains.
Select the Appropriate Identity Domain
- Click on the identity domain you use for your IAM users (often named Default unless you created others).
Open the Password Policy Settings
- In the left-hand menu for that domain, go to:
  Security → Password Policy
  (In some UIs, it may be under Security → Authentication Settings → Password Policy.)
Edit the Password Policy
- Click Edit (or Edit Password Policy).
Enable Uppercase Requirement
- Locate the setting similar to:
  - Require uppercase letters / Minimum uppercase characters.
- Turn on Require uppercase letters (or set minimum uppercase characters to at least 1).
Save Changes
- Click Save / Update to apply the new policy.
Verify
- Try creating or changing a test user’s password: the UI should now enforce at least one uppercase character.

If you are using an older tenancy without identity domains, check:
Identity & Security → Security → Authentication Settings → Password Policy, then enable Require Uppercase Characters there and save.

Using CLI

To enforce “Require Uppercase Characters” in the OCI IAM password policy using the OCI CLI, do the following:

1. Prerequisites

OCI CLI installed and configured (oci setup config)
You know your tenancy OCID (from Console: Profile → Tenancy Details)

2. Get current authentication (password) policy

TENANCY_OCID="<your_tenancy_ocid>"

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data' \
  > current-auth-policy.json

This file contains the existing password policy.

3. Edit the password policy JSON

Open current-auth-policy.json and locate the passwordPolicy block.
Ensure it contains "isUppercaseCharactersRequired": true.Example minimal structure:

{
  "compartmentId": "ocid1.tenancy.oc1....",
  "passwordPolicy": {
    "isUppercaseCharactersRequired": true
  }
}

If other passwordPolicy fields exist (length, numeric, lowercase, etc.), keep them as-is and only change/add isUppercaseCharactersRequired.

4. Update the authentication policy with OCI CLI

Save your edited JSON as updated-auth-policy.json, then run:

oci iam authentication-policy update \
  --compartment-id "$TENANCY_OCID" \
  --authentication-policy file://updated-auth-policy.json

5. Verify the change

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data.passwordPolicy'

Confirm the output shows:

"isUppercaseCharactersRequired": true

This will remediate the “OCI IAM Password Policy Should Require Uppercase Characters” finding used by OCI IAM/Cloud Guard monitoring.

Using Python

To fix “OCI IAM Password Policy Should Require Uppercase Characters” using Python, you need to update the tenancy’s Authentication Policy via the OCI Python SDK.Below are step-by-step instructions and a sample remediation script.

1. Prerequisites

Install the OCI Python SDK:
pip install oci
Configure your ~/.oci/config with a profile that has IAM permissions on the tenancy (e.g., Tenancy Admin or a policy allowing MANAGE authentication-policies on the tenancy):
[DEFAULT] user=ocid1.user.oc1..aaaa... fingerprint=xx:xx:xx:... key_file=/path/to/oci_api_key.pem tenancy=ocid1.tenancy.oc1..aaaa... region=us-ashburn-1

2. Python Script to Enforce Uppercase Requirement

This script:

Fetches current authentication (password) policy.
Sets is_uppercase_characters_required to True (and preserves other settings).
Updates the tenancy authentication policy if needed.

import oci

# CONFIG
PROFILE_NAME = "DEFAULT"  # or your profile name in ~/.oci/config

def main():
    # Load config
    config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
    tenancy_ocid = config["tenancy"]

    # Create IdentityClient
    identity_client = oci.identity.IdentityClient(config)

    # 1. Get current authentication policy
    current_policy_response = identity_client.get_authentication_policy(tenancy_ocid)
    current_policy = current_policy_response.data

    password_policy = current_policy.password_policy

    # 2. If password_policy is None, initialize it
    if password_policy is None:
        password_policy = oci.identity.models.PasswordPolicy()

    # 3. Check if uppercase requirement is already enabled
    if password_policy.is_uppercase_characters_required:
        print("Uppercase characters are already required in the password policy.")
        return

    # 4. Set uppercase requirement to True
    password_policy.is_uppercase_characters_required = True

    # NOTE: We keep all other existing properties as they are

    # 5. Prepare update payload
    update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
        password_policy=password_policy
    )

    # 6. Update authentication policy
    update_response = identity_client.update_authentication_policy(
        tenancy_id=tenancy_ocid,
        update_authentication_policy_details=update_details
    )

    print("Updated authentication policy. New settings:")
    print(update_response.data)

if __name__ == "__main__":
    main()

3. How to Use This for “Monitoring + Remediation”

Monitoring:
- Run the “get” part (get_authentication_policy) on a schedule (e.g., via a cron job, OCI Functions, or OCI DevOps pipeline).
- If password_policy.is_uppercase_characters_required is False, log an alert (or push a metric/event).
Auto-remediation:
- Keep the script as is and run it on a schedule or trigger it from an OCI Function when a detector (e.g., from OCI Cloud Guard or your own check) finds the misconfiguration.
- The script is idempotent: if uppercase is already required, it does nothing.

If you’re using OCI Identity Domains (not classic IAM) and need the equivalent for a specific identity domain, say so and I’ll provide the Identity Domains version of the Python code.

Using Terraform

resource "oci_identity_authentication_policy" "iam_password_policy" {
  # Replace with your tenancy OCID
  compartment_id = "OCID_OF_TENANCY"

  password_policy {
    # Keep existing settings as they are in your environment,
    # only change the uppercase requirement to true.
    is_uppercase_characters_required = true

    # EXAMPLES of other commonly configured attributes; keep or adjust
    # to match your current policy, do not blindly copy:
    # minimum_password_length        = 14
    # is_lowercase_characters_required = true
    # is_numeric_characters_required   = true
    # is_special_characters_required   = true
    # is_username_containment_allowed  = false
    # password_expiration_in_days      = 90
    # minimum_password_difference      = 4
  }
}

This change is an in-place update of the IAM authentication (password) policy and does not force resource replacement.For verification, terraform plan should show an in-place update (~) to oci_identity_authentication_policy.iam_password_policy with is_uppercase_characters_required changing from false (or null) to true.

OCI Misconfigurations

OCI IAM Password Policy Should Require Uppercase Characters

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Get current authentication (password) policy

3. Edit the password policy JSON

4. Update the authentication policy with OCI CLI

5. Verify the change

1. Prerequisites

2. Python Script to Enforce Uppercase Requirement

3. How to Use This for “Monitoring + Remediation”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prerequisites

​2. Get current authentication (password) policy

​3. Edit the password policy JSON

​4. Update the authentication policy with OCI CLI

​5. Verify the change

​1. Prerequisites

​2. Python Script to Enforce Uppercase Requirement

​3. How to Use This for “Monitoring + Remediation”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Get current authentication (password) policy

3. Edit the password policy JSON

4. Update the authentication policy with OCI CLI

5. Verify the change

1. Prerequisites

2. Python Script to Enforce Uppercase Requirement

3. How to Use This for “Monitoring + Remediation”