Check ID: events_rule_vcn_changes
Provider: Oracle Cloud (OCI)
Service: events
Severity: MEDIUM
Categories: logging
Resource type: EventRule

What this check verifies

OCI Events rules exist to capture VCN lifecycle changes (create, update, delete) via event types com.oraclecloud.virtualnetwork.createvcn, com.oraclecloud.virtualnetwork.updatevcn, com.oraclecloud.virtualnetwork.deletevcn, and include notification actions.

Risk

Missing alerts for VCN changes reduces visibility of network perimeter modifications. Attackers or mistakes can silently open Internet access, alter routes for data exfiltration, or delete gateways/subnets, harming confidentiality and availability.

Recommendation

Create and enable Events rules for VCN lifecycle changes (create, update, delete) with notification actions to monitored channels. Apply least privilege to manage rules and notifications, integrate alerts with incident response, and periodically test to support defense in depth.

Remediation

oci events rule create --compartment-id <compartment_ocid> --display-name <example_resource_name> --is-enabled true --condition '{"eventType":["com.oraclecloud.virtualnetwork.createvcn","com.oraclecloud.virtualnetwork.deletevcn","com.oraclecloud.virtualnetwork.updatevcn"]}' --actions '{"actions":[{"actionType":"ONS","isEnabled":true,"topicId":"<example_resource_id>"}]}'

References

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = events_rule_vcn_changes. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Oracle Cloud (OCI) checks