Control: 1.4 Ensure IAM password policy requires minimum length of 14 or greater
Description
Password policies are used to enforce password complexity requirements. IAM password policies can be used to ensure password are at least a certain length and are composed of certain characters. It is recommended the password policy require a minimum password length 14 characters and contain 1 non-alphabetic character (Number or “Special Character”).
Remediation
From Console
OCI Native IAM
- Login to OCI Console.
- Go to
Identityin the Services menu. - Select
Authentication Settingsfrom the Identity menu. - Click
Editin the middle of the page. - Type the number
14into the box below the text:MINIMUM PASSWORD LENGTH (IN CHARACTERS). - Select checkbox next to
MUST CONTAIN AT LEAST 1 SPECIAL CHARACTERORMUST CONTAIN AT LEAST 1 NUMERIC CHARACTER.
OCI Identity Cloud Service (IDCS)
- Login to IDCS Admin Console.
- Expand the Navigation Drawer, click
Settings, and then clickPassword Policy. - Click on
Change Your Password Policybutton. - Update the
Password length min size settingto14. - Click
Save. - Under The
password must contain these characterssection, update the number given inSpecial minsetting to1or Under Thepassword must contain these characterssection, update the number given inNumeric minsetting to1. - Click
Save.
Usage
Run the control in your terminal:
powerpipe control run oci_compliance.control.cis_v120_1_4Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run oci_compliance.control.cis_v120_1_4 --shareSQL
This control uses a named query:
select tenant_id as resource, case when minimum_password_length >= 14 and (is_numeric_characters_required or is_special_characters_required) then 'ok' else 'alarm' end as status, case when minimum_password_length is null then 'No password policy set.' when minimum_password_length >= 14 and (is_numeric_characters_required or is_special_characters_required) then 'Strong password policies configured.' else 'Strong password policies not configured.' end as reason , tenant_name as tenantfrom oci_identity_authentication_policy;