Back to Checks
oraclecloud

Event rule for IdP group mapping changes has notification actions configured

events_rule_idp_group_mapping_changes
Service: eventsSeverity: high
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:EventRule

OCI Events rules monitor IdP group mapping changes with notification actions for com.oraclecloud.identitycontrolplane.addidpgroupmapping, com.oraclecloud.identitycontrolplane.removeidpgroupmapping, and com.oraclecloud.identitycontrolplane.updateidpgroupmapping.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without alerts on IdP group mapping changes, federated users can gain unauthorized group memberships unnoticed, enabling privilege escalation and broader access to OCI resources. This undermines confidentiality and integrity, and may affect availability through misuse of elevated permissions.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_idp_group_mapping_changes

Recommendation

Define Events rules for IdP group mapping changes (com.oraclecloud.identitycontrolplane.addidpgroupmapping, ...removeidpgroupmapping, ...updateidpgroupmapping) and route notifications to monitored channels via OCI Notifications. Apply least privilege and separation of duties, and integrate alerts with a SIEM for defense in depth.

Remediation

CLI

oci events rule create --compartment-id <COMPARTMENT_OCID> --display-name <example_resource_name> --is-enabled true --condition '{"eventType":["com.oraclecloud.identitycontrolplane.addidpgroupmapping","com.oraclecloud.identitycontrolplane.removeidpgroupmapping","com.oraclecloud.identitycontrolplane.updateidpgroupmapping"]}' --actions '{"actions":[{"actionType":"ONS","isEnabled":true,"topicId":"<TOPIC_OCID>"}]}'

Terraform

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"
  is_enabled     = true

  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.addidpgroupmapping", # critical: monitor IdP group mapping add
      "com.oraclecloud.identitycontrolplane.removeidpgroupmapping", # critical: monitor IdP group mapping remove
      "com.oraclecloud.identitycontrolplane.updateidpgroupmapping"  # critical: monitor IdP group mapping update
    ]
  })

  actions {
    actions {
      action_type = "ONS"                       # critical: adds notification action
      topic_id    = "<example_resource_id>"     # critical: ONS topic to notify
      is_enabled  = true
    }
  }
}

Other

1In OCI Console, go to Observability & Management > Events Service > Rules
2Click Create rule
3Condition: add Event types:
4- com.oraclecloud.identitycontrolplane.addidpgroupmapping
5- com.oraclecloud.identitycontrolplane.removeidpgroupmapping
6- com.oraclecloud.identitycontrolplane.updateidpgroupmapping
7Actions: Add action > Notifications (ONS) and select the target Topic
8Ensure Rule is Enabled and click Create

Check Code

"""Check Ensure a notification is configured for IdP group mapping changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_idp_group_mapping_changes(Check):
    """Check Ensure a notification is configured for IdP group mapping changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_idp_group_mapping_changes check."""
        findings = []

        # OCI CIS 3.1 renamed create/delete to add/remove. Accept both to keep
        # compatibility with rules that still use the legacy event names.
        current_required_event_types = [
            "com.oraclecloud.identitycontrolplane.addidpgroupmapping",
            "com.oraclecloud.identitycontrolplane.removeidpgroupmapping",
            "com.oraclecloud.identitycontrolplane.updateidpgroupmapping",
        ]
        legacy_required_event_types = [
            "com.oraclecloud.identitycontrolplane.createidpgroupmapping",
            "com.oraclecloud.identitycontrolplane.deleteidpgroupmapping",
            "com.oraclecloud.identitycontrolplane.updateidpgroupmapping",
        ]

        # Filter rules that monitor IdP group mapping changes
        matching_rules = []
        seen_rule_ids = set()
        for required_event_types in (
            current_required_event_types,
            legacy_required_event_types,
        ):
            for rule, condition in filter_rules_by_event_types(
                events_client.rules, required_event_types
            ):
                rule_id = getattr(rule, "id", None) or id(rule)
                if rule_id not in seen_rule_ids:
                    matching_rules.append((rule, condition))
                    seen_rule_ids.add(rule_id)

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor IdP group mapping changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors IdP group mapping changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Idp Group Mapping Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor IdP group mapping changes."
            )
            findings.append(report)

        return findings

References