User IAM database password was created within the last 90 days
OCI IAM user database passwords are evaluated for age. Passwords are compared to a rotation window of 90 days, flagging credentials that have not been refreshed within that period for the associated user accounts and regions.
Covers each user's active database passwords tracked by IAM.
Prowlerprowler-provider-oraclecloudRisk
Stale database credentials increase exposure to brute-force, credential stuffing, and reuse of leaked passwords. If compromised, attackers can gain direct DB access, enabling data exfiltration (C), unauthorized changes to schemas or data (I), and service disruption via destructive queries (A). Long-lived secrets can bypass offboarding.
Run this check with Prowler
Run in Prowler Cloudprowler oraclecloud --checks identity_user_db_passwords_rotated_90_daysRecommendation
Enforce rotation of IAM database passwords at or below 90 days and expire old credentials. Automate issuance and revocation, and remove unused DB passwords.
Prefer short-lived auth (tokens or certificates) where supported, apply least privilege to DB roles, and monitor credential age to prevent drift.
Remediation
CLI
oci iam db-credential create --user-id <example_resource_id>Other
Check Code
"""Check Ensure user IAM Database Passwords rotate within 90 days."""
from datetime import datetime, timedelta, timezone
from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
identity_client,
)
class identity_user_db_passwords_rotated_90_days(Check):
"""Check Ensure user IAM Database Passwords rotate within 90 days."""
def execute(self) -> Check_Report_OCI:
"""Execute the identity_user_db_passwords_rotated_90_days check."""
findings = []
# Calculate 90 days ago from now
current_time = datetime.now(timezone.utc)
max_age = current_time - timedelta(days=90)
# Check each user's database passwords
for user in identity_client.users:
if not user.db_passwords:
continue
for password in user.db_passwords:
report = Check_Report_OCI(
metadata=self.metadata(),
resource=password,
region=user.region,
resource_name=f"{user.name} - DB Password",
resource_id=password.id,
compartment_id=user.compartment_id,
)
# Check if password is older than 90 days
password_age_days = (current_time - password.time_created).days
if password.time_created < max_age:
report.status = "FAIL"
report.status_extended = f"User '{user.name}' has a database password created {password_age_days} days ago (on {password.time_created.strftime('%Y-%m-%d')}), which exceeds the 90-day rotation period."
else:
report.status = "PASS"
report.status_extended = f"User '{user.name}' has a database password created {password_age_days} days ago, which is within the 90-day rotation period."
findings.append(report)
return findings