🛡️ Oracle IAM Domain Password Policy does not remember 24 passwords🟢

• Contextual name: 🛡️ Domain Password Policy does not remember 24 passwords🟢
• ID: /ce/ca/oracle/iam/domain-password-policy-reuse
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Oracle IAM Domain Password Policy
  • 🔌 Oracle IAM Domain Password Policy - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Set Previous passwords remembered to at least 24 for every Oracle IAM domain password policy, including the default fallback policy, to meet CIS Oracle control 1.6.

Rationale

Remembering previous passwords prevents users from repeatedly choosing the same credentials after a reset.

Impact

Users must choose a password outside the remembered history at their next password change. Communicate the change before enforcing it.

Audit

This policy marks an Oracle IAM Domain Password Policy as INCOMPLIANT if Previous Passwords Remembered is below 24.

A history of at least 24 passwords is COMPLIANT. A missing Previous Passwords Remembered is UNDETERMINED: the optional API field alone does not establish the effective default. Every collected policy is evaluated, regardless of its name or group assignments. This checks the configured setting; actual end-user password reuse is not observed.

Remediation

Open File

Remediation

1. Open Identity & Security > Domains in the OCI Console and select the affected domain.
2. Open Settings > Password policy and select the affected policy.
3. Select Edit password rules.
4. Set Previous passwords remembered to at least 24. Retain stronger existing settings.
5. Save and verify the setting on each policy, including the domain fallback policy. If a predefined policy cannot be edited, use a custom policy with the required setting and update the affected group assignments.

Communicate the change to users. Confirm users can complete password resets under the new history requirement.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Oracle v3.1.0 → 💼 1.6 Ensure IAM password policy prevents password reuse - Level 1 (Manual)			1		no data
💼 CIS Oracle v3.1.1 → 💼 1.6 Ensure IAM password policy prevents password reuse - Level 1 (Manual)			1		no data
💼 Cloudaware Framework → 💼 Credential Lifecycle Management			39		no data