> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI IAM Password Policy Should Prevent Password Reuse ### More Info: The IAM password policy should prevent password reuse. Allowing users to reuse previous passwords negates the security benefits of regular password rotation. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Startup Security Baseline * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * GDPR * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To prevent password reuse in OCI IAM via the Console, you need to edit the tenancy’s password policy. **Prerequisites:** * You must be in the tenancy’s **home region**. * You must have permissions to manage IAM password policies (typically a tenancy administrator). *** ### Step-by-step Remediation in OCI Console 1. **Sign in to the OCI Console**\ Log in to the OCI Console as a user with admin privileges. 2. **Switch to the Home Region (if not already there)** * At the top of the Console, check the region selector. * If you are not in the home region, switch to it (password policies are managed at the tenancy level, in the home region). 3. **Go to Identity & Security → Domains (or Identity → Domains)** * In the left-hand navigation menu, open **Identity & Security**. * Click **Domains**. * Identify the **Default domain** (or the domain in which the users are managed). 4. **Open the Domain Settings** * Click on the domain name (for example, **Default**). * In the domain details page, locate and select **Security** or **Password Policy** (naming can vary slightly, look for “Password policy” or similar under Security settings). 5. **Edit the Password Policy** * Click **Edit** (or **Edit password policy**). * Look for the setting related to **Password Reuse** or **Password History** (e.g., “Number of previous passwords remembered”, “Disallow reuse of last N passwords”). 6. **Configure Password Reuse Prevention** * Set the value for **password history** / **previous passwords** to a non-zero number (e.g., **5** or your organization’s required value). * This means a user cannot reuse any of their previous N passwords. 7. **Save the Policy** * Click **Save changes** or **Update** to apply the new password policy. 8. **Verify the Change** * Re-open the **Password policy** screen to confirm the **password reuse / history** value is correctly set. * Optionally, attempt a password change for a test user to confirm that reusing an old password is blocked. This configuration will satisfy the requirement that the **OCI IAM password policy prevents password reuse** for IAM Monitoring or any compliance check looking at your tenancy’s IAM password policy. In OCI, “prevent password reuse” is controlled by the **password history** settings in the tenancy’s IAM Authentication Policy. You remediate it by enabling password history and setting a non‑zero history count using the OCI CLI. ### 1. Prerequisites * OCI CLI installed and configured (`oci setup config` already done). * You know your **tenancy OCID** (this is the compartment OCID for the auth policy). ### 2. Check the current password policy ```bash theme={null} oci iam authentication-policy get \ --compartment-id \ --query 'authenticationPolicy.passwordPolicy' \ --output table ``` Look for: * `isPasswordHistoryEnabled` * `passwordHistoryCount` If `isPasswordHistoryEnabled` is `false` or `passwordHistoryCount` is `0` or null, password reuse is effectively allowed. ### 3. Update the policy to prevent password reuse Decide how many previous passwords you want to remember (example: 5). ```bash theme={null} oci iam authentication-policy update \ --compartment-id \ --password-policy '{ "isPasswordHistoryEnabled": true, "passwordHistoryCount": 5 }' ``` This replaces only the fields you specify; unspecified fields keep their existing values (the CLI merges JSON). > If you prefer to be explicit, first dump the current policy, edit, then re‑apply: ```bash theme={null} oci iam authentication-policy get \ --compartment-id \ --query 'authenticationPolicy.passwordPolicy' > password-policy.json ``` Edit `password-policy.json`: ```json theme={null} { "isPasswordHistoryEnabled": true, "passwordHistoryCount": 5, "... other existing settings ..." } ``` Then: ```bash theme={null} oci iam authentication-policy update \ --compartment-id \ --password-policy file://password-policy.json ``` ### 4. Verify the change ```bash theme={null} oci iam authentication-policy get \ --compartment-id \ --query 'authenticationPolicy.passwordPolicy.{HistoryEnabled:isPasswordHistoryEnabled,HistoryCount:passwordHistoryCount}' \ --output table ``` You should see: * `HistoryEnabled` = `true` * `HistoryCount` = your chosen number (e.g., `5`) That configuration satisfies the “Password Policy Should Prevent Password Reuse” requirement for OCI IAM. To prevent password reuse in OCI IAM and handle it via Python monitoring/remediation, you need to enforce the setting in the Identity Domain password policy using the OCI Python SDK. Below are the high‑level steps and then a sample Python script. *** ### 1. Prerequisites 1. Install OCI Python SDK: ```bash theme={null} pip install oci ``` 2. Configure OCI credentials (`~/.oci/config`) with a profile that has permissions to manage Identity Domains (e.g., `Identity Domain Administrator`): ```ini theme={null} [DEFAULT] user= fingerprint= key_file=/path/to/oci_api_key.pem tenancy= region= ``` 3. Note the **Identity Domain OCID** where you want to enforce the policy. *** ### 2. Understand the setting In Identity Domains, password policy is usually controlled by attributes like: * `isPreventedPasswordReuse` (or similarly named flag for reuse prevention) * sometimes combined with a “history” count like `passwordReuseHistoryCount` (if supported) Your security requirement: `isPreventedPasswordReuse = True` (and optionally a minimum history count). Names may differ slightly by SDK version; the pattern is the same: get the policy, set the reuse‑prevention field to true, update. *** ### 3. Python remediation script (identity domain password policy) This script: * Reads config * Gets a password policy for a given Identity Domain * Sets the “prevent password reuse” flag if not already enabled ```python theme={null} import oci from oci.identity_domains import IdentityDomainsClient from oci.identity_domains.models import UpdatePasswordPolicyDetails # --------------------------- # CONFIG # --------------------------- CONFIG_PROFILE = "DEFAULT" # profile in ~/.oci/config DOMAIN_OCID = "" # OCID of the Identity Domain PASSWORD_POLICY_ID = "" # see note below # NOTE: # In many setups, there is a single default password policy. # If you don't know the policy ID, list them first (see helper below). def get_identity_domains_client(): config = oci.config.from_file(profile_name=CONFIG_PROFILE) return IdentityDomainsClient(config) def list_password_policies(client): # Helper to discover password policies in the domain resp = client.list_password_policies( identity_domain_id=DOMAIN_OCID, count=100 ) for policy in resp.data.resources: print("Policy ID:", policy.id, "| Name:", getattr(policy, "display_name", None)) def ensure_password_reuse_prevented(): client = get_identity_domains_client() # OPTIONAL: uncomment to discover policy IDs # list_password_policies(client); return # 1. Get current password policy get_resp = client.get_password_policy( password_policy_id=PASSWORD_POLICY_ID, identity_domain_id=DOMAIN_OCID ) policy = get_resp.data # Check current setting (attribute name can vary; adjust to your SDK version) current_prevent_reuse = getattr(policy, "is_prevented_password_reuse", None) if current_prevent_reuse is True: print("Password reuse prevention already enabled.") return # 2. Build update details update_details = UpdatePasswordPolicyDetails() # Set prevent password reuse flag. # Use the exact attribute name from your SDK model: # - inspect UpdatePasswordPolicyDetails in your environment: # `help(UpdatePasswordPolicyDetails)` or `dir(UpdatePasswordPolicyDetails)` update_details.is_prevented_password_reuse = True # Optional: set minimum history count, if supported # For example: # update_details.password_history_count = 5 # 3. Update the policy update_resp = client.update_password_policy( password_policy_id=PASSWORD_POLICY_ID, update_password_policy_details=update_details, identity_domain_id=DOMAIN_OCID ) print("Updated password policy. Prevent reuse:", update_resp.data.is_prevented_password_reuse) if __name__ == "__main__": ensure_password_reuse_prevented() ``` *** ### 4. How to integrate into “OCI IAM Monitoring using Python” 1. **Monitoring step**: periodically run a script that: * Calls `get_password_policy` * Checks `is_prevented_password_reuse` * Logs/alerts if `False` 2. **Auto‑remediation step**: extend that script to: * If `False`, call `update_password_policy` as above to set it to `True`. You can schedule this with: * An OCI **Functions** function triggered by **Events** or a **scheduled** job * An external cron job / CI pipeline running the Python script *** If you share your current SDK version (`pip show oci`) I can give the exact attribute names as they appear in that version. ```hcl theme={null} # As of the current oracle/oci provider version, the IAM password policy # setting that prevents password reuse (password history / reuse count) # is not exposed in any Terraform resource (including identity domains # password policy resources), so it cannot be remediated via Terraform. # You must configure this in the OCI Console instead: # 1. Go to Identity & Security → Identity Domains (or your tenancy-level IAM as applicable). # 2. Open the Identity Domain / Security settings that hold your password policy. # 3. Edit the password policy and enable password history / prevent password reuse, # setting the history length / reuse threshold to match your requirement. # 4. Save the changes. # Verification with Terraform is not possible for this specific control, # since there is no corresponding argument to appear in `terraform plan`. ```