Back to Checks
oraclecloud

User auth token age is 90 days or less

identity_user_auth_tokens_rotated_90_days
Service: identitySeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesssecrets
Resource Type:User

OCI IAM user auth tokens are evaluated for rotation age against a 90-day threshold using each token's creation time. Tokens older than this window indicate the token has not been recently rotated.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Stale auth tokens increase exposure of confidential data and enable persistent unauthorized API access if compromised. Long-lived tokens can outlast password resets and role changes, weakening least privilege and enabling lateral movement and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks identity_user_auth_tokens_rotated_90_days

Recommendation

Enforce routine token rotation at <= 90 days and prefer short-lived, scoped credentials. Apply least privilege, revoke unused tokens, set automatic expirations, and monitor usage. When possible, replace static tokens with federated or session-based access to reduce exposure.

Remediation

CLI

oci iam user delete-auth-token --user-id <example_resource_id> --auth-token-id <example_resource_id> --force

Other

1In the OCI Console, go to Identity & Security > Users
2Open the user with the failing auth token
3In the Auth Tokens tab, find tokens older than 90 days (check Created date)
4Select the old token and click Delete
5Confirm deletion
6Repeat for any other tokens older than 90 days

Check Code

"""Check Ensure user auth tokens rotate within 90 days or less."""

from datetime import datetime, timedelta, timezone

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
    identity_client,
)


class identity_user_auth_tokens_rotated_90_days(Check):
    """Check Ensure user auth tokens rotate within 90 days or less."""

    def execute(self) -> Check_Report_OCI:
        """Execute the identity_user_auth_tokens_rotated_90_days check.

        Ensure user auth tokens rotate within 90 days or less.
        """
        findings = []

        # Calculate 90 days ago from now
        current_time = datetime.now(timezone.utc)
        max_age = current_time - timedelta(days=90)

        # Check each user's auth tokens
        for user in identity_client.users:
            if not user.auth_tokens:
                continue

            for token in user.auth_tokens:
                report = Check_Report_OCI(
                    metadata=self.metadata(),
                    resource=token,
                    region=user.region,
                    resource_name=f"{user.name} - Auth Token",
                    resource_id=token.id,
                    compartment_id=user.compartment_id,
                )

                # Check if token is older than 90 days
                token_age_days = (current_time - token.time_created).days

                if token.time_created < max_age:
                    report.status = "FAIL"
                    report.status_extended = f"User '{user.name}' has an auth token created {token_age_days} days ago (on {token.time_created.strftime('%Y-%m-%d')}), which exceeds the 90-day rotation period."
                else:
                    report.status = "PASS"
                    report.status_extended = f"User '{user.name}' has an auth token created {token_age_days} days ago, which is within the 90-day rotation period."

                findings.append(report)

        return findings

References