Ensure a notification is configured for user changes

中级别 1自动化oci

说明

It is recommended to setup an Event Rule and Notification that gets triggered when IAM Users are created, updated, deleted, capabilities updated, or state updated. Event Rules are compartment scoped and will detect events in child compartments, it is recommended to create the Event rule at the root compartment level. Users use or manage Oracle Cloud Infrastructure resources. Monitoring and alerting on changes to Users will help in identifying changes to the security posture. Passes when one ACTIVE, enabled Events rule in an accessible compartment (home region) has an enabled ONS action and a condition containing every event type: com.oraclecloud.identitycontrolplane.createuser com.oraclecloud.identitycontrolplane.deleteuser com.oraclecloud.identitycontrolplane.updateuser com.oraclecloud.identitycontrolplane.updateusercapabilities com.oraclecloud.identitycontrolplane.updateuserstate. Read-only OCI CLI calls; credentials and home region come from the CLI's normal configuration (~/.oci/config, OCI_CLI_PROFILE, OCI_CLI_AUTH). The tenancy OCID is taken from OCI_TENANCY or the first tenancy= line of the config file. A missing CLI or credential fails the check.

检查方式

审计方法: Shell 命令

shell

t=${OCI_TENANCY:-$(sed -n 's/^[[:space:]]*tenancy[[:space:]]*=[[:space:]]*//p' "${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}" 2>/dev/null | head -n 1 | tr -d '\r[:space:]')}
[ -n "$t" ] || exit 1
bad=0
cs=$(oci iam compartment list --compartment-id "$t" --compartment-id-in-subtree true --access-level ACCESSIBLE --all --query 'data[?"lifecycle-state"==`"ACTIVE"`].id' --raw-output 2>/dev/null) || exit 1
comps="$t $(printf '%s\n' "$cs" | grep -o 'ocid1\.compartment\.[^"]*')"
need="com.oraclecloud.identitycontrolplane.createuser com.oraclecloud.identitycontrolplane.deleteuser com.oraclecloud.identitycontrolplane.updateuser com.oraclecloud.identitycontrolplane.updateusercapabilities com.oraclecloud.identitycontrolplane.updateuserstate"
ok=0
for c in $comps; do
  ids=$(oci events rule list --compartment-id "$c" --all --query 'data[?"lifecycle-state"==`"ACTIVE"` && "is-enabled"==`true`].id' --raw-output 2>/dev/null) || exit 1
  for i in $(printf '%s\n' "$ids" | grep -o 'ocid1\.eventrule\.[^"]*'); do
    rule=$(oci events rule get --rule-id "$i" --query 'data.[condition, length(actions.actions[?"action-type"==`"ONS"` && "is-enabled"==`true`])]' --raw-output 2>/dev/null) || exit 1
    printf '%s\n' "$rule" | grep -Eq '^[[:space:]]*[1-9][0-9]*[[:space:]]*$' || continue
    miss=0
    for e in $need; do printf '%s\n' "$rule" | grep -qF "$e" || { miss=1; break; }; done
    [ "$miss" -eq 0 ] && { ok=1; break 2; }
  done
done
[ "$ok" -eq 1 ] && echo compliant

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Create an Events rule (oci events rule create --compartment-id <tenancy> --display-name <name> --is-enabled true --condition '{"eventType":[...]}' --actions '{"actions":[{"actionType":"ONS","isEnabled":true,"topicId":"<topic>"}]}') covering: com.oraclecloud.identitycontrolplane.createuser com.oraclecloud.identitycontrolplane.deleteuser com.oraclecloud.identitycontrolplane.updateuser com.oraclecloud.identitycontrolplane.updateusercapabilities com.oraclecloud.identitycontrolplane.updateuserstate.

属性

操作系统: 任意
标签: ocilogging
参考: CIS Oracle Cloud Infrastructure Foundations Benchmark v3.1.1 - 4.7 Ensure a notification is configured for user changes

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target oci