Back to Checks
oraclecloud

Event rule for identity provider changes has notification actions configured

events_rule_identity_provider_changes
Service: eventsSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesslogging
Resource Type:EventRule

OCI Events rules monitor IAM identity provider creation, update, and deletion and include a notification action. The evaluation identifies rules that filter these events and route matching activity to a notification destination.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without alerts on identity provider changes, federation can be modified unnoticed, enabling unauthorized SSO, privilege escalation, or account takeover. Delayed visibility degrades incident response and threatens confidentiality and integrity of tenant access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_identity_provider_changes

Recommendation

Configure rules to capture identity provider create, update, and delete events and send notifications to responders and SIEM. Enforce least privilege on IdP management, require approvals for changes, and test alert paths. Use defense in depth with audit logging to spot anomalous identity changes.

Remediation

CLI

oci events rule create --compartment-id <example_resource_id> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.identitycontrolplane.createidentityprovider","com.oraclecloud.identitycontrolplane.deleteidentityprovider","com.oraclecloud.identitycontrolplane.updateidentityprovider"]}' --is-enabled true --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>"}]}'

Terraform

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"
  is_enabled     = true

  # Critical: monitor identity provider create/delete/update events
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.createidentityprovider",
      "com.oraclecloud.identitycontrolplane.deleteidentityprovider",
      "com.oraclecloud.identitycontrolplane.updateidentityprovider",
    ]
  })

  actions {
    actions {
      action_type = "ONS"                 # Critical: send notifications via OCI Notifications
      topic_id    = "<example_resource_id>"  # Topic to notify
    }
  }
}

Other

1In the OCI Console, go to Observability & Management > Events Service > Rules and click Create rule
2Set Name and select the target Compartment
3In Rule condition, add event types: CreateIdentityProvider, DeleteIdentityProvider, UpdateIdentityProvider (service: Identity)
4In Actions, add Notification, select your Topic
5Ensure Enabled is On and click Create

Check Code

"""Check Ensure a notification is configured for identity provider changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_identity_provider_changes(Check):
    """Check Ensure a notification is configured for identity provider changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_identity_provider_changes check."""
        findings = []

        # Required event types for identity provider changes
        required_event_types = [
            "com.oraclecloud.identitycontrolplane.createidentityprovider",
            "com.oraclecloud.identitycontrolplane.deleteidentityprovider",
            "com.oraclecloud.identitycontrolplane.updateidentityprovider",
        ]

        # Filter rules that monitor identity provider changes
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor identity provider changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors identity provider changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Identity Provider Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor identity provider changes."
            )
            findings.append(report)

        return findings

References