> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI IAM Password Policy Should Require Uppercase Characters ### More Info: The OCI IAM password policy should require at least one uppercase character. Mixed-case passwords provide greater entropy and are harder for attackers to guess ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * GDPR * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To require uppercase characters in OCI IAM passwords using the OCI Console: 1. **Sign in to OCI Console**\ Log in with a user that has tenancy-level / domain admin privileges. 2. **Go to Identity Domains** * Open the hamburger menu (☰) in the top-left. * Navigate to: **Identity & Security → Domains**. 3. **Select the Appropriate Identity Domain** * Click on the identity domain you use for your IAM users (often named **Default** unless you created others). 4. **Open the Password Policy Settings** * In the left-hand menu for that domain, go to:\ **Security → Password Policy**\ (In some UIs, it may be under **Security → Authentication Settings → Password Policy**.) 5. **Edit the Password Policy** * Click **Edit** (or **Edit Password Policy**). 6. **Enable Uppercase Requirement** * Locate the setting similar to: * **Require uppercase letters** / **Minimum uppercase characters**. * Turn on **Require uppercase letters** (or set minimum uppercase characters to at least 1). 7. **Save Changes** * Click **Save** / **Update** to apply the new policy. 8. **Verify** * Try creating or changing a test user’s password: the UI should now enforce at least one uppercase character. If you are using an older tenancy without identity domains, check:\ **Identity & Security → Security → Authentication Settings → Password Policy**, then enable **Require Uppercase Characters** there and save. To enforce **“Require Uppercase Characters”** in the OCI IAM password policy using the **OCI CLI**, do the following: *** ### 1. Prerequisites * OCI CLI installed and configured (`oci setup config`) * You know your **tenancy OCID** (from Console: Profile → Tenancy Details) *** ### 2. Get current authentication (password) policy ```bash theme={null} TENANCY_OCID="" oci iam authentication-policy get \ --compartment-id "$TENANCY_OCID" \ --query 'data' \ > current-auth-policy.json ``` This file contains the existing password policy. *** ### 3. Edit the password policy JSON Open `current-auth-policy.json` and locate the `passwordPolicy` block.\ Ensure it contains `"isUppercaseCharactersRequired": true`. Example minimal structure: ```json theme={null} { "compartmentId": "ocid1.tenancy.oc1....", "passwordPolicy": { "isUppercaseCharactersRequired": true } } ``` If other `passwordPolicy` fields exist (length, numeric, lowercase, etc.), keep them as-is and only change/add `isUppercaseCharactersRequired`. *** ### 4. Update the authentication policy with OCI CLI Save your edited JSON as `updated-auth-policy.json`, then run: ```bash theme={null} oci iam authentication-policy update \ --compartment-id "$TENANCY_OCID" \ --authentication-policy file://updated-auth-policy.json ``` *** ### 5. Verify the change ```bash theme={null} oci iam authentication-policy get \ --compartment-id "$TENANCY_OCID" \ --query 'data.passwordPolicy' ``` Confirm the output shows: ```json theme={null} "isUppercaseCharactersRequired": true ``` This will remediate the “OCI IAM Password Policy Should Require Uppercase Characters” finding used by OCI IAM/Cloud Guard monitoring. To fix “OCI IAM Password Policy Should Require Uppercase Characters” using Python, you need to update the tenancy’s Authentication Policy via the OCI Python SDK. Below are step-by-step instructions and a sample remediation script. *** ## 1. Prerequisites 1. Install the OCI Python SDK: ```bash theme={null} pip install oci ``` 2. Configure your `~/.oci/config` with a profile that has IAM permissions on the tenancy (e.g., `Tenancy Admin` or a policy allowing `MANAGE authentication-policies` on the tenancy): ```ini theme={null} [DEFAULT] user=ocid1.user.oc1..aaaa... fingerprint=xx:xx:xx:... key_file=/path/to/oci_api_key.pem tenancy=ocid1.tenancy.oc1..aaaa... region=us-ashburn-1 ``` *** ## 2. Python Script to Enforce Uppercase Requirement This script: * Fetches current authentication (password) policy. * Sets `is_uppercase_characters_required` to `True` (and preserves other settings). * Updates the tenancy authentication policy if needed. ```python theme={null} import oci # CONFIG PROFILE_NAME = "DEFAULT" # or your profile name in ~/.oci/config def main(): # Load config config = oci.config.from_file("~/.oci/config", PROFILE_NAME) tenancy_ocid = config["tenancy"] # Create IdentityClient identity_client = oci.identity.IdentityClient(config) # 1. Get current authentication policy current_policy_response = identity_client.get_authentication_policy(tenancy_ocid) current_policy = current_policy_response.data password_policy = current_policy.password_policy # 2. If password_policy is None, initialize it if password_policy is None: password_policy = oci.identity.models.PasswordPolicy() # 3. Check if uppercase requirement is already enabled if password_policy.is_uppercase_characters_required: print("Uppercase characters are already required in the password policy.") return # 4. Set uppercase requirement to True password_policy.is_uppercase_characters_required = True # NOTE: We keep all other existing properties as they are # 5. Prepare update payload update_details = oci.identity.models.UpdateAuthenticationPolicyDetails( password_policy=password_policy ) # 6. Update authentication policy update_response = identity_client.update_authentication_policy( tenancy_id=tenancy_ocid, update_authentication_policy_details=update_details ) print("Updated authentication policy. New settings:") print(update_response.data) if __name__ == "__main__": main() ``` *** ## 3. How to Use This for “Monitoring + Remediation” * **Monitoring**: * Run the “get” part (`get_authentication_policy`) on a schedule (e.g., via a cron job, OCI Functions, or OCI DevOps pipeline). * If `password_policy.is_uppercase_characters_required is False`, log an alert (or push a metric/event). * **Auto-remediation**: * Keep the script as is and run it on a schedule or trigger it from an OCI Function when a detector (e.g., from OCI Cloud Guard or your own check) finds the misconfiguration. * The script is idempotent: if uppercase is already required, it does nothing. If you’re using *OCI Identity Domains* (not classic IAM) and need the equivalent for a specific identity domain, say so and I’ll provide the Identity Domains version of the Python code. ```hcl theme={null} resource "oci_identity_authentication_policy" "iam_password_policy" { # Replace with your tenancy OCID compartment_id = "OCID_OF_TENANCY" password_policy { # Keep existing settings as they are in your environment, # only change the uppercase requirement to true. is_uppercase_characters_required = true # EXAMPLES of other commonly configured attributes; keep or adjust # to match your current policy, do not blindly copy: # minimum_password_length = 14 # is_lowercase_characters_required = true # is_numeric_characters_required = true # is_special_characters_required = true # is_username_containment_allowed = false # password_expiration_in_days = 90 # minimum_password_difference = 4 } } ``` This change is an in-place update of the IAM authentication (password) policy and does not force resource replacement. For verification, `terraform plan` should show an in-place update (`~`) to `oci_identity_authentication_policy.iam_password_policy` with `is_uppercase_characters_required` changing from `false` (or null) to `true`.