Back to Checks
oraclecloud

Event rule for route table changes has notification actions configured

events_rule_route_table_changes
Service: eventsSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:EventRule

OCI Events rules for VCN route tables monitor lifecycle and compartment changes and include notification actions.

The evaluation looks for rules that capture create, update, delete, and changeCompartment events for route tables and send notifications.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Without notifications on route table changes, routing tampering can persist unnoticed:

  • Exposure of private subnets to the Internet
  • Traffic hijack or blackholing
  • Segmentation bypass enabling lateral movement This threatens confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_route_table_changes

Recommendation

Create an Events rule that captures route table create, update, delete, and changeCompartment events and routes them to notifications used by on-call and SIEM. Enforce least privilege on route edits, require change approvals, and apply defense in depth with auditing and automated response.

Remediation

CLI

oci events rule create --compartment-id <example_compartment_ocid> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.virtualnetwork.changeroutetablecompartment","com.oraclecloud.virtualnetwork.createroutetable","com.oraclecloud.virtualnetwork.deleteroutetable","com.oraclecloud.virtualnetwork.updateroutetable"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<example_resource_id>"}]}'

Terraform

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_compartment_ocid>"
  display_name   = "<example_resource_name>"

  condition = jsonencode({
    eventType = [
      "com.oraclecloud.virtualnetwork.changeroutetablecompartment", # critical: monitor route table change events
      "com.oraclecloud.virtualnetwork.createroutetable",
      "com.oraclecloud.virtualnetwork.deleteroutetable",
      "com.oraclecloud.virtualnetwork.updateroutetable"
    ]
  })

  actions {
    actions {
      action_type = "ONS"                   # critical: adds notification action
      topic_id    = "<example_resource_id>" # critical: ONS topic to receive notifications
    }
  }
}

Other

1In OCI Console, go to Observability & Management > Events Service > Rules.
2Click Create rule and select the target Compartment; set a Display name.
3In Condition, add event types:
4- com.oraclecloud.virtualnetwork.changeroutetablecompartment
5- com.oraclecloud.virtualnetwork.createroutetable
6- com.oraclecloud.virtualnetwork.deleteroutetable
7- com.oraclecloud.virtualnetwork.updateroutetable
8In Actions, add Notifications (ONS) and select the desired Topic.
9Ensure the rule is Enabled and click Create.

Check Code

"""Check Ensure a notification is configured for route table changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_route_table_changes(Check):
    """Check Ensure a notification is configured for route table changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_route_table_changes check."""
        findings = []

        # Required event types for route table changes
        required_event_types = [
            "com.oraclecloud.virtualnetwork.changeroutetablecompartment",
            "com.oraclecloud.virtualnetwork.createroutetable",
            "com.oraclecloud.virtualnetwork.deleteroutetable",
            "com.oraclecloud.virtualnetwork.updateroutetable",
        ]

        # Filter rules that monitor route table changes
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor route table changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors route table changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Route Table Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor route table changes."
            )
            findings.append(report)

        return findings

References