OCI IAM password policy for local (non-federated) users does not have minimum 14 characters misconfi

Rule Details

Cortex AppSec Rule ID	APPSEC_OCI_18
Category - Subcategory	IAM - Authentication Policies
Provider	ORACLE
Severity	MEDIUM
Framework	Terraform, Terraform Plan

Impact

This rule identifies Oracle Cloud Infrastructure(OCI) accounts that do not have a minimum of 14 characters in the password policy for local (non-federated) users. As a security best practice, configure a strong password policy for secure access to the OCI console.

How to Fix

Resource: oci_identity_authentication_policy

• Arguments: password_policy.minimum_password_length [source,go]

---

resource "oci_identity_authentication_policy" "pass" {

compartment_id = var.tenancy_id

password_policy { ... minimum_password_length = 14 } }