OCI IAM password policy for local (non-federated) users does not have a lowercase character misconfi

Rule Details

Cortex AppSec Rule ID	APPSEC_OCI_11
Category - Subcategory	IAM - Authentication Policies
Provider	ORACLE
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule identifies Oracle Cloud Infrastructure(OCI) accounts that do not have a lowercase character in the password policy for local (non-federated) users. As a security best practice, configure a strong password policy for secure access to the OCI console.

How to Fix

Resource: oci_identity_authentication_policy

• Arguments: password_policy.is_lowercase_characters_required [source,go]

---

resource "oci_identity_authentication_policy" "pass" { ...

password_policy { is_lowercase_characters_required = true ... } }