Check ID: events_rule_idp_group_mapping_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: identity-access
Resource type: EventRule

What this check verifies

OCI Events rules monitor IdP group mapping changes with notification actions for com.oraclecloud.identitycontrolplane.addidpgroupmapping, com.oraclecloud.identitycontrolplane.removeidpgroupmapping, and com.oraclecloud.identitycontrolplane.updateidpgroupmapping.

Risk

Without alerts on IdP group mapping changes, federated users can gain unauthorized group memberships unnoticed, enabling privilege escalation and broader access to OCI resources. This undermines confidentiality and integrity, and may affect availability through misuse of elevated permissions.

Recommendation

Define Events rules for IdP group mapping changes (com.oraclecloud.identitycontrolplane.addidpgroupmapping, ...removeidpgroupmapping, ...updateidpgroupmapping) and route notifications to monitored channels via OCI Notifications. Apply least privilege and separation of duties, and integrate alerts with a SIEM for defense in depth.

Remediation

oci events rule create --compartment-id <COMPARTMENT_OCID> --display-name <example_resource_name> --is-enabled true --condition '{"eventType":["com.oraclecloud.identitycontrolplane.addidpgroupmapping","com.oraclecloud.identitycontrolplane.removeidpgroupmapping","com.oraclecloud.identitycontrolplane.updateidpgroupmapping"]}' --actions '{"actions":[{"actionType":"ONS","isEnabled":true,"topicId":"<TOPIC_OCID>"}]}'

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_idp_group_mapping_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks