🛡️ Oracle IAM Domain Password Policy does not expire passwords within 365 days🟢

• Contextual name: 🛡️ Domain Password Policy does not expire passwords within 365 days🟢
• ID: /ce/ca/oracle/iam/domain-password-policy-expiration
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Oracle IAM Domain Password Policy
  • 🔌 Oracle IAM Domain Password Policy - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Set Expires after (days) to a value from 1 to 365 for every Oracle IAM domain password policy, including the default fallback policy, to meet CIS Oracle control 1.5.

Rationale

Annual expiration limits the lifetime of a potentially compromised password. Passwords must also be changed promptly after compromise or relevant personnel changes.

Impact

A shorter expiration period can require users to change their passwords sooner. Communicate the change before enforcing it.

Audit

This policy marks an Oracle IAM Domain Password Policy as INCOMPLIANT if Password Expires After (days) is zero or negative (no valid expiration), or greater than 365.

An expiration period from 1 through 365 days is COMPLIANT. A missing Password Expires After (days) is UNDETERMINED: the optional API field alone does not establish the effective default. Every collected policy is evaluated, regardless of its name or group assignments. This checks the configured setting; event-driven password changes require operational review.

Remediation

Open File

Remediation

1. Open Identity & Security > Domains in the OCI Console and select the affected domain.
2. Open Settings > Password policy and select the affected policy.
3. Select Edit password rules.
4. Set Expires after (days) to a value from 1 to 365. Retain stronger existing settings.
5. Save and verify the setting on each policy, including the domain fallback policy. If a predefined policy cannot be edited, use a custom policy with the required setting and update the affected group assignments.

Communicate the change to users. Review any near-term expiration impact and the process for changing passwords immediately after compromise.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Oracle v3.1.0 → 💼 1.5 Ensure IAM password policy expires passwords within 365 days - Level 1 (Manual)			1		no data
💼 CIS Oracle v3.1.1 → 💼 1.5 Ensure IAM password policy expires passwords within 365 days - Level 1 (Manual)			1		no data
💼 Cloudaware Framework → 💼 Credential Lifecycle Management			39		no data