Event rule for network gateway changes has notifications

Check ID: events_rule_network_gateway_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: logging
Resource type: EventRule

What this check verifies

OCI Events rules monitor network gateway lifecycle and attachment changes (DRG, Internet, NAT, Service, and Local Peering gateways) and include notification actions so changes generate alerts. The evaluation looks for rules filtered to these events and confirms they trigger notifications.

Risk

Unalerted gateway changes can reroute traffic, expose services, or sever connectivity. Attackers or misconfigurations may modify routes or attachments to enable data exfiltration, man-in-the-middle, or denial of service, degrading confidentiality, integrity, and availability.

Recommendation

Define event rules that match create, update, delete, attach, and detach actions for all gateway types and send notifications to monitored channels. Apply least privilege on topics, cover all compartments/regions, integrate with SIEM, and use defense in depth with network change approvals.

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --compartment-id <example_resource_id> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.virtualnetwork.createdrg","com.oraclecloud.virtualnetwork.deletedrg","com.oraclecloud.virtualnetwork.updatedrg","com.oraclecloud.virtualnetwork.createdrgattachment","com.oraclecloud.virtualnetwork.deletedrgattachment","com.oraclecloud.virtualnetwork.updatedrgattachment","com.oraclecloud.virtualnetwork.changeinternetgatewaycompartment","com.oraclecloud.virtualnetwork.createinternetgateway","com.oraclecloud.virtualnetwork.deleteinternetgateway","com.oraclecloud.virtualnetwork.updateinternetgateway","com.oraclecloud.virtualnetwork.changelocalpeeringgatewaycompartment","com.oraclecloud.virtualnetwork.createlocalpeeringgateway","com.oraclecloud.virtualnetwork.deletelocalpeeringgateway.end","com.oraclecloud.virtualnetwork.updatelocalpeeringgateway","com.oraclecloud.natgateway.changenatgatewaycompartment","com.oraclecloud.natgateway.createnatgateway","com.oraclecloud.natgateway.deletenatgateway","com.oraclecloud.natgateway.updatenatgateway","com.oraclecloud.servicegateway.attachserviceid","com.oraclecloud.servicegateway.changeservicegatewaycompartment","com.oraclecloud.servicegateway.createservicegateway","com.oraclecloud.servicegateway.deleteservicegateway.end","com.oraclecloud.servicegateway.detachserviceid","com.oraclecloud.servicegateway.updateservicegateway"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>"}]}'

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"

  # Critical: Monitor required network gateway event types
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.virtualnetwork.createdrg",
      "com.oraclecloud.virtualnetwork.deletedrg",
      "com.oraclecloud.virtualnetwork.updatedrg",
      "com.oraclecloud.virtualnetwork.createdrgattachment",
      "com.oraclecloud.virtualnetwork.deletedrgattachment",
      "com.oraclecloud.virtualnetwork.updatedrgattachment",
      "com.oraclecloud.virtualnetwork.changeinternetgatewaycompartment",
      "com.oraclecloud.virtualnetwork.createinternetgateway",
      "com.oraclecloud.virtualnetwork.deleteinternetgateway",
      "com.oraclecloud.virtualnetwork.updateinternetgateway",
      "com.oraclecloud.virtualnetwork.changelocalpeeringgatewaycompartment",
      "com.oraclecloud.virtualnetwork.createlocalpeeringgateway",
      "com.oraclecloud.virtualnetwork.deletelocalpeeringgateway.end",
      "com.oraclecloud.virtualnetwork.updatelocalpeeringgateway",
      "com.oraclecloud.natgateway.changenatgatewaycompartment",
      "com.oraclecloud.natgateway.createnatgateway",
      "com.oraclecloud.natgateway.deletenatgateway",
      "com.oraclecloud.natgateway.updatenatgateway",
      "com.oraclecloud.servicegateway.attachserviceid",
      "com.oraclecloud.servicegateway.changeservicegatewaycompartment",
      "com.oraclecloud.servicegateway.createservicegateway",
      "com.oraclecloud.servicegateway.deleteservicegateway.end",
      "com.oraclecloud.servicegateway.detachserviceid",
      "com.oraclecloud.servicegateway.updateservicegateway"
    ]
  })

  actions {
    actions {
      # Critical: Add notification action so the rule passes the check
      action_type = "ONS"   # Sends to Notifications service (ONS)
      topic_id    = "<example_resource_id>"  # ONS topic OCID
    }
  }
}

References

https://docs.oracle.com/en-us/iaas/Content/Events/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_network_gateway_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires