Skip to main content

OCI IAM Password Policy Should Require Special Characters

More Info:​

The OCI IAM password policy should require at least one special character (symbol). Special characters dramatically increase password complexity and resistance to automated cracking

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To require special characters in the OCI IAM password policy via the OCI Console:

  1. Sign in
    Log in to the OCI Console with a user that has tenancy-level IAM admin permissions.

  2. Go to Identity Domains

    • In the left navigation menu, click Identity & Security.
    • Click Domains (or Identity Domains, depending on your console view).

  3. Select the domain

    • Click your main identity domain (often named Default or similar, where your IAM users reside).

  4. Open the Password Policy

    • In the domain details page, go to Security.
    • Click Password Policy (or similar “Password” / “Authentication” settings option).

  5. Edit the policy

    • Click Edit (or the equivalent action button for modifying the password policy).
    • Locate the setting for special characters, often labeled like:
      • Require special characters or
      • Minimum number of special characters

  6. Enable special characters requirement

    • Check Require special characters (or set the Minimum number of special characters to at least 1).
    • Optionally, review and adjust other password settings if needed (length, numbers, uppercase, etc.).

  7. Save changes

    • Click Save or Update to apply the new password policy.

  8. Confirm application

    • Verify the updated policy is visible in the Password Policy page.
    • New password changes/resets will now require special characters for users in this identity domain.
Using CLI

Below is how to enforce “special characters required” in the OCI IAM password policy using the OCI CLI.

1. Prerequisites​

  • OCI CLI installed and configured (oci setup config)
  • You have the tenancy OCID and permissions to modify IAM authentication policy.

Tenancy OCID is usually in your config file as tenancy= or visible in the console under: Profile → Tenancy Information.

2. (Optional) View the current password policy​

TENANCY_OCID="<your-tenancy-ocid>"

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID"

Look at the passwordPolicy block to see current settings.

3. Update the password policy to require special characters​

You must submit the full passwordPolicy object, not just the changed field. Example with strong defaults:

TENANCY_OCID="<your-tenancy-ocid>"

oci iam authentication-policy update \
  --compartment-id "$TENANCY_OCID" \
  --authentication-policy '{
    "passwordPolicy": {
      "isLowercaseCharactersRequired": true,
      "isUppercaseCharactersRequired": true,
      "isNumericCharactersRequired": true,
      "isSpecialCharactersRequired": true,
      "minimumPasswordLength": 14,
      "isUsernameContainmentAllowed": false
    }
  }'

Key field for your finding:

  • "isSpecialCharactersRequired": true

Adjust other fields (length, numeric, etc.) as needed for your environment.

4. Confirm the change​

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query "data.\"authentication-policy\".passwordPolicy" \
  --output table

Verify isSpecialCharactersRequired is true.

Using Python

Below is a minimal, end‑to‑end way to check and remediate the OCI IAM password policy so that special characters are required, using Python and the OCI SDK.

1. Prerequisites​

  1. Install the OCI Python SDK:

    pip install oci

  2. Ensure you have an OCI config file (usually at ~/.oci/config) with:

    • user
    • fingerprint
    • key_file
    • tenancy
    • region

    And a profile (e.g., DEFAULT).

  3. The user/principal running this must have permission to:

    identity-domains UPDATE_AUTHENTICATION_POLICY
    identity-domains READ_AUTHENTICATION_POLICY

    or equivalent IAM policies, e.g.:

    Allow group <your-group> to manage authentication-policies in tenancy

2. Python Script: Monitor & Remediate Special Character Requirement​

This script:

  1. Reads the current authentication (password) policy at the tenancy level.
  2. Checks whether is_special_characters_required is True.
  3. If not, updates the policy to set it to True (leaving other settings unchanged).
import oci

def main():
    # Load config
    config = oci.config.from_file("~/.oci/config", "DEFAULT")
    tenancy_id = config["tenancy"]

    identity_client = oci.identity.IdentityClient(config)

    # 1. Get current authentication policy
    auth_policy = identity_client.get_authentication_policy(tenancy_id).data
    current_password_policy = auth_policy.password_policy

    # If there's no password policy yet, create a default one object
    if current_password_policy is None:
        from oci.identity.models import PasswordPolicy
        current_password_policy = PasswordPolicy()

    # 2. Check if special characters are already required
    if getattr(current_password_policy, "is_special_characters_required", None):
        print("Password policy already requires special characters. No change needed.")
        return

    print("Special characters are NOT required. Remediating...")

    # 3. Build a new password policy object, keeping existing values
    from oci.identity.models import AuthenticationPolicy, PasswordPolicy

    new_password_policy = PasswordPolicy(
        # Keep current values if present, otherwise leave as None
        minimum_password_length=current_password_policy.minimum_password_length,
        is_uppercase_characters_required=current_password_policy.is_uppercase_characters_required,
        is_lowercase_characters_required=current_password_policy.is_lowercase_characters_required,
        is_numeric_characters_required=current_password_policy.is_numeric_characters_required,

        # This is the key remediation:
        is_special_characters_required=True,

        is_username_containment_allowed=current_password_policy.is_username_containment_allowed,
        is_password_expires=current_password_policy.is_password_expires,
        password_expires_in_days=current_password_policy.password_expires_in_days,
        is_lockout_enabled=current_password_policy.is_lockout_enabled,
        maximum_failed_login_attempts=current_password_policy.maximum_failed_login_attempts,
    )

    # 4. Build the authentication policy details
    auth_policy_details = AuthenticationPolicy(
        password_policy=new_password_policy
    )

    # 5. Update the authentication policy
    response = identity_client.update_authentication_policy(
        tenancy_id,
        update_authentication_policy_details=auth_policy_details
    )

    print("Updated authentication policy. Special characters are now required.")
    print("New policy:", response.data.password_policy)


if __name__ == "__main__":
    main()

3. Turn This Into “Monitoring + Auto-Remediation”​

To use this as a monitoring/remediation job:

  • Run it on a schedule (e.g., OCI Functions, OCI DevOps Pipeline, or a cron job on a bastion/CI server).
  • Optionally:
    • Log when a remediation is performed.
    • Send notifications (via OCI Notifications/Email) when a change was needed.

This ensures your OCI IAM password policy always enforces special characters.

Using Terraform
resource "oci_identity_authentication_policy" "iam_password_policy" {
  # Replace with your root compartment (tenancy) OCID, or the compartment whose policy you manage
  compartment_id = "OCID_OF_TENANCY_OR_COMPARTMENT"

  password_policy {
    # Keep existing requirements as they are; only set this to true to meet the finding
    is_special_characters_required = true

    # Example of other commonly-used settings (leave as-is if you already manage them):
    # is_lowercase_characters_required = true
    # is_uppercase_characters_required = true
    # is_numeric_characters_required  = true
    # minimum_password_length         = 14
    # is_username_containment_allowed = false
    # is_first_name_containment_allowed = false
    # is_last_name_containment_allowed  = false
  }
}

This updates the IAM password policy so that passwords must include at least one special character; it is an in-place update and does not replace the resource.

After you add or modify this resource, terraform plan should show an in-place update to oci_identity_authentication_policy.iam_password_policy with is_special_characters_required changing from false (or unset) to true.