Back to Checks
oraclecloud

Event rule monitoring VCN changes has notification actions configured

events_rule_vcn_changes
Service: eventsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:EventRule

OCI Events rules exist to capture VCN lifecycle changes (create, update, delete) via event types com.oraclecloud.virtualnetwork.createvcn, com.oraclecloud.virtualnetwork.updatevcn, com.oraclecloud.virtualnetwork.deletevcn, and include notification actions.

Prowler logoProwlerprowler-provider-oraclecloud

Risk

Missing alerts for VCN changes reduces visibility of network perimeter modifications.

Attackers or mistakes can silently open Internet access, alter routes for data exfiltration, or delete gateways/subnets, harming confidentiality and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler oraclecloud --checks events_rule_vcn_changes

Recommendation

Create and enable Events rules for VCN lifecycle changes (create, update, delete) with notification actions to monitored channels.

Apply least privilege to manage rules and notifications, integrate alerts with incident response, and periodically test to support defense in depth.

Remediation

CLI

oci events rule create --compartment-id <compartment_ocid> --display-name <example_resource_name> --is-enabled true --condition '{"eventType":["com.oraclecloud.virtualnetwork.createvcn","com.oraclecloud.virtualnetwork.deletevcn","com.oraclecloud.virtualnetwork.updatevcn"]}' --actions '{"actions":[{"actionType":"ONS","isEnabled":true,"topicId":"<example_resource_id>"}]}'

Terraform

resource "oci_events_rule" "<example_resource_name>" {
  compartment_id = var.compartment_id
  display_name   = "<example_resource_name>"
  is_enabled     = true

  # critical: monitor VCN create/delete/update events
  condition = jsonencode({
    eventType = [
      "com.oraclecloud.virtualnetwork.createvcn",
      "com.oraclecloud.virtualnetwork.deletevcn",
      "com.oraclecloud.virtualnetwork.updatevcn"
    ]
  })

  actions {
    actions {
      action_type = "ONS"         # critical: send notifications via OCI Notifications
      topic_id    = var.topic_id   # critical: target Notifications topic
    }
  }
}

Other

1In OCI Console, go to Observability & Management > Events Service > Rules
2Click Create rule and enter a name; set Rule state to Enabled
3Under Conditions, add Event types: com.oraclecloud.virtualnetwork.createvcn, com.oraclecloud.virtualnetwork.deletevcn, com.oraclecloud.virtualnetwork.updatevcn
4Under Actions, add Notification and select the target Notifications topic
5Click Create to save the rule

Check Code

"""Check Ensure a notification is configured for VCN changes."""

from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.events.events_client import events_client
from prowler.providers.oraclecloud.services.events.lib.helpers import (
    check_event_rule_has_notification_actions,
    filter_rules_by_event_types,
)


class events_rule_vcn_changes(Check):
    """Check Ensure a notification is configured for VCN changes."""

    def execute(self) -> Check_Report_OCI:
        """Execute the events_rule_vcn_changes check."""
        findings = []

        # Required event types for VCN changes
        required_event_types = [
            "com.oraclecloud.virtualnetwork.createvcn",
            "com.oraclecloud.virtualnetwork.deletevcn",
            "com.oraclecloud.virtualnetwork.updatevcn",
        ]

        # Filter rules that monitor VCN changes
        matching_rules = filter_rules_by_event_types(
            events_client.rules, required_event_types
        )

        # Create findings for each matching rule
        for rule, _ in matching_rules:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource=rule,
                region=rule.region,
                resource_name=rule.name,
                resource_id=rule.id,
                compartment_id=rule.compartment_id,
            )

            # Check if the rule has notification actions
            if check_event_rule_has_notification_actions(rule):
                report.status = "PASS"
                report.status_extended = f"Event rule '{rule.name}' is configured to monitor VCN changes with notifications."
            else:
                report.status = "FAIL"
                report.status_extended = f"Event rule '{rule.name}' monitors VCN changes but does not have notification actions configured."

            findings.append(report)

        # If no matching rules found, create a single FAIL finding
        if not findings:
            report = Check_Report_OCI(
                metadata=self.metadata(),
                resource={},
                region="global",
                resource_name="Vcn Changes Event Rule",
                resource_id=events_client.audited_tenancy,
                compartment_id=events_client.audited_tenancy,
            )
            report.status = "FAIL"
            report.status_extended = "No event rules configured to monitor VCN changes."
            findings.append(report)

        return findings

References