# Ensure user IAM database password was created within the last 90 days

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698513741461-ensure-user-iam-database-password-was-created-within-the-last-90-days
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every IAM database password that a user has created was created or replaced within the last 90 days. IAM database passwords let users sign in to supported Oracle databases with their OCI identity, so they should be replaced regularly and removed when no longer used.

**Rationale**

Database passwords that are never changed can be reused for a long time if they are stolen, shared, or saved in scripts. Replacing them at least every 90 days limits how long a leaked password can be used to reach database data. Removing passwords that are no longer needed also reduces the number of credentials an attacker could abuse.

**Impact**

-   Limits how long a stolen database password can be used
    
-   Removes unused database credentials
    
-   Tools that use an old password must be updated
    

**Default Value**

By default, IAM database passwords do not expire and are not replaced automatically.

**Pre-Requisites**

-   Identity domain administrator or user administrator role
    
-   A list of databases and tools that use each password
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab and find the Database passwords section (on older consoles, select Database passwords under Resources).
    
5.  Check the creation date of each database password.
    
6.  If any password was created more than 90 days ago, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab and find the Database passwords section.
    
5.  Select Create database password, enter a description and a strong password, and select Create.
    
6.  Update the database clients and tools that use the old password.
    
7.  Delete the old database password.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).
    
3.  Select the User management tab, and select the user you want to review.
    
4.  Open the Tokens and keys tab and delete the new database password if it causes problems.
    
5.  Create another database password and update the affected tools.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm](https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/managingcredentials.htm)
    
-   [https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-IAM/rotate-iam-database-passwords.html](https://www.trendmicro.com/cloudoneconformity/knowledge-base/oci/OCI-IAM/rotate-iam-database-passwords.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.