# Ensure IAM Local User Passwords Are Rotated

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826024224465-ensure-iam-local-user-passwords-are-rotated
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure IAM local user passwords are changed on a regular schedule, and immediately if a password may have been exposed, so that old passwords do not stay valid indefinitely. Users should also enable two-factor authentication on their own login.

**Rationale**

Passwords that are never changed can be reused for a long time if they are leaked, phished, or reused on other sites. Regular rotation limits how long a compromised password can be used. Because OVHcloud does not expire local user passwords automatically, rotation must be part of a documented process.

**Impact**

-   Limits how long a leaked password stays valid
    
-   Supports password policy and compliance requirements
    
-   Users must update their saved passwords
    

**Default Value**

OVHcloud does not automatically expire IAM local user passwords.

**Pre-Requisites**

-   Access to the OVHcloud account owner login or an IAM administrator
    
-   A defined password rotation period
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Under Identity and Access Management, select Identities, then open the Local users tab.
    
4.  Review each local user and check, using your records, when its password was last changed.
    
5.  If any password is older than your rotation period, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Identity, Security & Operations.
    
3.  Under Identity and Access Management, select Identities, then open the Local users tab.
    
4.  Open the ⋯ menu for the local user and edit the user to set a new password.
    
5.  Set a new strong password, or ask the user to change it from their own account.
    
6.  Record the change date and repeat on your defined schedule.
    

**Backout Plan**

1.  If a user cannot sign in, set a new password for them from the Identities page.
    

**Reference**

-   [https://us.ovhcloud.com/identity-security/identity-access-management/](https://us.ovhcloud.com/identity-security/identity-access-management/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.