Back to Checks
oraclecloud

Tenancy has at least one notification topic with active subscriptions

events_notification_topic_and_subscription_exists
Service: eventsSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:OnsTopic

OCI Notifications is evaluated for the existence of at least one topic that has one or more subscriptions.

The focus is on whether subscribed endpoints are present to receive Events and monitoring alerts.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without subscribed topics, alerts are not delivered, reducing visibility and delaying detection of malicious or accidental changes. This undermines confidentiality (undetected data access), integrity (unauthorized config changes), and availability (unresolved outages).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_notification_topic_and_subscription_exists

Recommendation

Create a centralized Notifications topic with one or more subscriptions, and route critical Events/monitoring to it. Apply least privilege to topic management, use redundant channels, test delivery regularly, and tune filters to reduce noise. Consider escalation paths for critical alerts.

Remediation

Terraform

# Create a notification topic
resource "oci_ons_notification_topic" "<example_resource_name>" {
  compartment_id = var.compartment_ocid
  name           = "<example_resource_name>"  # Critical: creates the notification topic needed for the check
}

# Create a subscription on the topic (ensures topic has an active subscription)
resource "oci_ons_subscription" "<example_resource_name>" {
  compartment_id = var.compartment_ocid
  topic_id       = oci_ons_notification_topic.<example_resource_name>.id  # Critical: attaches the subscription to the topic
  protocol       = "ORACLE_FUNCTIONS"  # Critical: protocol that can become active without manual confirmation
  endpoint       = "<function_ocid>"   # Critical: endpoint for the subscription
}

Other

1In the OCI Console, go to Menu > Application Integration > Notifications > Topics
2Click Create Topic, enter a name, and click Create
3Open the topic, click Create Subscription
4Select a protocol (e.g., Function), choose/provide the endpoint, and click Create
5Verify the subscription lifecycle state shows Active (confirm if prompted for protocols like Email)

Check Code

"""Check Create at least one notification topic and subscription to receive monitoring alerts."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client


class events_notification_topic_and_subscription_exists(Check):
    """Check Create at least one notification topic and subscription to receive monitoring alerts."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_notification_topic_and_subscription_exists check."""
        findings = []

        # Check if at least one topic with subscriptions exists
        has_topic_with_subscription = any(
            len(topic.subscriptions) > 0 for topic in events_client.topics
        )

        # Create a single report for tenancy-level check
        # Use the first topic's region if available, otherwise use the first audited region
        region = "global"
        if events_client.topics:
            region = events_client.topics[0].region
        elif events_client.audited_regions:
            # audited_regions contains OCIRegion objects, extract the key
            first_region = events_client.audited_regions[0]
            region = (
                first_region.key if hasattr(first_region, "key") else str(first_region)
            )

        report = Check_Report_OCI(
            metadata=self.metadata(),
            resource={},
            region=region,
            resource_name="Notification Service",
            resource_id=events_client.audited_tenancy,
            compartment_id=events_client.audited_tenancy,
        )

        if has_topic_with_subscription:
            report.status = "PASS"
            report.status_extended = (
                "At least one notification topic with active subscriptions exists."
            )
        else:
            report.status = "FAIL"
            report.status_extended = (
                "No notification topics with active subscriptions found."
            )

        findings.append(report)

        return findings

References