IAM user has a valid email address
OCI IAM user accounts are evaluated for a populated email attribute that resembles an address (contains @). Accounts missing this attribute or with malformed values are identified.
ProwlerRisk
Missing or invalid emails break account recovery and MFA flows, silencing security notifications. This degrades availability for legitimate users and enables attacker persistence on compromised or orphaned accounts, delaying containment and risking unauthorized data access.
Run this check with Prowler
Run in Prowler Cloudprowler oraclecloud --checks identity_user_valid_email_addressRecommendation
Ensure every user has a unique, verified, and monitored email. Enforce this at creation and through periodic reviews; disable or remove accounts with invalid addresses. Prefer federated identities to minimize local users, and apply least privilege with clear ownership to support lifecycle management.
Remediation
CLI
oci iam user update --user-id <example_resource_id> --email <example_email@example.com>Terraform
# Ensure the user has a valid email address
resource "oci_identity_user" "<example_resource_name>" {
compartment_id = "<example_resource_id>"
name = "<example_resource_name>"
email = "<example_email@example.com>" # Critical: sets a valid email (contains '@') to pass the check
}Other
Check Code
"""Check Ensure all OCI IAM user accounts have a valid and current email address."""
from prowler.lib.check.models import Check, Check_Report_OCI
from prowler.providers.oraclecloud.services.identity.identity_client import (
identity_client,
)
class identity_user_valid_email_address(Check):
"""Check Ensure all OCI IAM user accounts have a valid and current email address."""
def execute(self) -> Check_Report_OCI:
"""Execute the identity_user_valid_email_address check."""
findings = []
# Check users have valid email
for user in identity_client.users:
report = Check_Report_OCI(
metadata=self.metadata(),
resource=user,
region=user.region,
resource_name=user.name,
resource_id=user.id,
compartment_id=user.compartment_id,
)
if user.email and "@" in user.email:
report.status = "PASS"
report.status_extended = f"User {user.name} has a valid email address."
else:
report.status = "FAIL"
report.status_extended = (
f"User {user.name} does not have a valid email address."
)
findings.append(report)
return findings