Event rule for user changes has notifications

Check ID: events_rule_user_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: HIGH
Categories: identity-access, logging
Resource type: EventRule

What this check verifies

OCI Events rules targeting IAM user changes (e.g., com.oraclecloud.identitycontrolplane.createuser and related update/delete/state events) are assessed for attached notification actions. The finding indicates which rules listen for these events and whether they are configured to emit alerts.

Risk

Absent alerts on user lifecycle events, unauthorized account creation, privilege escalation, or re-enabling disabled users may go undetected. This delays containment, enabling persistence and lateral movement that erode confidentiality and integrity, and introduces audit gaps reducing accountability.

Recommendation

Create and maintain Events rules for IAM user lifecycle changes and attach reliable notification actions to security-owned channels (SIEM, paging, email, chat). Enforce least privilege and separation of duties on rule management, and use defense in depth by correlating alerts with audit logs and automating containment.

Remediation

CLI
Terraform
Dashboard steps

oci events rule create --compartment-id <COMPARTMENT_OCID> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.identitycontrolplane.createuser","com.oraclecloud.identitycontrolplane.deleteuser","com.oraclecloud.identitycontrolplane.updateuser","com.oraclecloud.identitycontrolplane.updateusercapabilities","com.oraclecloud.identitycontrolplane.updateuserstate"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<TOPIC_OCID>"}]}'

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"

  # Critical: monitor IAM user change event types
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.createuser",
      "com.oraclecloud.identitycontrolplane.deleteuser",
      "com.oraclecloud.identitycontrolplane.updateuser",
      "com.oraclecloud.identitycontrolplane.updateusercapabilities",
      "com.oraclecloud.identitycontrolplane.updateuserstate",
    ]
  })

  actions {
    actions {
      action_type = "ONS"            # Critical: notification action type
      topic_id    = "<example_resource_id>" # Critical: ONS topic to notify
    }
  }
}

References

https://docs.oracle.com/en-us/iaas/Content/Events/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_user_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

Event rule for security list changes has notifications Event rule for VCN changes has notifications

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires