> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI IAM Password Policy Should Enforce Strong Requirements ### More Info: The IAM password policy should enforce strong requirements including minimum 14 characters, uppercase, lowercase, numbers, and special characters. Weak policies allow easily compromised passwords. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * GDPR * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate **“OCI IAM Password Policy Should Enforce Strong Requirements”** using the **OCI Console**, you need to tighten the password policy on your **Identity Domain(s)**. Follow these steps: 1. **Sign in to OCI Console** * Log in as a user with permissions to manage identity domains (e.g., tenancy admin). 2. **Open the Identity Domain** * In the left menu, go to:\ **Identity & Security → Domains** * Click the **Identity Domain** you are using for your users (for most environments this is the “Default” domain unless you created others). 3. **Go to Password Policy Settings** * Inside the domain, in the left pane, select:\ **Security → Password Policy** 4. **Configure Strong Password Requirements**\ Adjust settings to meet strong requirements (and typically satisfy OCI Cloud Guard / security checks), for example: * **Minimum password length**: set to **at least 12** (or your org standard, often ≥ 12–14). * **Require character types** (enable all): * Require **uppercase** letters * Require **lowercase** letters * Require **numbers** * Require **special characters** * **Password history**: keep users from reusing passwords (e.g., remember last **5–10** passwords). * **Password expiration**: set to expire after a period (e.g., **90 days** or as per policy). * **Account lockout**: * Lock account after X failed attempts (e.g., **5**). * Set lockout duration or require admin unlock (per your policy). * **Disallow username or parts of name in password** if that option is available in your tenancy. 5. **Save the Policy** * Click **Save** (or **Save changes**) at the bottom of the page. 6. **Verify Remediation (Optional but Recommended)** * If you are using **Cloud Guard**, ensure the relevant **Detector Recipe** for IAM password policy is enabled. * After the policy is updated, allow a few minutes and then: * Go to **Cloud Guard → Detector Recipes / Problems** * Confirm that the **“IAM Password Policy Should Enforce Strong Requirements”** problem is no longer listed (or has been resolved) for that domain. Repeat the same steps for **each Identity Domain** where local users are managed, if you have more than one. Below are the concise steps to remediate “OCI IAM Password Policy Should Enforce Strong Requirements” using the OCI CLI. Assumptions: * You’re using **OCI IAM (classic)**, not Identity Domains. * You have **tenancy OCID** and OCI CLI already configured (`oci setup config`). ### 1. Get your Tenancy OCID (if you don’t already have it) If you don’t know it, from CLI: ```bash theme={null} oci iam compartment list --compartment-id-in-subtree false \ --access-level ACCESSIBLE --all \ --query "data[?\"compartment-id\"=='null'].id | [0]" \ --raw-output ``` Or look it up in the Console:\ Profile → Tenancy: the OCID is shown there. Let’s call it: ```bash theme={null} TENANCY_OCID="" ``` *** ### 2. Check the current password policy ```bash theme={null} oci iam password-policy get \ --compartment-id "$TENANCY_OCID" ``` Review the output to see existing settings. *** ### 3. Define a strong password policy in JSON Create a file `password_policy.json` with strong requirements, e.g.: ```json theme={null} { "minimumPasswordLength": 14, "isUppercaseCharactersRequired": true, "isLowercaseCharactersRequired": true, "isNumericCharactersRequired": true, "isSpecialCharactersRequired": true, "isUserNameContainedDenied": true, "isFirstNameContainedDenied": true, "isLastNameContainedDenied": true, "minimumNumericCharacters": 1, "minimumSpecialCharacters": 1, "passwordReusePrevention": 10, "passwordExpiryInDays": 90, "isLockoutEffective": true, "maximumIncorrectAttempts": 5, "lockoutDurationInSeconds": 900 } ``` Adjust values per your policy if needed. *** ### 4. Update the password policy using OCI CLI ```bash theme={null} oci iam password-policy update \ --compartment-id "$TENANCY_OCID" \ --policy "file://password_policy.json" ``` *** ### 5. Verify the updated policy ```bash theme={null} oci iam password-policy get \ --compartment-id "$TENANCY_OCID" ``` Confirm the returned fields match your strong requirements. *** If you share the exact policy standard you must meet (e.g., CIS, internal policy), I can provide a JSON snippet tailored to that. To enforce a strong OCI IAM password policy and monitor/remediate it using Python, you’ll: 1. Read the current authentication (password) policy. 2. Compare it to your required “strong” standards. 3. If it’s weaker, update it via the OCI Python SDK. Below is a concise, end‑to‑end example. *** ## 1. Prerequisites * OCI Python SDK installed: ```bash theme={null} pip install oci ``` * A config file (default: `~/.oci/config`) with a profile that has **identity:AUTHENTICATION\_POLICY\_UPDATE** permission on the tenancy. Example policy in IAM: ```json theme={null} Allow group SecurityAdmins to manage authentication-policies in tenancy ``` *** ## 2. Decide Your “Strong” Password Requirements Example strong policy (adjust as needed): * Minimum length: 14 * Require lowercase, uppercase, numbers, special characters * Disallow username in password * Optional: set password hard expiry, etc. *** ## 3. Python Script: Monitor and Remediate Password Policy ```python theme={null} import oci from oci.identity import IdentityClient from oci.identity.models import UpdateAuthenticationPolicyDetails, PasswordPolicy # -------- CONFIGURE THESE VALUES -------- PROFILE_NAME = "DEFAULT" # profile in ~/.oci/config MIN_LENGTH = 14 REQUIRE_LOWERCASE = True REQUIRE_UPPERCASE = True REQUIRE_NUMERIC = True REQUIRE_SPECIAL = True ALLOW_USERNAME_CONTAINMENT = False # ---------------------------------------- def get_identity_client(profile=PROFILE_NAME): config = oci.config.from_file("~/.oci/config", profile_name=profile) return IdentityClient(config), config["tenancy"] def is_policy_strong(current_policy: PasswordPolicy) -> bool: """ Returns True if the current policy meets or exceeds the desired standards. """ # Handle None (no policy set yet) if current_policy is None: return False checks = [ (current_policy.minimum_password_length or 0) >= MIN_LENGTH, bool(current_policy.is_lowercase_characters_required) == REQUIRE_LOWERCASE, bool(current_policy.is_uppercase_characters_required) == REQUIRE_UPPERCASE, bool(current_policy.is_numeric_characters_required) == REQUIRE_NUMERIC, bool(current_policy.is_special_characters_required) == REQUIRE_SPECIAL, bool(current_policy.is_username_containment_allowed) == ALLOW_USERNAME_CONTAINMENT, ] return all(checks) def build_strong_policy() -> PasswordPolicy: """ Build the desired strong password policy object. """ return PasswordPolicy( minimum_password_length=MIN_LENGTH, is_lowercase_characters_required=REQUIRE_LOWERCASE, is_uppercase_characters_required=REQUIRE_UPPERCASE, is_numeric_characters_required=REQUIRE_NUMERIC, is_special_characters_required=REQUIRE_SPECIAL, is_username_containment_allowed=ALLOW_USERNAME_CONTAINMENT, # Optional extras; set as needed: # is_password_hard_expiry_enabled=True, # is_password_expiry_notifications_enabled=True, # is_api_keys_cleanup_enabled=True, # is_oauth_client_certificates_cleanup_enabled=True, # is_smtp_credential_cleanup_enabled=True, ) def ensure_strong_password_policy(): identity_client, tenancy_id = get_identity_client() # 1. Get current authentication (password) policy current_auth_policy = identity_client.get_authentication_policy( compartment_id=tenancy_id ).data current_password_policy = current_auth_policy.password_policy # 2. Check if it already meets strong requirements if is_policy_strong(current_password_policy): print("Password policy already meets strong requirements. No change needed.") return print("Password policy is weak or missing. Updating to strong policy…") # 3. Build the new strong policy new_policy = build_strong_policy() update_details = UpdateAuthenticationPolicyDetails( password_policy=new_policy ) # 4. Update the tenancy authentication (password) policy response = identity_client.update_authentication_policy( compartment_id=tenancy_id, update_authentication_policy_details=update_details, ) print("Password policy updated. New policy:") print(response.data.password_policy) if __name__ == "__main__": ensure_strong_password_policy() ``` *** ## 4. Using This for “Monitoring” * Run this script periodically (e.g., via cron, CI pipeline, or an external scheduler). * Treat it as a **monitor + auto‑remediator**: * It inspects the current policy. * If it’s already strong, it does nothing. * If it’s weak, it automatically remediates. If you want it to only **alert** and not change anything, you can: * Keep `is_policy_strong()` logic. * When policy is weak, just log/send an alert (email, Slack, etc.) instead of calling `update_authentication_policy`. ```hcl theme={null} # There is currently no Terraform resource in the official OCI provider # that manages the *tenancy-level* IAM password policy (the one checked # by this finding), so this control cannot be remediated via Terraform. # You must update it manually in the OCI Console: # 1. Open "Identity & Security" → "Domains" (or "Identity" → "Security" for classic IAM). # 2. Select the target tenancy/domain. # 3. Go to "Password Policy". # 4. Set: # - Minimum password length: 14 # - Require at least one uppercase character: Enabled # - Require at least one lowercase character: Enabled # - Require at least one number: Enabled # - Require at least one special character: Enabled # 5. Save the policy. # Since there is no Terraform-managed resource, `terraform plan` # will show no changes related to the IAM password policy. ```