Skip to main content

OCI IAM Password Policy Should Require Uppercase Characters

More Info:​

The OCI IAM password policy should require at least one uppercase character. Mixed-case passwords provide greater entropy and are harder for attackers to guess

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Startup Security Baseline
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • GDPR
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIST
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Cyber Security Framework
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To require uppercase characters in OCI IAM passwords using the OCI Console:

  1. Sign in to OCI Console
    Log in with a user that has tenancy-level / domain admin privileges.

  2. Go to Identity Domains

    • Open the hamburger menu (☰) in the top-left.
    • Navigate to: Identity & Security → Domains.

  3. Select the Appropriate Identity Domain

    • Click on the identity domain you use for your IAM users (often named Default unless you created others).

  4. Open the Password Policy Settings

    • In the left-hand menu for that domain, go to:
      Security → Password Policy
      (In some UIs, it may be under Security → Authentication Settings → Password Policy.)

  5. Edit the Password Policy

    • Click Edit (or Edit Password Policy).

  6. Enable Uppercase Requirement

    • Locate the setting similar to:
      • Require uppercase letters / Minimum uppercase characters.
    • Turn on Require uppercase letters (or set minimum uppercase characters to at least 1).

  7. Save Changes

    • Click Save / Update to apply the new policy.

  8. Verify

    • Try creating or changing a test user’s password: the UI should now enforce at least one uppercase character.

If you are using an older tenancy without identity domains, check:
Identity & Security → Security → Authentication Settings → Password Policy, then enable Require Uppercase Characters there and save.

Using CLI

To enforce “Require Uppercase Characters” in the OCI IAM password policy using the OCI CLI, do the following:

1. Prerequisites​

  • OCI CLI installed and configured (oci setup config)
  • You know your tenancy OCID (from Console: Profile → Tenancy Details)

2. Get current authentication (password) policy​

TENANCY_OCID="<your_tenancy_ocid>"

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data' \
  > current-auth-policy.json

This file contains the existing password policy.

3. Edit the password policy JSON​

Open current-auth-policy.json and locate the passwordPolicy block.
Ensure it contains "isUppercaseCharactersRequired": true.

Example minimal structure:

{
  "compartmentId": "ocid1.tenancy.oc1....",
  "passwordPolicy": {
    "isUppercaseCharactersRequired": true
  }
}

If other passwordPolicy fields exist (length, numeric, lowercase, etc.), keep them as-is and only change/add isUppercaseCharactersRequired.

4. Update the authentication policy with OCI CLI​

Save your edited JSON as updated-auth-policy.json, then run:

oci iam authentication-policy update \
  --compartment-id "$TENANCY_OCID" \
  --authentication-policy file://updated-auth-policy.json

5. Verify the change​

oci iam authentication-policy get \
  --compartment-id "$TENANCY_OCID" \
  --query 'data.passwordPolicy'

Confirm the output shows:

"isUppercaseCharactersRequired": true

This will remediate the “OCI IAM Password Policy Should Require Uppercase Characters” finding used by OCI IAM/Cloud Guard monitoring.

Using Python

To fix “OCI IAM Password Policy Should Require Uppercase Characters” using Python, you need to update the tenancy’s Authentication Policy via the OCI Python SDK.

Below are step-by-step instructions and a sample remediation script.

1. Prerequisites​

  1. Install the OCI Python SDK:

    pip install oci

  2. Configure your ~/.oci/config with a profile that has IAM permissions on the tenancy (e.g., Tenancy Admin or a policy allowing MANAGE authentication-policies on the tenancy):

    [DEFAULT]
    user=ocid1.user.oc1..aaaa...
    fingerprint=xx:xx:xx:...
    key_file=/path/to/oci_api_key.pem
    tenancy=ocid1.tenancy.oc1..aaaa...
    region=us-ashburn-1

2. Python Script to Enforce Uppercase Requirement​

This script:

  • Fetches current authentication (password) policy.
  • Sets is_uppercase_characters_required to True (and preserves other settings).
  • Updates the tenancy authentication policy if needed.
import oci

# CONFIG
PROFILE_NAME = "DEFAULT"  # or your profile name in ~/.oci/config

def main():
    # Load config
    config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
    tenancy_ocid = config["tenancy"]

    # Create IdentityClient
    identity_client = oci.identity.IdentityClient(config)

    # 1. Get current authentication policy
    current_policy_response = identity_client.get_authentication_policy(tenancy_ocid)
    current_policy = current_policy_response.data

    password_policy = current_policy.password_policy

    # 2. If password_policy is None, initialize it
    if password_policy is None:
        password_policy = oci.identity.models.PasswordPolicy()

    # 3. Check if uppercase requirement is already enabled
    if password_policy.is_uppercase_characters_required:
        print("Uppercase characters are already required in the password policy.")
        return

    # 4. Set uppercase requirement to True
    password_policy.is_uppercase_characters_required = True

    # NOTE: We keep all other existing properties as they are

    # 5. Prepare update payload
    update_details = oci.identity.models.UpdateAuthenticationPolicyDetails(
        password_policy=password_policy
    )

    # 6. Update authentication policy
    update_response = identity_client.update_authentication_policy(
        tenancy_id=tenancy_ocid,
        update_authentication_policy_details=update_details
    )

    print("Updated authentication policy. New settings:")
    print(update_response.data)

if __name__ == "__main__":
    main()

3. How to Use This for “Monitoring + Remediation”​

  • Monitoring:

    • Run the “get” part (get_authentication_policy) on a schedule (e.g., via a cron job, OCI Functions, or OCI DevOps pipeline).
    • If password_policy.is_uppercase_characters_required is False, log an alert (or push a metric/event).

  • Auto-remediation:

    • Keep the script as is and run it on a schedule or trigger it from an OCI Function when a detector (e.g., from OCI Cloud Guard or your own check) finds the misconfiguration.
    • The script is idempotent: if uppercase is already required, it does nothing.

If you’re using OCI Identity Domains (not classic IAM) and need the equivalent for a specific identity domain, say so and I’ll provide the Identity Domains version of the Python code.

Using Terraform
resource "oci_identity_authentication_policy" "iam_password_policy" {
  # Replace with your tenancy OCID
  compartment_id = "OCID_OF_TENANCY"

  password_policy {
    # Keep existing settings as they are in your environment,
    # only change the uppercase requirement to true.
    is_uppercase_characters_required = true

    # EXAMPLES of other commonly configured attributes; keep or adjust
    # to match your current policy, do not blindly copy:
    # minimum_password_length        = 14
    # is_lowercase_characters_required = true
    # is_numeric_characters_required   = true
    # is_special_characters_required   = true
    # is_username_containment_allowed  = false
    # password_expiration_in_days      = 90
    # minimum_password_difference      = 4
  }
}

This change is an in-place update of the IAM authentication (password) policy and does not force resource replacement.

For verification, terraform plan should show an in-place update (~) to oci_identity_authentication_policy.iam_password_policy with is_uppercase_characters_required changing from false (or null) to true.