Check ID: events_notification_topic_and_subscription_exists
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: logging
Resource type: OnsTopic

​
What this check verifies

OCI Notifications is evaluated for the existence of at least one topic that has one or more subscriptions. The focus is on whether subscribed endpoints are present to receive Events and monitoring alerts.

​
Risk

Without subscribed topics, alerts are not delivered, reducing visibility and delaying detection of malicious or accidental changes. This undermines confidentiality (undetected data access), integrity (unauthorized config changes), and availability (unresolved outages).

​
Recommendation

Create a centralized Notifications topic with one or more subscriptions, and route critical Events/monitoring to it. Apply least privilege to topic management, use redundant channels, test delivery regularly, and tune filters to reduce noise. Consider escalation paths for critical alerts.

​
Remediation

# Create a notification topic
resource "oci_ons_notification_topic" "<example_resource_name>" {
  compartment_id = var.compartment_ocid
  name           = "<example_resource_name>"  # Critical: creates the notification topic needed for the check
}

# Create a subscription on the topic (ensures topic has an active subscription)
resource "oci_ons_subscription" "<example_resource_name>" {
  compartment_id = var.compartment_ocid
  topic_id       = oci_ons_notification_topic.<example_resource_name>.id  # Critical: attaches the subscription to the topic
  protocol       = "ORACLE_FUNCTIONS"  # Critical: protocol that can become active without manual confirmation
  endpoint       = "<function_ocid>"   # Critical: endpoint for the subscription
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_notification_topic_and_subscription_exists. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks