Check ID: identity_user_customer_secret_keys_rotated_90_days
Provider: Oracle Cloud (OCI)
Service: identity
Severity: MEDIUM
Categories: identity-access, secrets
Resource type: User

​
What this check verifies

OCI IAM customer secret keys are assessed by creation timestamp to determine whether their age exceeds 90 days.

​
Risk

Long-lived customer secret keys keep compromised or brute-forced credentials valid. Attackers can use them to list, read, write, or delete Object Storage data, enabling exfiltration, tampering, and disruption-impacting confidentiality, integrity, and availability.

​
Recommendation

Rotate customer secret keys every <= 90 days. Apply least privilege, remove unused keys, and prefer short-lived identities (instance/resource principals) over static secrets. Automate rotation and alerts, avoid embedding keys in code, and continuously monitor key usage.

​
Remediation

oci iam customer-secret-key delete —user-id <example_resource_id> —customer-secret-key-id <example_resource_id> —force

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_user_customer_secret_keys_rotated_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks