User database password was created in the last 90 days

​

What this check verifies

OCI IAM user database passwords are evaluated for age. Passwords are compared to a rotation window of 90 days, flagging credentials that have not been refreshed within that period for the associated user accounts and regions. Covers each user’s active database passwords tracked by IAM.

​

Risk

Stale database credentials increase exposure to brute-force, credential stuffing, and reuse of leaked passwords. If compromised, attackers can gain direct DB access, enabling data exfiltration (C), unauthorized changes to schemas or data (I), and service disruption via destructive queries (A). Long-lived secrets can bypass offboarding.

​

Recommendation

Enforce rotation of IAM database passwords at or below 90 days and expire old credentials. Automate issuance and revocation, and remove unused DB passwords. Prefer short-lived auth (tokens or certificates) where supported, apply least privilege to DB roles, and monitor credential age to prevent drift.

​

Remediation

​

References

• https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm

​

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_user_db_passwords_rotated_90_days. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Oracle Cloud (OCI) checks