Event rule for route table changes has notifications

Check ID: events_rule_route_table_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: logging
Resource type: EventRule

What this check verifies

OCI Events rules for VCN route tables monitor lifecycle and compartment changes and include notification actions. The evaluation looks for rules that capture create, update, delete, and changeCompartment events for route tables and send notifications.

Risk

Without notifications on route table changes, routing tampering can persist unnoticed:

Exposure of private subnets to the Internet
Traffic hijack or blackholing
Segmentation bypass enabling lateral movement This threatens confidentiality, integrity, and availability.

Recommendation

Create an Events rule that captures route table create, update, delete, and changeCompartment events and routes them to notifications used by on-call and SIEM. Enforce least privilege on route edits, require change approvals, and apply defense in depth with auditing and automated response.

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --compartment-id <example_compartment_ocid> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.virtualnetwork.changeroutetablecompartment","com.oraclecloud.virtualnetwork.createroutetable","com.oraclecloud.virtualnetwork.deleteroutetable","com.oraclecloud.virtualnetwork.updateroutetable"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>"}]}'

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_compartment_ocid>"
  display_name   = "<example_resource_name>"

  condition = jsonencode({
    eventType = [
      "com.oraclecloud.virtualnetwork.changeroutetablecompartment", # critical: monitor route table change events
      "com.oraclecloud.virtualnetwork.createroutetable",
      "com.oraclecloud.virtualnetwork.deleteroutetable",
      "com.oraclecloud.virtualnetwork.updateroutetable"
    ]
  })

  actions {
    actions {
      action_type = "ONS"                   # critical: adds notification action
      topic_id    = "<example_resource_id>" # critical: ONS topic to receive notifications
    }
  }
}

References

https://docs.oracle.com/en-us/iaas/Content/Events/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_route_table_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Event rule for NSG changes has notifications Event rule for security list changes has notifications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires