Description

Ensure every auth token belonging to an IAM user was created within the last 90 days. Auth tokens are used by third-party APIs and tools, such as Docker registry access and Swift clients, that do not support OCI signature-based authentication, so they should be replaced regularly.

Rationale

Auth tokens act like passwords and remain valid until they are deleted. Tokens that are never replaced may be stored in scripts, CI pipelines, or laptops, and can be used by anyone who finds them. Replacing tokens at least every 90 days limits how long a leaked token remains useful to an attacker.

Impact

  • Limits how long a leaked token can be used

  • Removes old tokens that may be stored insecurely

  • Tools using an old token must be updated

Default Value

By default, auth tokens do not expire, and each user can have up to two auth tokens.

Pre-Requisites

  • Identity domain administrator or user administrator role

  • A list of tools that use each token

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. Open the Tokens and keys tab and find the Auth tokens section (on older consoles, select Auth tokens under Resources).

  5. Check the creation date of each token.

  6. If any token is older than 90 days, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. Open the Tokens and keys tab, and in the Auth tokens section select Generate token.

  5. Enter a description, select Generate token, and copy the token immediately, as it is shown only once.

  6. Update every tool that uses the old token.

  7. Delete the old token.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Identity & Security, and under Identity select Domains. Select the identity domain (for example, Default).

  3. Select the User management tab, and select the user you want to review.

  4. If a tool fails, generate a new token and update the tool with it.

Reference