Event rule for identity provider changes has notifications

Check ID: events_rule_identity_provider_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: identity-access, logging
Resource type: EventRule

What this check verifies

OCI Events rules monitor IAM identity provider creation, update, and deletion and include a notification action. The evaluation identifies rules that filter these events and route matching activity to a notification destination.

Risk

Without alerts on identity provider changes, federation can be modified unnoticed, enabling unauthorized SSO, privilege escalation, or account takeover. Delayed visibility degrades incident response and threatens confidentiality and integrity of tenant access.

Recommendation

Configure rules to capture identity provider create, update, and delete events and send notifications to responders and SIEM. Enforce least privilege on IdP management, require approvals for changes, and test alert paths. Use defense in depth with audit logging to spot anomalous identity changes.

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --compartment-id <example_resource_id> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.identitycontrolplane.createidentityprovider","com.oraclecloud.identitycontrolplane.deleteidentityprovider","com.oraclecloud.identitycontrolplane.updateidentityprovider"]}' --is-enabled true --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>"}]}'

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"
  is_enabled     = true

  # Critical: monitor identity provider create/delete/update events
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.createidentityprovider",
      "com.oraclecloud.identitycontrolplane.deleteidentityprovider",
      "com.oraclecloud.identitycontrolplane.updateidentityprovider",
    ]
  })

  actions {
    actions {
      action_type = "ONS"                 # Critical: send notifications via OCI Notifications
      topic_id    = "<example_resource_id>"  # Topic to notify
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_identity_provider_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Event rule for IAM policy changes has notifications Event rule for IdP group mapping changes has notifications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires