OCI IAM Password Policy Should Prevent Password Reuse

Using Console

To prevent password reuse in OCI IAM via the Console, you need to edit the tenancy’s password policy.Prerequisites:

You must be in the tenancy’s home region.
You must have permissions to manage IAM password policies (typically a tenancy administrator).

Step-by-step Remediation in OCI Console

Sign in to the OCI Console
Log in to the OCI Console as a user with admin privileges.
Switch to the Home Region (if not already there)
- At the top of the Console, check the region selector.
- If you are not in the home region, switch to it (password policies are managed at the tenancy level, in the home region).
Go to Identity & Security → Domains (or Identity → Domains)
- In the left-hand navigation menu, open Identity & Security.
- Click Domains.
- Identify the Default domain (or the domain in which the users are managed).
Open the Domain Settings
- Click on the domain name (for example, Default).
- In the domain details page, locate and select Security or Password Policy (naming can vary slightly, look for “Password policy” or similar under Security settings).
Edit the Password Policy
- Click Edit (or Edit password policy).
- Look for the setting related to Password Reuse or Password History (e.g., “Number of previous passwords remembered”, “Disallow reuse of last N passwords”).
Configure Password Reuse Prevention
- Set the value for password history / previous passwords to a non-zero number (e.g., 5 or your organization’s required value).
- This means a user cannot reuse any of their previous N passwords.
Save the Policy
- Click Save changes or Update to apply the new password policy.
Verify the Change
- Re-open the Password policy screen to confirm the password reuse / history value is correctly set.
- Optionally, attempt a password change for a test user to confirm that reusing an old password is blocked.

This configuration will satisfy the requirement that the OCI IAM password policy prevents password reuse for IAM Monitoring or any compliance check looking at your tenancy’s IAM password policy.

Using CLI

In OCI, “prevent password reuse” is controlled by the password history settings in the tenancy’s IAM Authentication Policy. You remediate it by enabling password history and setting a non‑zero history count using the OCI CLI.

1. Prerequisites

OCI CLI installed and configured (oci setup config already done).
You know your tenancy OCID (this is the compartment OCID for the auth policy).

2. Check the current password policy

oci iam authentication-policy get \
  --compartment-id <TENANCY_OCID> \
  --query 'authenticationPolicy.passwordPolicy' \
  --output table

Look for:

isPasswordHistoryEnabled
passwordHistoryCount

If isPasswordHistoryEnabled is false or passwordHistoryCount is 0 or null, password reuse is effectively allowed.

3. Update the policy to prevent password reuse

Decide how many previous passwords you want to remember (example: 5).

oci iam authentication-policy update \
  --compartment-id <TENANCY_OCID> \
  --password-policy '{
    "isPasswordHistoryEnabled": true,
    "passwordHistoryCount": 5
  }'

This replaces only the fields you specify; unspecified fields keep their existing values (the CLI merges JSON).

If you prefer to be explicit, first dump the current policy, edit, then re‑apply:

oci iam authentication-policy get \
  --compartment-id <TENANCY_OCID> \
  --query 'authenticationPolicy.passwordPolicy' > password-policy.json

Edit password-policy.json:

{
  "isPasswordHistoryEnabled": true,
  "passwordHistoryCount": 5,
  "... other existing settings ..."
}

Then:

oci iam authentication-policy update \
  --compartment-id <TENANCY_OCID> \
  --password-policy file://password-policy.json

4. Verify the change

oci iam authentication-policy get \
  --compartment-id <TENANCY_OCID> \
  --query 'authenticationPolicy.passwordPolicy.{HistoryEnabled:isPasswordHistoryEnabled,HistoryCount:passwordHistoryCount}' \
  --output table

You should see:

HistoryEnabled = true
HistoryCount = your chosen number (e.g., 5)

That configuration satisfies the “Password Policy Should Prevent Password Reuse” requirement for OCI IAM.

Using Python

To prevent password reuse in OCI IAM and handle it via Python monitoring/remediation, you need to enforce the setting in the Identity Domain password policy using the OCI Python SDK.Below are the high‑level steps and then a sample Python script.

1. Prerequisites

Install OCI Python SDK:
pip install oci
Configure OCI credentials (~/.oci/config) with a profile that has permissions to manage Identity Domains (e.g., Identity Domain Administrator):
[DEFAULT] user=<user_ocid> fingerprint=<api_key_fingerprint> key_file=/path/to/oci_api_key.pem tenancy=<tenancy_ocid> region=<region>
Note the Identity Domain OCID where you want to enforce the policy.

2. Understand the setting

In Identity Domains, password policy is usually controlled by attributes like:

isPreventedPasswordReuse (or similarly named flag for reuse prevention)
sometimes combined with a “history” count like passwordReuseHistoryCount (if supported)

Your security requirement: isPreventedPasswordReuse = True (and optionally a minimum history count).Names may differ slightly by SDK version; the pattern is the same: get the policy, set the reuse‑prevention field to true, update.

3. Python remediation script (identity domain password policy)

This script:

Reads config
Gets a password policy for a given Identity Domain
Sets the “prevent password reuse” flag if not already enabled

import oci
from oci.identity_domains import IdentityDomainsClient
from oci.identity_domains.models import UpdatePasswordPolicyDetails

# ---------------------------
# CONFIG
# ---------------------------
CONFIG_PROFILE = "DEFAULT"          # profile in ~/.oci/config
DOMAIN_OCID = "<your_identity_domain_ocid>"  # OCID of the Identity Domain
PASSWORD_POLICY_ID = "<password_policy_id_or_ocid>"  # see note below

# NOTE:
# In many setups, there is a single default password policy.
# If you don't know the policy ID, list them first (see helper below).

def get_identity_domains_client():
    config = oci.config.from_file(profile_name=CONFIG_PROFILE)
    return IdentityDomainsClient(config)

def list_password_policies(client):
    # Helper to discover password policies in the domain
    resp = client.list_password_policies(
        identity_domain_id=DOMAIN_OCID,
        count=100
    )
    for policy in resp.data.resources:
        print("Policy ID:", policy.id, "| Name:", getattr(policy, "display_name", None))

def ensure_password_reuse_prevented():
    client = get_identity_domains_client()

    # OPTIONAL: uncomment to discover policy IDs
    # list_password_policies(client); return

    # 1. Get current password policy
    get_resp = client.get_password_policy(
        password_policy_id=PASSWORD_POLICY_ID,
        identity_domain_id=DOMAIN_OCID
    )
    policy = get_resp.data

    # Check current setting (attribute name can vary; adjust to your SDK version)
    current_prevent_reuse = getattr(policy, "is_prevented_password_reuse", None)

    if current_prevent_reuse is True:
        print("Password reuse prevention already enabled.")
        return

    # 2. Build update details
    update_details = UpdatePasswordPolicyDetails()

    # Set prevent password reuse flag.
    # Use the exact attribute name from your SDK model:
    #   - inspect UpdatePasswordPolicyDetails in your environment:
    #     `help(UpdatePasswordPolicyDetails)` or `dir(UpdatePasswordPolicyDetails)`
    update_details.is_prevented_password_reuse = True

    # Optional: set minimum history count, if supported
    # For example:
    # update_details.password_history_count = 5

    # 3. Update the policy
    update_resp = client.update_password_policy(
        password_policy_id=PASSWORD_POLICY_ID,
        update_password_policy_details=update_details,
        identity_domain_id=DOMAIN_OCID
    )

    print("Updated password policy. Prevent reuse:",
          update_resp.data.is_prevented_password_reuse)

if __name__ == "__main__":
    ensure_password_reuse_prevented()

4. How to integrate into “OCI IAM Monitoring using Python”

Monitoring step: periodically run a script that:
- Calls get_password_policy
- Checks is_prevented_password_reuse
- Logs/alerts if False
Auto‑remediation step: extend that script to:
- If False, call update_password_policy as above to set it to True.

You can schedule this with:

An OCI Functions function triggered by Events or a scheduled job
An external cron job / CI pipeline running the Python script

If you share your current SDK version (pip show oci) I can give the exact attribute names as they appear in that version.

Using Terraform

# As of the current oracle/oci provider version, the IAM password policy
# setting that prevents password reuse (password history / reuse count)
# is not exposed in any Terraform resource (including identity domains
# password policy resources), so it cannot be remediated via Terraform.

# You must configure this in the OCI Console instead:
# 1. Go to Identity & Security → Identity Domains (or your tenancy-level IAM as applicable).
# 2. Open the Identity Domain / Security settings that hold your password policy.
# 3. Edit the password policy and enable password history / prevent password reuse,
#    setting the history length / reuse threshold to match your requirement.
# 4. Save the changes.

# Verification with Terraform is not possible for this specific control,
# since there is no corresponding argument to appear in `terraform plan`.

OCI Misconfigurations

OCI IAM Password Policy Should Prevent Password Reuse

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Step-by-step Remediation in OCI Console

1. Prerequisites

2. Check the current password policy

3. Update the policy to prevent password reuse

4. Verify the change

1. Prerequisites

2. Understand the setting

3. Python remediation script (identity domain password policy)

4. How to integrate into “OCI IAM Monitoring using Python”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Step-by-step Remediation in OCI Console

​1. Prerequisites

​2. Check the current password policy

​3. Update the policy to prevent password reuse

​4. Verify the change

​1. Prerequisites

​2. Understand the setting

​3. Python remediation script (identity domain password policy)

​4. How to integrate into “OCI IAM Monitoring using Python”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Step-by-step Remediation in OCI Console

1. Prerequisites

2. Check the current password policy

3. Update the policy to prevent password reuse

4. Verify the change

1. Prerequisites

2. Understand the setting

3. Python remediation script (identity domain password policy)

4. How to integrate into “OCI IAM Monitoring using Python”