Event rule for IAM group changes has notifications

Check ID: events_rule_iam_group_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: threat-detection
Resource type: EventRule

What this check verifies

OCI Events rules monitor IAM group lifecycle events (creategroup, updategroup, deletegroup) and include notification actions to generate alerts when these changes occur.

Risk

Without alerts on IAM group changes, unauthorized privilege changes can persist unnoticed, enabling privilege escalation and broader access. This undermines confidentiality and integrity, and delays response to identity misuse.

Recommendation

Create Events rules for IAM group create, update, and delete and route them to Notifications channels consumed by the SOC. Enforce least privilege and separation of duties on rules/topics, forward events to a SIEM, and periodically test alert delivery.

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --compartment-id <compartment_ocid> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.identitycontrolplane.creategroup","com.oraclecloud.identitycontrolplane.deletegroup","com.oraclecloud.identitycontrolplane.updategroup"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>"}]}'

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"

  # Critical: Monitor IAM group changes
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.creategroup",
      "com.oraclecloud.identitycontrolplane.deletegroup",
      "com.oraclecloud.identitycontrolplane.updategroup"
    ]
  })

  actions {
    actions {
      action_type = "ONS"               # Critical: Send notifications via OCI Notifications
      topic_id    = "<example_resource_id>"  # Topic OCID for notifications
    }
  }
}

References

https://docs.oracle.com/en-us/iaas/Content/Events/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_iam_group_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Event rule for Cloud Guard problems has notifications Event rule for IAM policy changes has notifications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires