Skip to main content

OCI IAM Password Policy Should Enforce Yearly Rotation

More Info:​

The IAM password policy should enforce password expiration within 365 days. Passwords that never expire remain vulnerable indefinitely if compromised without detection.

Risk Level​

High

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To enforce yearly password rotation in OCI IAM using the Console, you need to update the password policy for your identity domain (or for the tenancy if you’re still using the classic model).

Below are the steps for both models—use the one that matches what you see in your Console.

1. For Identity Domains (most new tenancies)​

  1. Sign in to OCI Console with a user that has identity-domain-admin or tenancy admin privileges.
  2. In the left hamburger menu, go to:
    Identity & Security → Domains.
  3. Click the Identity Domain you want to configure (e.g., “Default”).
  4. In the domain page, under Security, click Password Policy (or Security → Password policy, depending on UI version).
  5. Edit the policy:
    • Locate Maximum password age (or similar field).
    • Set it to 365 days (or 12 months, as allowed by UI).
  6. Review other parameters (optional) such as:
    • Password history
    • Minimum password length
    • Complexity requirements
  7. Click Save or Update to apply the changes.

This will enforce that all local users in that identity domain must change their passwords at least once every year.

2. For Classic IAM (Tenancy-level password policy)​

If you don’t see “Domains” and instead work with “Users, Groups, Policies” directly:

  1. Sign in to OCI Console with tenancy admin privileges.
  2. Go to:
    Identity & Security → Administration → Security (or directly Identity → Security depending on UI).
  3. Click Password Policy.
  4. Click Edit.
  5. Set:
    • Maximum password age (days) = 365.
  6. Save/apply the configuration.

This applies to all local IAM users in the tenancy using the classic IAM model.

If you tell me whether you see “Identity Domains” or just “Users/Groups/Policies,” I can tailor the exact menu path for your specific layout.

Using CLI

Below are the exact steps to enforce yearly password rotation in OCI IAM using the OCI CLI.

1. Prerequisites​

  • OCI CLI installed and configured (oci setup config)
  • You must be in the home region
  • You need your tenancy OCID (root compartment OCID)

If you don’t know it:

oci iam tenancy get --tenancy-id <tenancy_ocid>

(You can also copy it from the console under “Tenancy Information”.)

2. Check the Current Password Policy​

oci iam authentication-policy get \
  --compartment-id <tenancy_ocid> \
  --query "data.password-policy" \
  --output table

This shows current settings, including isPasswordExpiryEnabled and passwordExpiryInDays.

3. Update Policy to Enforce Yearly Rotation (365 Days)​

Run this command, adjusting other fields as needed. The key change for yearly rotation is:

  • "isPasswordExpiryEnabled": true
  • "passwordExpiryInDays": 365
oci iam authentication-policy update \
  --compartment-id <tenancy_ocid> \
  --password-policy '{
    "isLowercaseCharactersRequired": true,
    "isUppercaseCharactersRequired": true,
    "isNumericCharactersRequired": true,
    "isSpecialCharactersRequired": true,
    "isPasswordExpiryEnabled": true,
    "passwordExpiryInDays": 365,
    "isPasswordReusePreventionEnabled": true,
    "minimumPasswordLength": 12,
    "isUsernameContainmentAllowed": false
  }'

Notes:

  • Include all required fields in --password-policy (not just the ones you’re changing), otherwise some may reset.
  • Adjust minimumPasswordLength and the character requirements to your organization’s standards.

4. Verify the Change​

oci iam authentication-policy get \
  --compartment-id <tenancy_ocid> \
  --query "data.password-policy" \
  --output table

Confirm:

  • isPasswordExpiryEnabled = true
  • passwordExpiryInDays = 365

This will satisfy the “OCI IAM Password Policy Should Enforce Yearly Rotation” requirement for IAM monitoring / Cloud Guard.

Using Python

To enforce yearly password rotation for OCI IAM using Python, you’ll:

  1. Check the current password policy
  2. Update it so password_lifetime = 365 days
  3. Optionally turn this into a “monitor + auto-remediate” script

Below are the concrete steps and Python code.

1. Prerequisites​

  1. Install OCI Python SDK:

    pip install oci

  2. Make sure you have an OCI config file (usually ~/.oci/config) with:

    [DEFAULT]
    user=ocid1.user.oc1..
    fingerprint=xx:xx:xx:...
    key_file=/path/to/oci_api_key.pem
    tenancy=ocid1.tenancy.oc1..
    region=us-ashburn-1

You need permissions like:

  • identity-domains-authentication-policies Manage or equivalent in your tenancy (typically via manage authentication-policies on tenancy).

2. Get Current Authentication (Password) Policy​

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")

identity_client = oci.identity.IdentityClient(config)

# Tenancy OCID from config
tenancy_id = config["tenancy"]

# Fetch current password/authentication policy
current_policy = identity_client.get_authentication_policy(tenancy_id).data
print("Current password_lifetime:", current_policy.password_policy.password_lifetime)

password_lifetime is in days (or None if not set).

3. Enforce Yearly Rotation (365 Days)​

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
identity_client = oci.identity.IdentityClient(config)
tenancy_id = config["tenancy"]

# Get existing policy object
authn_policy = identity_client.get_authentication_policy(tenancy_id).data

# Copy current password policy and adjust lifetime
password_policy = authn_policy.password_policy

# Set to 365 days (yearly rotation)
password_policy.password_lifetime = 365

update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
    password_policy=password_policy
)

response = identity_client.update_authentication_policy(
    tenancy_id,
    update_details
)

print("Updated password_lifetime to:", response.data.password_policy.password_lifetime)

This directly remediates the misconfiguration by enforcing yearly rotation.

4. Turn It into “Monitoring + Auto-Remediation”​

A minimal monitoring script that:

  • Checks if password_lifetime is 365
  • If not, sets it to 365 and logs the action
import oci
import datetime

TARGET_LIFETIME = 365

def enforce_password_rotation(config_profile="DEFAULT"):
    config = oci.config.from_file("~/.oci/config", config_profile)
    identity_client = oci.identity.IdentityClient(config)
    tenancy_id = config["tenancy"]

    authn_policy = identity_client.get_authentication_policy(tenancy_id).data
    password_policy = authn_policy.password_policy

    current_lifetime = password_policy.password_lifetime
    print(f"[{datetime.datetime.utcnow().isoformat()}] Current password_lifetime: {current_lifetime}")

    if current_lifetime == TARGET_LIFETIME:
        print("Compliant. No change needed.")
        return

    password_policy.password_lifetime = TARGET_LIFETIME
    update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
        password_policy=password_policy
    )

    response = identity_client.update_authentication_policy(
        tenancy_id,
        update_details
    )

    print(f"Updated password_lifetime to {response.data.password_policy.password_lifetime}")

if __name__ == "__main__":
    enforce_password_rotation()

Run this script on a schedule (e.g., cron, OCI Scheduled Tasks via Functions/Events) to continuously monitor and auto-remediate the password policy.

If you want, I can adapt this into an OCI Function (with func.yaml and handler) for fully managed monitoring.

Using Terraform
resource "oci_identity_password_policy" "iam_password_policy" {
  # Replace with your tenancy OCID
  compartment_id = "TENANCY_OCID"

  # Existing settings (examples – keep or adjust to match your policy)
  minimum_password_length          = 14
  is_lowercase_characters_required = true
  is_uppercase_characters_required = true
  is_numeric_characters_required   = true
  is_special_characters_required   = true
  is_username_containment_allowed  = false
  allowed_attempts                 = 5
  is_password_reset_required       = false

  # Fix: enforce password expiration within 365 days
  is_password_expires     = true
  password_expires_in_days = 365
}

This change updates the existing IAM password policy in place (no resource replacement or outage). After applying, terraform plan should show an in-place update to is_password_expires = true and password_expires_in_days = 365 on oci_identity_password_policy.iam_password_policy.