Skip to main content

OCI IAM Password Policy Should Require Minimum 14 Characters

More Info:​

The OCI IAM password policy should enforce a minimum password length of 14 characters. Short passwords are vulnerable to brute-force attacks and dictionary-based cracking

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Here’s how to set the IAM password policy to require a minimum of 14 characters in OCI using the Console:

  1. Sign in to OCI Console
    Log in to the Oracle Cloud Console with an account that has tenancy-level IAM admin privileges (e.g., Administrator group).

  2. Go to Identity & Security

    • Open the Navigation menu (≡) in the top left.
    • Under Identity & Security, click Domains (or Identity > Domains depending on your Console layout).

  3. Select the Target Domain

    • You’ll see a list of identity domains (or the default one if you’re using the older model).
    • Click the identity domain where your users are managed (often Default).

  4. Open Security Settings

    • In the domain page, in the left-hand menu, click Security.
    • Under Security, click Password Policies (or Password policy).

  5. Edit the Password Policy

    • On the Password Policy page, click Edit (or the pencil icon).

  6. Set Minimum Password Length to 14

    • Find the field Minimum password length (or similar).
    • Change the value to 14.
    • Review other password policy settings (complexity, reuse, lockout) as needed, but not required for this specific control.

  7. Save the Policy

    • Click Save or Save changes.
    • The new minimum length applies to all new password changes and resets in that identity domain.

  8. (Optional) Re-check in Monitoring/Cloud Guard

    • If you’re using Cloud Guard or another OCI monitoring tool/policy that flagged this misconfiguration, wait a few minutes and re-run the check or assessment to confirm the issue is resolved.

If your tenancy still uses the older “Identity > Security > Password Policy” layout at tenancy level, the steps are the same conceptually:
Navigation menu → Identity & Security → Security → Password Policy → Edit → Set minimum length to 14 → Save.

Using CLI

To enforce a minimum 14-character password policy in OCI IAM using the OCI CLI, do the following:

1. Prerequisites​

  • OCI CLI installed and configured (oci setup config)
  • You have permission to manage the tenancy’s authentication policy (e.g., identity-domains-authentication-policies or tenancy admin).

2. Get Your Tenancy OCID​

If you don’t already have it:

oci iam tenancy get --tenancy-id <your-tenancy-ocid>

(or copy it from the Console: Profile → Tenancy: <name> → OCID)

3. View Current Authentication Policy​

oci iam authentication-policy get \
  --compartment-id <your-tenancy-ocid>

Look at the output under passwordPolicy. You’ll see fields like minimumPasswordLength, isLowercaseCharactersRequired, etc.

4. Update Password Policy to Require Minimum 14 Characters​

You can either:

Option A – Provide full password policy JSON inline​

If you want to explicitly define the full policy (recommended when you know the desired settings):

oci iam authentication-policy update \
  --compartment-id <your-tenancy-ocid> \
  --password-policy '{
    "isLowercaseCharactersRequired": true,
    "isUppercaseCharactersRequired": true,
    "isNumericCharactersRequired": true,
    "isSpecialCharactersRequired": true,
    "minimumPasswordLength": 14,
    "isUsernameContainmentAllowed": false
  }'

Adjust booleans as needed, but keep "minimumPasswordLength": 14.

Option B – Modify only the minimum length (using a file)​

  1. Save the existing policy from step 3 into a file (for example, auth-policy.json) and edit it:
    • Under "passwordPolicy", set: 
      "minimumPasswordLength": 14
  2. Apply the updated policy: 
    oci iam authentication-policy update \
      --compartment-id <your-tenancy-ocid> \
      --from-json file://auth-policy.json

5. Verify the Change​

Run:

oci iam authentication-policy get \
  --compartment-id <your-tenancy-ocid> \
  --query "authenticationPolicy.passwordPolicy.minimumPasswordLength" \
  --raw-output

This should return:

14

That enforces a minimum 14-character password policy in OCI IAM via OCI CLI.

Using Python

To enforce a minimum 14-character password policy in OCI IAM using Python, you need to update the tenancy’s Authentication Policy via the OCI Python SDK.

1. Prerequisites​

  1. Install OCI Python SDK (if not already):

    pip install oci

  2. Configure OCI CLI/SDK config (tenancy OCID, user OCID, key, region, etc.), usually at: ~/.oci/config with a profile, e.g. [DEFAULT].

  3. Your user must have IAM permissions similar to:

    ALLOW GROUP <Your-Admin-Group> TO MANAGE authentication-policies IN TENANCY

2. Find Your Tenancy OCID​

You can get it from the OCI Console:

  • Profile (top-right) → Tenancy: click it → copy OCID.

Or from your config file:

[DEFAULT]
tenancy=ocid1.tenancy.oc1......

3. Python Code: Update Password Policy to Minimum 14 Characters​

import oci

# 1. Load config and create Identity client
config = oci.config.from_file("~/.oci/config", "DEFAULT")  # adjust path/profile as needed
identity_client = oci.identity.IdentityClient(config)

tenancy_id = config["tenancy"]

# 2. Get existing authentication policy (optional but recommended)
current_policy = identity_client.get_authentication_policy(tenancy_id).data

# 3. Prepare updated password policy
password_policy = current_policy.password_policy or oci.identity.models.PasswordPolicy()

# Set minimum length to 14
password_policy.minimum_password_length = 14

# (Optional) Leave other existing fields intact, e.g.:
# password_policy.is_numeric_characters_required = current_policy.password_policy.is_numeric_characters_required
# password_policy.is_uppercase_characters_required = current_policy.password_policy.is_uppercase_characters_required
# etc.

# 4. Build update payload
update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
    password_policy=password_policy
)

# 5. Call update_authentication_policy
response = identity_client.update_authentication_policy(
    tenancy_id=tenancy_id,
    update_authentication_policy_details=update_details
)

print("Updated password minimum length to:",
      response.data.password_policy.minimum_password_length)

4. Notes for “Monitoring / Auto-remediation”​

If this is driven by a monitoring system (e.g., a Cloud Security Posture tool) and you want auto-remediation:

  • Wrap this script into:
    • An OCI Function, or
    • A scheduled OCI DevOps/cron job, or
    • An external scheduler (Jenkins, GitHub Actions, etc.)
  • Trigger it whenever a misconfiguration is detected (e.g., from a security scan event, webhook, or scheduled check).
  • Optionally first check and only update if minimum_password_length < 14.

Example quick check:

current_min = current_policy.password_policy.minimum_password_length
if current_min is None or current_min < 14:
    # run the update code shown above

This ensures your OCI IAM password policy always requires at least 14 characters.

Using Terraform
resource "oci_identity_authentication_policy" "iam_password_policy" {
  # Replace with your tenancy OCID (password policy is defined at the tenancy level)
  compartment_id = TENANCY_OCID

  password_policy {
    # Enforce minimum password length of 14 characters
    minimum_password_length = 14

    # Keep or adjust any other existing settings as needed, for example:
    # is_numeric_characters_required      = true
    # is_lowercase_characters_required    = true
    # is_uppercase_characters_required    = true
    # is_special_characters_required      = true
    # is_username_containment_allowed     = false
    # is_password_reuse_prevented         = true
    # password_lockout_duration           = 30
    # max_login_attempts                  = 5
  }
}

This updates the tenancy-level IAM password policy without forcing replacement of the resource; it will be an in‑place update.

Verification with terraform plan should show an in-place update in-place on oci_identity_authentication_policy.iam_password_policy with minimum_password_length changing from its current value to 14.