IAM user has a valid email address

Check ID: identity_user_valid_email_address
Provider: Oracle Cloud (OCI)
Service: identity
Severity: LOW
Categories: identity-access
Resource type: User

What this check verifies

OCI IAM user accounts are evaluated for a populated email attribute that resembles an address (contains @). Accounts missing this attribute or with malformed values are identified.

Risk

Missing or invalid emails break account recovery and MFA flows, silencing security notifications. This degrades availability for legitimate users and enables attacker persistence on compromised or orphaned accounts, delaying containment and risking unauthorized data access.

Recommendation

Ensure every user has a unique, verified, and monitored email. Enforce this at creation and through periodic reviews; disable or remove accounts with invalid addresses. Prefer federated identities to minimize local users, and apply least privilege with clear ownership to support lifecycle management.

Remediation

CLI
Terraform
Dashboard steps

oci iam user update —user-id <example_resource_id> —email <[email protected]>

# Ensure the user has a valid email address
resource "oci_identity_user" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  name           = "<example_resource_name>"
  email          = "<[email protected]>" # Critical: sets a valid email (contains '@') to pass the check
}

References

https://docs.oracle.com/en-us/iaas/Content/Identity/home.htm

Where this check fires

This check runs on every scheduled scan against your Oracle Cloud (OCI) account. Findings appear at Cloud Security → Findings filterable by Check ID = identity_user_valid_email_address. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Oracle Cloud (OCI) checks

User with a console password has MFA enabled Integration Cloud instance restricts network access

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires