Back to Checks
oraclecloud

Event rule monitoring user changes has notification actions configured

events_rule_user_changes
Service: eventsSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesslogging
Resource Type:EventRule

OCI Events rules targeting IAM user changes (e.g., com.oraclecloud.identitycontrolplane.createuser and related update/delete/state events) are assessed for attached notification actions.

The finding indicates which rules listen for these events and whether they are configured to emit alerts.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Absent alerts on user lifecycle events, unauthorized account creation, privilege escalation, or re-enabling disabled users may go undetected. This delays containment, enabling persistence and lateral movement that erode confidentiality and integrity, and introduces audit gaps reducing accountability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_user_changes

Recommendation

Create and maintain Events rules for IAM user lifecycle changes and attach reliable notification actions to security-owned channels (SIEM, paging, email, chat).

Enforce least privilege and separation of duties on rule management, and use defense in depth by correlating alerts with audit logs and automating containment.

Remediation

CLI

oci events rule create --compartment-id <COMPARTMENT_OCID> --display-name <example_resource_name> --condition '{"eventType":["com.oraclecloud.identitycontrolplane.createuser","com.oraclecloud.identitycontrolplane.deleteuser","com.oraclecloud.identitycontrolplane.updateuser","com.oraclecloud.identitycontrolplane.updateusercapabilities","com.oraclecloud.identitycontrolplane.updateuserstate"]}' --actions '{"actions":[{"actionType":"ONS","topicId":"<TOPIC_OCID>"}]}'

Terraform

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = "<example_resource_id>"
  display_name   = "<example_resource_name>"

  # Critical: monitor IAM user change event types
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.identitycontrolplane.createuser",
      "com.oraclecloud.identitycontrolplane.deleteuser",
      "com.oraclecloud.identitycontrolplane.updateuser",
      "com.oraclecloud.identitycontrolplane.updateusercapabilities",
      "com.oraclecloud.identitycontrolplane.updateuserstate",
    ]
  })

  actions {
    actions {
      action_type = "ONS"            # Critical: notification action type
      topic_id    = "<example_resource_id>" # Critical: ONS topic to notify
    }
  }
}

Other

1In the OCI Console, go to Observability & Management > Events Service > Rules and click Create Rule
2Select the Compartment and enter a Name
3Under Rule Conditions, set Event Type to include:
4- com.oraclecloud.identitycontrolplane.createuser
5- com.oraclecloud.identitycontrolplane.deleteuser
6- com.oraclecloud.identitycontrolplane.updateuser
7- com.oraclecloud.identitycontrolplane.updateusercapabilities
8- com.oraclecloud.identitycontrolplane.updateuserstate
9Under Actions, add a Notification action and select the desired Notifications (ONS) Topic
10Click Create

Check Code

"""Check Ensure a notification is configured for user changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_user_changes(Check):
    """Check Ensure a notification is configured for user changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_user_changes check."""
        findings = []

        # Required event types for user changes
        required_event_types = [
            "com.oraclecloud.identitycontrolplane.createuser",
            "com.oraclecloud.identitycontrolplane.deleteuser",
            "com.oraclecloud.identitycontrolplane.updateuser",
            "com.oraclecloud.identitycontrolplane.updateusercapabilities",
            "com.oraclecloud.identitycontrolplane.updateuserstate",
        ]

        # Filter rules that monitor user changes
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor user changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors user changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="User Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = (
                "No event rules configured to monitor user changes."
            )
            findings.append(report)

        return findings

References