Back to Checks
oraclecloud

Event rule monitoring IAM group changes has notification actions configured

events_rule_iam_group_changes
Service: eventsSeverity: high
OfficialBuilt-inVerified
Categories:threat-detection
Resource Type:EventRule

OCI Events rules monitor IAM group lifecycle events (creategroup, updategroup, deletegroup) and include notification actions to generate alerts when these changes occur.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without alerts on IAM group changes, unauthorized privilege changes can persist unnoticed, enabling privilege escalation and broader access. This undermines confidentiality and integrity, and delays response to identity misuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_iam_group_changes

Recommendation

Create Events rules for IAM group create, update, and delete and route them to Notifications channels consumed by the SOC. Enforce least privilege and separation of duties on rules/topics, forward events to a SIEM, and periodically test alert delivery.

Remediation

CLI

oci events rule create --compartment-id <compartment_ocid> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.identitycontrolplane.creategroup","com.oraclecloud.identitycontrolplane.deletegroup","com.oraclecloud.identitycontrolplane.updategroup"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>"}]}'

Terraform

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"

  # Critical: Monitor IAM group changes
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.creategroup",
      "com.oraclecloud.identitycontrolplane.deletegroup",
      "com.oraclecloud.identitycontrolplane.updategroup"
    ]
  })

  actions {
    actions {
      action_type = "ONS"               # Critical: Send notifications via OCI Notifications
      topic_id    = "<example_resource_id>"  # Topic OCID for notifications
    }
  }
}

Other

1In the OCI Console, go to Observability & Management > Events Service > Rules
2Click Create rule and set Name
3In Condition, select Event types and add:
4- com.oraclecloud.identitycontrolplane.creategroup
5- com.oraclecloud.identitycontrolplane.deletegroup
6- com.oraclecloud.identitycontrolplane.updategroup
7In Actions, add Notifications and select an existing Topic
8Click Create to save the rule

Check Code

"""Check Ensure a notification is configured for IAM group changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_iam_group_changes(Check):
    """Check Ensure a notification is configured for IAM group changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_iam_group_changes check."""
        findings = []

        # Required event types for IAM group changes
        required_event_types = [
            "com.oraclecloud.identitycontrolplane.creategroup",
            "com.oraclecloud.identitycontrolplane.deletegroup",
            "com.oraclecloud.identitycontrolplane.updategroup",
        ]

        # Filter rules that monitor IAM group changes
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor IAM group changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors IAM group changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="IAM Group Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor IAM group changes."
            )
            findings.append(report)

        return findings

References