Skip to main content

OCI Monitoring Should Have Event Rule For IAM Group Changes

More Info:​

Ensure Event Rules capture IAM Group creation, updates, and deletions. Real-time event triggers for group mutation enable automated remediation pipelines to revert unauthorized privilege grants.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are the exact steps in the OCI Console to set up an Event Rule that alerts on IAM group changes (via Notifications / “alerting monitoring”).

1. Prepare a Notifications Topic (for alerts)​

  1. In the OCI Console, open the Navigation Menu.
  2. Go to Developer Services → Notifications → Topics.
  3. Click Create Topic.
    • Name: iam-group-changes-topic (or similar)
    • Description: Alerts on IAM group changes
    • Click Create.
  4. Open the topic you just created.
  5. Under Subscriptions, click Create Subscription.
    • Protocol: typically Email (or HTTPS/Slack/PagerDuty as needed)
    • Email: your alert email
    • Click Create.
  6. Confirm the subscription from the email you received.

2. Create an Event Rule for IAM Group Changes​

  1. Open Navigation Menu → Observability & Management → Events Service → Rules.

  2. Make sure you are in the correct compartment where you want the rule to live.

  3. Click Create Rule.

  4. Fill in:

    • Display name: iam-group-change-rule
    • Description: Triggers on IAM group create/update/delete and membership changes
    • Rule Conditions:
      • Condition Type: Event Type
      • Rule is matching: Any of the following.

  5. Under Condition, configure events for IAM groups. Depending on your tenancy (IDCS vs IAM/Identity Domains) you will see variants, but generally:

    • Service Name / Event Source: Identity
    • Then add event types such as (names may vary slightly by console version):
      • Group - Create
      • Group - Update
      • Group - Delete
      • Group Membership - Add User
      • Group Membership - Remove User

    If using the JSON editor, a typical pattern looks like:

    {
      "eventType": [
        "com.oraclecloud.identitycontrolplane.creategroup",
        "com.oraclecloud.identitycontrolplane.updategroup",
        "com.oraclecloud.identitycontrolplane.deletegroup",
        "com.oraclecloud.identitycontrolplane.addusertogroup",
        "com.oraclecloud.identitycontrolplane.removeuserfromgroup"
      ]
    }

    Use the console’s event type picker where possible; only use JSON if you can’t find the specific types in the UI.

  6. Under Actions, click Add Action:

    • Action Type: Notifications
    • Topic: select the topic you created earlier (e.g., iam-group-changes-topic).
    • Optionally set:
      • Action Name: SendNotificationOnIAMGroupChange.

  7. Click Create Rule (and ensure the rule is in Enabled state).

3. (Optional) Test the Configuration​

  1. Make a safe IAM group change (e.g., create a test group or add/remove a test user to a test group).
  2. Confirm you receive an email (or chosen channel) alert from the Notifications topic.

This setup provides “alerting monitoring” for OCI IAM Group changes entirely via the OCI Console, using Events + Notifications.

Using CLI

Below is a simple end‑to‑end remediation using OCI CLI so that any IAM Group change triggers an event rule and sends an alert (e.g., email).

1. Prerequisites​

Make sure:

  • OCI CLI is installed and configured (oci setup config).
  • You have:
    • COMPARTMENT_OCID where you’ll create the rule and topic (often root compartment / tenancy).
    • An email address (for the notification subscription).

Export variables for convenience:

export COMPARTMENT_OCID="<your-compartment-ocid>"
export TENANCY_OCID="<your-tenancy-ocid>"   # often same as root compartment
export REGION="<your-region-identifier>"    # e.g., us-ashburn-1

2. Create a Notifications Topic​

oci ons topic create \
  --name "iam-group-change-topic" \
  --compartment-id "$COMPARTMENT_OCID" \
  --description "Alerts on IAM group changes"

Capture the topic-id from the output, or:

export TOPIC_OCID=$(oci ons topic list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all \
  --query "data[?\"name\"=='iam-group-change-topic'].id | [0]" \
  --raw-output)

3. Create an Email Subscription to the Topic​

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol EMAIL \
  --endpoint "<your-alert-email@example.com>"

Then go to your email inbox and confirm the subscription.

4. Define the Event Rule Condition (IAM Group Changes)​

Create a JSON file iam-group-events-condition.json:

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.creategroup",
    "com.oraclecloud.identitycontrolplane.updategroup",
    "com.oraclecloud.identitycontrolplane.deletegroup",
    "com.oraclecloud.identitycontrolplane.addusertogroup",
    "com.oraclecloud.identitycontrolplane.removeuserfromgroup"
  ]
}

This matches all major IAM group change events.

5. Define the Event Rule Actions (Send to Notifications)​

Create a JSON file iam-group-events-actions.json:

{
  "actions": [
    {
      "actionType": "ONS",
      "isEnabled": true,
      "description": "Send alert when IAM group changes occur",
      "topicId": "<TOPIC_OCID_PLACEHOLDER>"
    }
  ]
}

Replace <TOPIC_OCID_PLACEHOLDER> with your real $TOPIC_OCID, or generate the file with sed:

cat > iam-group-events-actions.json <<EOF
{
  "actions": [
    {
      "actionType": "ONS",
      "isEnabled": true,
      "description": "Send alert when IAM group changes occur",
      "topicId": "$TOPIC_OCID"
    }
  ]
}
EOF

6. Create the Event Rule via OCI CLI​

oci events rule create \
  --display-name "iam-group-change-rule" \
  --description "Event rule to alert on IAM group creation, update, delete, and membership changes" \
  --compartment-id "$COMPARTMENT_OCID" \
  --is-enabled true \
  --condition file://iam-group-events-condition.json \
  --actions file://iam-group-events-actions.json

This creates an Events rule in the specified compartment. Any matching IAM group event will be sent to the Notification topic, which then sends email to your subscription.

7. (Optional) Verify the Rule​

List rules:

oci events rule list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all

Trigger a test by creating/updating a group in the Console or via CLI (e.g., change a group description), then confirm you receive an email.

These steps implement “OCI Monitoring/Alerting for IAM Group Changes” fully via OCI CLI using Events + Notifications.

Using Python

Below is a minimal, step‑by‑step way to:

  1. Detect IAM Group changes using OCI Events
  2. Send alerts via OCI Notifications (which is what Monitoring “Alerting” uses for delivery)
  3. Do it programmatically with Python (OCI SDK)

1. Prerequisites​

  1. OCI Python SDK installed
pip install oci

  1. Config file (~/.oci/config) with a profile, e.g. DEFAULT

  2. IAM policies (in the tenancy root or relevant compartment):

Allow service events to use ons-topics in compartment <COMPARTMENT_NAME>
Allow service events to read compartments in tenancy
Allow service events to read groups in tenancy

If you create the topic in another compartment, adjust policy scope accordingly.

2. Create a Notifications Topic (for alerts)​

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")

ons_client = oci.ons.NotificationControlPlaneClient(config)

compartment_id = "<COMPARTMENT_OCID>"  # where you want the topic

create_topic_details = oci.ons.models.CreateTopicDetails(
    name="iam-group-changes-topic",
    compartment_id=compartment_id,
    description="Alerts for IAM group changes from Events"
)

topic = ons_client.create_topic(create_topic_details).data
print("Topic OCID:", topic.topic_id)

Add a subscription (e.g., email):

subscription_details = oci.ons.models.CreateSubscriptionDetails(
    compartment_id=compartment_id,
    topic_id=topic.topic_id,
    protocol="EMAIL",
    endpoint="you@example.com"
)

sub = ons_client.create_subscription(subscription_details).data
print("Subscription OCID:", sub.id)

Confirm the subscription from your email.

3. Create an Events Rule for IAM Group Changes​

OCI IAM group events (non‑exhaustive) typically look like:

  • com.oraclecloud.identitycontrolplane.creategroup
  • com.oraclecloud.identitycontrolplane.updategroup
  • com.oraclecloud.identitycontrolplane.deletegroup
  • com.oraclecloud.identitycontrolplane.adduserstogroup
  • com.oraclecloud.identitycontrolplane.removeusersfromgroup

We’ll create a rule that matches all of these and sends the event to the Notifications topic.

events_client = oci.events.EventsClient(config)

# Compartment where the rule is defined (often the root / tenancy compartment)
rule_compartment_id = "<TENANCY_OR_COMPARTMENT_OCID>"

# Event pattern for IAM group changes
# Use identity domain / realm event types appropriate to your environment if needed
event_pattern = {
    "eventType": [
        "com.oraclecloud.identitycontrolplane.creategroup",
        "com.oraclecloud.identitycontrolplane.updategroup",
        "com.oraclecloud.identitycontrolplane.deletegroup",
        "com.oraclecloud.identitycontrolplane.adduserstogroup",
        "com.oraclecloud.identitycontrolplane.removeusersfromgroup"
    ]
}

create_rule_details = oci.events.models.CreateRuleDetails(
    compartment_id=rule_compartment_id,
    display_name="iam-group-changes-rule",
    description="Triggers on IAM group create/update/delete and membership changes",
    is_enabled=True,
    # Condition is a JSON string
    condition=oci.util.to_json(event_pattern),
    actions=oci.events.models.ActionList(
        actions=[
            oci.events.models.NotificationActionDetails(
                action_type="ONS",
                is_enabled=True,
                topic_id=topic.topic_id
            )
        ]
    )
)

rule = events_client.create_rule(create_rule_details).data
print("Rule OCID:", rule.id)

This rule will:

  • Listen for any of the IAM group change events in the tenancy/compartment scope
  • Push a message to the Notifications topic you created
  • Notifications will then send email (or other channels you configure)

4. (Optional) Tie in Monitoring Alarms​

If you specifically want Monitoring Alarm objects to send alerts (rather than directly from Events):

  1. You still use the Notifications topic for alarm delivery.
  2. You create a custom metric and a Monitoring Alarm on that metric.
  3. Your Events Rule target would be a Function or Streaming that increments a custom metric, and then the alarm fires.

That is more complex; for most “IAM group change alert” use cases, Events → Notifications is the standard pattern and is what OCI’s “alerting” usually refers to for control-plane events.

If you share your tenancy region and whether you use IAM domains, I can adjust the exact eventType values and pattern for your environment.

Using Terraform
resource "oci_events_rule" "iam_group_changes" {
  compartment_id = VAR_COMPARTMENT_OCID            # replace with your compartment OCID
  display_name   = "iam-group-changes-events-rule"
  description    = "Capture IAM group create, update, and delete events for monitoring/automation"
  is_enabled     = true

  # Match IAM group mutations
  condition = jsonencode({
    "eventType" : [
      "com.oraclecloud.identitycontrolplane.creategroup",
      "com.oraclecloud.identitycontrolplane.updategroup",
      "com.oraclecloud.identitycontrolplane.deletegroup"
    ]
  })

  # Optional: send events to an OCI Notifications topic that your monitoring/alerting consumes
  actions {
    actions {
      action_type = "ONS"
      is_enabled  = true
      topic_id    = oci_ons_notification_topic.iam_group_changes.id
    }
  }
}

resource "oci_ons_notification_topic" "iam_group_changes" {
  compartment_id = VAR_COMPARTMENT_OCID            # same or appropriate compartment OCID
  name           = "iam-group-changes-topic"
  description    = "Notifications for IAM group create/update/delete events"
}

This change is additive (new rule/topic) and does not force replacement of existing resources unless you bind this rule to an existing oci_events_rule by renaming/importing. After updating Terraform, terraform plan should show one new oci_events_rule (and oci_ons_notification_topic if added) being created with the condition listing the three IAM group event types.