Back to Checks
oraclecloud

Identity Domain password policy expires passwords within 365 days

identity_password_policy_expires_within_365_days
Service: identitySeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Policy

OCI Identity Domain password policies are evaluated to confirm password expiration is configured and set to <= 365 days (password_expires_after). System-managed immutable policies (SimplePasswordPolicy, StandardPasswordPolicy) are excluded.

Legacy IAM lacks password expiration; tenancies without Identity Domains require manual assessment.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Missing or >365-day password expiration extends the window for credential stuffing, brute force, and use of leaked passwords. This enables unauthorized access, data exposure, and configuration changes, harming confidentiality and integrity, and allowing attacker persistence after staff turnover.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks identity_password_policy_expires_within_365_days

Recommendation

Enforce password rotation at <= 365 days in Identity Domains. Combine with MFA, strong composition rules, history, and minimum password age to prevent reuse. Apply least privilege, disable dormant accounts, and regularly review credential policies. If on legacy IAM, adopt Identity Domains to gain expiration controls.

Remediation

Terraform

resource "oci_identity_domains_password_policy" "<example_resource_name>" {
  idcs_endpoint = "<example_resource_id>"
  name          = "<example_resource_name>"
  schemas       = ["urn:ietf:params:scim:schemas:oracle:idcs:PasswordPolicy"]

  password_expires_after = 365 # Critical: ensures passwords expire within 365 days to pass the check
}

Other

1Sign in to the OCI Console
2Go to Identity & Security > Domains and select your identity domain
3In the domain, open Security (or Domain settings) > Password policies
4Edit the relevant password policy
5Set "Password expires after (days)" to 365 or less
6Click Save

Check Code

"""Check Ensure IAM password policy expires passwords within 365 days."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
    identity_client,
)


class identity_password_policy_expires_within_365_days(Check):
    """Check Ensure IAM password policy expires passwords within 365 days."""

    def execute(self) -> Check_Report_OCI:
        """Execute the identity_password_policy_expires_within_365_days check.

        Note: Password expiration policies are only available in OCI Identity Domains.
        The legacy IAM password policy does not support password expiration settings.
        This check requires Identity Domains to be enabled in the tenancy.
        """
        findings = []

        # This check only applies to Identity Domains, not the legacy password policy

        # If no Identity Domains are found, the legacy password policy is in use
        if not identity_client.domains:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Password Expiration Policy",
                resource_id=identity_client.audited_tenancy,
                compartment_id=identity_client.audited_tenancy,
            )
            report.status = "MANUAL"
            report.status_extended = "Identity Domains not enabled. Password expiration policies are only available in OCI Identity Domains. Legacy password policy does not support password expiration."
            findings.append(report)
            return findings

        # Check each Identity Domain's password policies
        for domain in identity_client.domains:
            # Determine the region
            region = domain.region if hasattr(domain, "region") else "global"

            # Check each password policy in the domain
            for policy in domain.password_policies:
                report = Check_Report_OCI(
                    metadata=self.metadata(),
                    resource=policy,
                    region=region,
                    resource_name=f"Domain: {domain.display_name} - Policy: {policy.name}",
                    resource_id=policy.id,
                    compartment_id=domain.compartment_id,
                )

                # Check if password expiration is configured
                if policy.password_expires_after is None:
                    report.status = "FAIL"
                    report.status_extended = f"Password policy '{policy.name}' in domain '{domain.display_name}' does not have password expiration configured."
                elif policy.password_expires_after > 365:
                    report.status = "FAIL"
                    report.status_extended = f"Password policy '{policy.name}' in domain '{domain.display_name}' allows passwords to expire after {policy.password_expires_after} days, which exceeds the recommended 365 days."
                else:
                    report.status = "PASS"
                    report.status_extended = f"Password policy '{policy.name}' in domain '{domain.display_name}' expires passwords within {policy.password_expires_after} days."

                findings.append(report)

        return findings

References