Check ID: identity_user_auth_tokens_rotated_90_days
Provider: Oracle Cloud (OCI)
Service: identity
Severity: MEDIUM
Categories: identity-access, secrets
Resource type: User

​
What this check verifies

OCI IAM user auth tokens are evaluated for rotation age against a 90-day threshold using each token’s creation time. Tokens older than this window indicate the token has not been recently rotated.

​
Risk

Stale auth tokens increase exposure of confidential data and enable persistent unauthorized API access if compromised. Long-lived tokens can outlast password resets and role changes, weakening least privilege and enabling lateral movement and data exfiltration.

​
Recommendation

Enforce routine token rotation at <= 90 days and prefer short-lived, scoped credentials. Apply least privilege, revoke unused tokens, set automatic expirations, and monitor usage. When possible, replace static tokens with federated or session-based access to reduce exposure.

​
Remediation

oci iam user delete-auth-token —user-id <example_resource_id> —auth-token-id <example_resource_id> —force

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_user_auth_tokens_rotated_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks