Skip to main content

OCI IAM Password Policy Should Require Numeric Characters

More Info:​

The OCI IAM password policy should require at least one numeric character. Including numbers in passwords increases the keyspace and strengthens protection against brute-force attacks

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To require numeric characters in the OCI IAM password policy using the OCI Console:

  1. Sign in to the OCI Console
    Log in with an account that has tenancy-level administrator or security admin privileges.

  2. Go to Identity Domains

    • Open the navigation menu (☰).
    • Select Identity & Security (or Identity & Security → Identity depending on your console layout).
    • Click Domains.
    • Click the identity domain where your IAM users reside (often named Default).

  3. Open Password Policy Settings
    Inside the selected domain:

    • In the left-hand menu, go to Security.
    • Click Password policy (or Authentication settings → Password policy if shown that way).

  4. Enable Numeric Character Requirement
    In the password policy configuration:

    • Locate the option similar to Require numbers in passwords or Must contain at least one number.
    • Check or toggle this option ON.
    • Confirm or adjust related fields if present (for example, minimum password length, uppercase, lowercase, special characters) to match your security standards.

  5. Save the Policy

    • Click Save, Update, or Apply (button text may vary slightly).
    • Confirm any prompt indicating that the new policy will apply to all future password changes/resets for users in this domain.

  6. (Optional) Validate via IAM Monitoring / Security Posture

    • If you use OCI Cloud Guard or Security Zones for monitoring:
      • Go to Navigation menu → Identity & Security → Cloud Guard.
      • Ensure the target (tenancy/compartment) including this identity domain is monitored.
      • Check that the IAM Password Policy detector family (or equivalent) is enabled so future drift (e.g., disabling numeric requirement) will raise a new problem.

Once saved, new and changed passwords must include at least one numeric character, resolving the “OCI IAM Password Policy Should Require Numeric Characters” finding.

Using CLI

To require numeric characters in OCI IAM passwords via OCI CLI, update the tenancy’s authentication policy.

1. Prereqs​

  • OCI CLI configured (oci setup config)
  • Your tenancy OCID (from Console: Profile → Tenancy Information).

2. Get current password policy​

TENANCY_OCID="<your_tenancy_ocid>"

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data."authentication-policy"' \
  --output json > current-auth-policy.json

This file will contain something like:

{
  "passwordPolicy": {
    "isLowercaseCharactersRequired": true,
    "isUppercaseCharactersRequired": true,
    "isNumericCharactersRequired": false,
    "isSpecialCharactersRequired": false,
    "isUserNameContainmentAllowed": false,
    "minimumPasswordLength": 12,
    "isFirstNameContainmentAllowed": false,
    "isLastNameContainmentAllowed": false
  }
}

3. Edit the policy to require numeric characters​

Open current-auth-policy.json and set:

"isNumericCharactersRequired": true

Ensure you keep all other existing fields as they are; OCI expects the full object.

The final file should look like:

{
  "passwordPolicy": {
    "isLowercaseCharactersRequired": true,
    "isUppercaseCharactersRequired": true,
    "isNumericCharactersRequired": true,
    "isSpecialCharactersRequired": false,
    "isUserNameContainmentAllowed": false,
    "minimumPasswordLength": 12,
    "isFirstNameContainmentAllowed": false,
    "isLastNameContainmentAllowed": false
  }
}

Save as updated-auth-policy.json.

4. Apply the updated authentication policy​

oci iam authentication-policy update \
  --compartment-id "$TENANCY_OCID" \
  --authentication-policy file://updated-auth-policy.json

5. Verify​

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data."authentication-policy".passwordPolicy.isNumericCharactersRequired'

Should return true.

This change will cause new/changed passwords in that tenancy to require at least one numeric character, which will clear the related IAM monitoring / compliance finding.

Using Python

To require numeric characters in the OCI IAM password policy using Python, you need to update the tenancy’s Authentication Policy via the OCI Python SDK.

Below are the minimal, step‑by‑step instructions.

1. Prerequisites​

  1. Install OCI Python SDK:
pip install oci
  1. Ensure you have an OCI config file (usually ~/.oci/config) with:
  • Tenancy OCID
  • User OCID
  • API key + fingerprint
  • Region
  • A profile name (e.g., DEFAULT)

2. Get Your Tenancy OCID​

You can find it in:

  • OCI Console → Governance & Administration → Tenancy details
    or in your ~/.oci/config as tenancy=.

You must pass this tenancy OCID to the script.

3. Python Script to Enable Numeric Characters in Password Policy​

This script:

  • Fetches the current authentication policy
  • Sets is_numeric_characters_required = True
  • Preserves all other existing password-policy settings
import oci

# Change if you use a non-default profile
OCI_PROFILE = "DEFAULT"

# Replace with your tenancy OCID
TENANCY_OCID = "<your-tenancy-ocid>"

def main():
    # Create config & client
    config = oci.config.from_file("~/.oci/config", OCI_PROFILE)
    identity_client = oci.identity.IdentityClient(config)

    # 1. Get current authentication policy
    current_policy = identity_client.get_authentication_policy(TENANCY_OCID).data

    # 2. Build updated password policy, preserving current values
    current_pw = current_policy.password_policy

    updated_password_policy = oci.identity.models.UpdatePasswordPolicyDetails(
        minimum_password_length=current_pw.minimum_password_length,
        is_uppercase_characters_required=current_pw.is_uppercase_characters_required,
        is_lowercase_characters_required=current_pw.is_lowercase_characters_required,
        is_numeric_characters_required=True,  # <-- ENFORCE NUMERIC CHARACTERS
        is_special_characters_required=current_pw.is_special_characters_required,
        is_username_containment_allowed=current_pw.is_username_containment_allowed,
        is_password_expiration_enabled=current_pw.is_password_expiration_enabled,
        password_expiration_in_days=current_pw.password_expiration_in_days,
        is_password_expiration_warning_enabled=current_pw.is_password_expiration_warning_enabled,
        password_expiration_warning_in_days=current_pw.password_expiration_warning_in_days,
        is_lockout_enabled=current_pw.is_lockout_enabled,
        lockout_duration_in_seconds=current_pw.lockout_duration_in_seconds,
        max_login_attempts=current_pw.max_login_attempts,
    )

    # 3. Build full authentication policy update
    update_auth_policy_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
        password_policy=updated_password_policy
    )

    # 4. Update the tenancy authentication policy
    response = identity_client.update_authentication_policy(
        TENANCY_OCID,
        update_auth_policy_details
    )

    print("Updated authentication policy:")
    print(response.data)

if __name__ == "__main__":
    main()

4. Verification​

  1. In the OCI Console, go to:
    • Identity & Security → Domains (or Identity → Authentication Policy, depending on tenancy type)
    • Check the password policy for the tenancy.
  2. Confirm “Require numbers” / numeric characters is enabled.

5. Integrating with Monitoring / Compliance​

If you’re using a monitoring/compliance tool (e.g., custom script, Cloud Guard target):

  • Run this Python code as a remediation step when a rule detects that is_numeric_characters_required is False.
  • Optional: add a pre-check snippet that only calls update_authentication_policy if the flag is currently False (to keep it idempotent).
Using Terraform
resource "oci_identity_password_policy" "iam_password_policy" {
  # Replace with your tenancy OCID (root compartment)
  compartment_id = "OCID_OF_TENANCY"

  # Existing / required settings (examples – keep your current values)
  minimum_password_length          = 12
  is_lowercase_characters_required = true
  is_uppercase_characters_required = true
  is_special_characters_required   = true

  # Fix: require at least one numeric character in passwords
  is_numeric_characters_required = true

  # Other optional settings – include as needed, matching your current policy
  # is_username_containment_allowed = false
  # is_reuse_prevention             = 5
}

This change does not force replacement of the resource; it updates the existing tenancy password policy in place.

To verify, terraform plan should show an in‑place update (~) of oci_identity_password_policy.iam_password_policy with is_numeric_characters_required changing from false (or unset) to true.