Identity Domain password policy requires 14 characters

Check ID: identity_password_policy_minimum_length_14
Provider: Oracle Cloud (OCI)
Service: identity
Severity: HIGH
Categories: identity-access
Resource type: Policy

What this check verifies

OCI IAM password policies are evaluated to confirm a minimum password length of >= 14 characters is enforced. The assessment considers policies defined in Identity Domains and the legacy tenancy policy, and also detects when no password policy exists. System-managed immutable policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded.

Risk

Short or missing password requirements weaken authentication, enabling brute-force, password spraying, and faster offline cracking. Compromised accounts can enable unauthorized console/API use, leading to data exfiltration (C), unauthorized changes (I), and service disruption via destructive actions (A).

Recommendation

Enforce a minimum password length of >= 14, preferably using passphrases. Combine with MFA, complexity and reuse limits, lockout/throttling, and routine policy reviews. Apply least privilege to limit blast radius and monitor authentication events. If using external IdPs, require equivalent policies there.

Remediation

CLI
Terraform
Dashboard steps

oci iam authentication-policy update --compartment-id <tenancy-ocid> --password-policy '{"minimumPasswordLength":14}'

resource "oci_identity_authentication_policy" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"

  password_policy {
    minimum_password_length = 14  # Critical: enforces minimum password length of 14
  }
}

References

https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_password_policy_minimum_length_14. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Password policy expires passwords within 365 days Password policy remembers 24 previous passwords

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires