OCI IAM Password Policy Should Enforce Strong Requirements

More Info:

The IAM password policy should enforce strong requirements including minimum 14 characters, uppercase, lowercase, numbers, and special characters. Weak policies allow easily compromised passwords.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Startup Security Baseline
AWS Well Architected Framework
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS AWS
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
GDPR
HIPAA
HITRUST CSF
ISO 27001
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIST
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
Reserve Bank of India (RBI) Cyber Security Framework
Reserve Bank of India (RBI) Master Direction – Information Technology Framework
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate “OCI IAM Password Policy Should Enforce Strong Requirements” using the OCI Console, you need to tighten the password policy on your Identity Domain(s).

Follow these steps:

Sign in to OCI Console
- Log in as a user with permissions to manage identity domains (e.g., tenancy admin).
Open the Identity Domain
- In the left menu, go to:
  Identity & Security → Domains
- Click the Identity Domain you are using for your users (for most environments this is the “Default” domain unless you created others).
Go to Password Policy Settings
- Inside the domain, in the left pane, select:
  Security → Password Policy
Configure Strong Password Requirements
Adjust settings to meet strong requirements (and typically satisfy OCI Cloud Guard / security checks), for example:
- Minimum password length: set to at least 12 (or your org standard, often ≥ 12–14).
- Require character types (enable all):
  - Require uppercase letters
  - Require lowercase letters
  - Require numbers
  - Require special characters
- Password history: keep users from reusing passwords (e.g., remember last 5–10 passwords).
- Password expiration: set to expire after a period (e.g., 90 days or as per policy).
- Account lockout:
  - Lock account after X failed attempts (e.g., 5).
  - Set lockout duration or require admin unlock (per your policy).
- Disallow username or parts of name in password if that option is available in your tenancy.
Save the Policy
- Click Save (or Save changes) at the bottom of the page.
Verify Remediation (Optional but Recommended)
- If you are using Cloud Guard, ensure the relevant Detector Recipe for IAM password policy is enabled.
- After the policy is updated, allow a few minutes and then:
  - Go to Cloud Guard → Detector Recipes / Problems
  - Confirm that the “IAM Password Policy Should Enforce Strong Requirements” problem is no longer listed (or has been resolved) for that domain.

Repeat the same steps for each Identity Domain where local users are managed, if you have more than one.

Using CLI

Below are the concise steps to remediate “OCI IAM Password Policy Should Enforce Strong Requirements” using the OCI CLI.

Assumptions:

You’re using OCI IAM (classic), not Identity Domains.
You have tenancy OCID and OCI CLI already configured (oci setup config).

1. Get your Tenancy OCID (if you don’t already have it)

If you don’t know it, from CLI:

oci iam compartment list --compartment-id-in-subtree false \
  --access-level ACCESSIBLE --all \
  --query "data[?\"compartment-id\"=='null'].id | [0]" \
  --raw-output

Or look it up in the Console:
Profile → Tenancy: the OCID is shown there.

Let’s call it:

TENANCY_OCID="<your_tenancy_ocid>"

2. Check the current password policy

oci iam password-policy get \
  --compartment-id "$TENANCY_OCID"

Review the output to see existing settings.

3. Define a strong password policy in JSON

Create a file password_policy.json with strong requirements, e.g.:

{
  "minimumPasswordLength": 14,
  "isUppercaseCharactersRequired": true,
  "isLowercaseCharactersRequired": true,
  "isNumericCharactersRequired": true,
  "isSpecialCharactersRequired": true,
  "isUserNameContainedDenied": true,
  "isFirstNameContainedDenied": true,
  "isLastNameContainedDenied": true,
  "minimumNumericCharacters": 1,
  "minimumSpecialCharacters": 1,
  "passwordReusePrevention": 10,
  "passwordExpiryInDays": 90,
  "isLockoutEffective": true,
  "maximumIncorrectAttempts": 5,
  "lockoutDurationInSeconds": 900
}

Adjust values per your policy if needed.

4. Update the password policy using OCI CLI

oci iam password-policy update \
  --compartment-id "$TENANCY_OCID" \
  --policy "file://password_policy.json"

5. Verify the updated policy

oci iam password-policy get \
  --compartment-id "$TENANCY_OCID"

Confirm the returned fields match your strong requirements.

If you share the exact policy standard you must meet (e.g., CIS, internal policy), I can provide a JSON snippet tailored to that.

Using Python

To enforce a strong OCI IAM password policy and monitor/remediate it using Python, you’ll:

Read the current authentication (password) policy.
Compare it to your required “strong” standards.
If it’s weaker, update it via the OCI Python SDK.

Below is a concise, end‑to‑end example.

1. Prerequisites

OCI Python SDK installed:
```
pip install oci
```
A config file (default: ~/.oci/config) with a profile that has identity:AUTHENTICATION_POLICY_UPDATE permission on the tenancy.

Example policy in IAM:

Allow group SecurityAdmins to manage authentication-policies in tenancy

2. Decide Your “Strong” Password Requirements

Example strong policy (adjust as needed):

Minimum length: 14
Require lowercase, uppercase, numbers, special characters
Disallow username in password
Optional: set password hard expiry, etc.

3. Python Script: Monitor and Remediate Password Policy

import oci
from oci.identity import IdentityClient
from oci.identity.models import UpdateAuthenticationPolicyDetails, PasswordPolicy

# -------- CONFIGURE THESE VALUES --------
PROFILE_NAME = "DEFAULT"  # profile in ~/.oci/config
MIN_LENGTH = 14
REQUIRE_LOWERCASE = True
REQUIRE_UPPERCASE = True
REQUIRE_NUMERIC = True
REQUIRE_SPECIAL = True
ALLOW_USERNAME_CONTAINMENT = False
# ----------------------------------------


def get_identity_client(profile=PROFILE_NAME):
    config = oci.config.from_file("~/.oci/config", profile_name=profile)
    return IdentityClient(config), config["tenancy"]


def is_policy_strong(current_policy: PasswordPolicy) -> bool:
    """
    Returns True if the current policy meets or exceeds the desired standards.
    """
    # Handle None (no policy set yet)
    if current_policy is None:
        return False

    checks = [
        (current_policy.minimum_password_length or 0) >= MIN_LENGTH,
        bool(current_policy.is_lowercase_characters_required) == REQUIRE_LOWERCASE,
        bool(current_policy.is_uppercase_characters_required) == REQUIRE_UPPERCASE,
        bool(current_policy.is_numeric_characters_required) == REQUIRE_NUMERIC,
        bool(current_policy.is_special_characters_required) == REQUIRE_SPECIAL,
        bool(current_policy.is_username_containment_allowed) == ALLOW_USERNAME_CONTAINMENT,
    ]

    return all(checks)


def build_strong_policy() -> PasswordPolicy:
    """
    Build the desired strong password policy object.
    """
    return PasswordPolicy(
        minimum_password_length=MIN_LENGTH,
        is_lowercase_characters_required=REQUIRE_LOWERCASE,
        is_uppercase_characters_required=REQUIRE_UPPERCASE,
        is_numeric_characters_required=REQUIRE_NUMERIC,
        is_special_characters_required=REQUIRE_SPECIAL,
        is_username_containment_allowed=ALLOW_USERNAME_CONTAINMENT,
        # Optional extras; set as needed:
        # is_password_hard_expiry_enabled=True,
        # is_password_expiry_notifications_enabled=True,
        # is_api_keys_cleanup_enabled=True,
        # is_oauth_client_certificates_cleanup_enabled=True,
        # is_smtp_credential_cleanup_enabled=True,
    )


def ensure_strong_password_policy():
    identity_client, tenancy_id = get_identity_client()

    # 1. Get current authentication (password) policy
    current_auth_policy = identity_client.get_authentication_policy(
        compartment_id=tenancy_id
    ).data

    current_password_policy = current_auth_policy.password_policy

    # 2. Check if it already meets strong requirements
    if is_policy_strong(current_password_policy):
        print("Password policy already meets strong requirements. No change needed.")
        return

    print("Password policy is weak or missing. Updating to strong policy…")

    # 3. Build the new strong policy
    new_policy = build_strong_policy()

    update_details = UpdateAuthenticationPolicyDetails(
        password_policy=new_policy
    )

    # 4. Update the tenancy authentication (password) policy
    response = identity_client.update_authentication_policy(
        compartment_id=tenancy_id,
        update_authentication_policy_details=update_details,
    )

    print("Password policy updated. New policy:")
    print(response.data.password_policy)


if __name__ == "__main__":
    ensure_strong_password_policy()

4. Using This for “Monitoring”

Run this script periodically (e.g., via cron, CI pipeline, or an external scheduler).
Treat it as a monitor + auto‑remediator:
- It inspects the current policy.
- If it’s already strong, it does nothing.
- If it’s weak, it automatically remediates.

If you want it to only alert and not change anything, you can:

Keep is_policy_strong() logic.
When policy is weak, just log/send an alert (email, Slack, etc.) instead of calling update_authentication_policy.

Using Terraform

# There is currently no Terraform resource in the official OCI provider
# that manages the *tenancy-level* IAM password policy (the one checked
# by this finding), so this control cannot be remediated via Terraform.

# You must update it manually in the OCI Console:
# 1. Open "Identity & Security" → "Domains" (or "Identity" → "Security" for classic IAM).
# 2. Select the target tenancy/domain.
# 3. Go to "Password Policy".
# 4. Set:
#    - Minimum password length: 14
#    - Require at least one uppercase character: Enabled
#    - Require at least one lowercase character: Enabled
#    - Require at least one number: Enabled
#    - Require at least one special character: Enabled
# 5. Save the policy.

# Since there is no Terraform-managed resource, `terraform plan`
# will show no changes related to the IAM password policy.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Get your Tenancy OCID (if you don’t already have it)​

2. Check the current password policy​

3. Define a strong password policy in JSON​

4. Update the password policy using OCI CLI​

5. Verify the updated policy​

1. Prerequisites​

2. Decide Your “Strong” Password Requirements​

3. Python Script: Monitor and Remediate Password Policy​

4. Using This for “Monitoring”​