Check ID: identity_password_policy_expires_within_365_days
Provider: Oracle Cloud (OCI)
Service: identity
Severity: MEDIUM
Categories: identity-access
Resource type: Policy

​
What this check verifies

OCI Identity Domain password policies are evaluated to confirm password expiration is configured and set to <= 365 days (password_expires_after). System-managed immutable policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded. Legacy IAM lacks password expiration; tenancies without Identity Domains require manual assessment.

​
Risk

Missing or >365-day password expiration extends the window for credential stuffing, brute force, and use of leaked passwords. This enables unauthorized access, data exposure, and configuration changes, harming confidentiality and integrity, and allowing attacker persistence after staff turnover.

​
Recommendation

Enforce password rotation at <= 365 days in Identity Domains. Combine with MFA, strong composition rules, history, and minimum password age to prevent reuse. Apply least privilege, disable dormant accounts, and regularly review credential policies. If on legacy IAM, adopt Identity Domains to gain expiration controls.

​
Remediation

resource "oci_identity_domains_password_policy" "<example_resource_name>" {
  idcs_endpoint = "<example_resource_id>"
  name          = "<example_resource_name>"
  schemas       = ["urn:ietf:params:scim:schemas:oracle:idcs:PasswordPolicy"]

  password_expires_after = 365 # Critical: ensures passwords expire within 365 days to pass the check
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_password_policy_expires_within_365_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks