Event rule for IAM policy changes has notifications

Check ID: events_rule_iam_policy_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: identity-access
Resource type: EventRule

What this check verifies

OCI Events rules configured to capture IAM policy create, update, and delete events (com.oraclecloud.identitycontrolplane.createpolicy, com.oraclecloud.identitycontrolplane.updatepolicy, com.oraclecloud.identitycontrolplane.deletepolicy) and include a notification action.

Risk

Without alerts on IAM policy changes, permissions can be altered unnoticed, enabling privilege escalation, unauthorized data access, and persistent footholds. Delayed visibility degrades confidentiality and integrity and slows incident response across compartments.

Recommendation

Create OCI Events rules for ...createpolicy, ...updatepolicy, and ...deletepolicy with a notification action to trusted channels. Enforce least privilege on IAM and Events administration, require change approvals, and routinely test alerting to ensure rapid detection.

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --compartment-id <compartment_ocid> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.identitycontrolplane.createpolicy","com.oraclecloud.identitycontrolplane.deletepolicy","com.oraclecloud.identitycontrolplane.updatepolicy"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<topic_ocid>"}]}'

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = var.compartment_id
  display_name   = "<example_resource_name>"
  is_enabled     = true

  # Critical: monitor IAM policy create/delete/update events
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.createpolicy",
      "com.oraclecloud.identitycontrolplane.deletepolicy",
      "com.oraclecloud.identitycontrolplane.updatepolicy"
    ]
  })

  actions {
    actions {
      action_type = "ONS"        # Critical: adds a Notifications action
      topic_id    = var.topic_id  # Critical: target Notifications topic
    }
  }
}

References

https://docs.oracle.com/en-us/iaas/Content/Events/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_iam_policy_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Event rule for IAM group changes has notifications Event rule for identity provider changes has notifications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires