Back to Checks
oraclecloud

Event rule monitoring IAM policy changes has notification actions configured

events_rule_iam_policy_changes
Service: eventsSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:EventRule

OCI Events rules configured to capture IAM policy create, update, and delete events (com.oraclecloud.identitycontrolplane.createpolicy, com.oraclecloud.identitycontrolplane.updatepolicy, com.oraclecloud.identitycontrolplane.deletepolicy) and include a notification action.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without alerts on IAM policy changes, permissions can be altered unnoticed, enabling privilege escalation, unauthorized data access, and persistent footholds. Delayed visibility degrades confidentiality and integrity and slows incident response across compartments.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_iam_policy_changes

Recommendation

Create OCI Events rules for ...createpolicy, ...updatepolicy, and ...deletepolicy with a notification action to trusted channels. Enforce least privilege on IAM and Events administration, require change approvals, and routinely test alerting to ensure rapid detection.

Remediation

CLI

oci events rule create --compartment-id <compartment_ocid> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.identitycontrolplane.createpolicy","com.oraclecloud.identitycontrolplane.deletepolicy","com.oraclecloud.identitycontrolplane.updatepolicy"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<topic_ocid>"}]}'

Terraform

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = var.compartment_id
  display_name   = "<example_resource_name>"
  is_enabled     = true

  # Critical: monitor IAM policy create/delete/update events
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.createpolicy",
      "com.oraclecloud.identitycontrolplane.deletepolicy",
      "com.oraclecloud.identitycontrolplane.updatepolicy"
    ]
  })

  actions {
    actions {
      action_type = "ONS"        # Critical: adds a Notifications action
      topic_id    = var.topic_id  # Critical: target Notifications topic
    }
  }
}

Other

1In the OCI Console, go to Observability & Management > Events Service
2Click Create Rule and set Display Name (leave Enabled)
3Under Conditions, choose Event Type, set Service Name to Identity and Access Management, and select:
4- com.oraclecloud.identitycontrolplane.createpolicy
5- com.oraclecloud.identitycontrolplane.deletepolicy
6- com.oraclecloud.identitycontrolplane.updatepolicy
7Under Actions, select Action Type: Notifications, then choose the target Topic
8Click Create

Check Code

"""Check Ensure a notification is configured for IAM policy changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_iam_policy_changes(Check):
    """Check Ensure a notification is configured for IAM policy changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_iam_policy_changes check."""
        findings = []

        # Required event types for IAM policy changes
        required_event_types = [
            "com.oraclecloud.identitycontrolplane.createpolicy",
            "com.oraclecloud.identitycontrolplane.deletepolicy",
            "com.oraclecloud.identitycontrolplane.updatepolicy",
        ]

        # Filter rules that monitor IAM policy changes
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor IAM policy changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors IAM policy changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Iam Policy Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor IAM policy changes."
            )
            findings.append(report)

        return findings

References