Skip to main content

OCI Monitoring Should Have Event Rule For IAM User Changes

More Info:​

Ensure Event Rules capture IAM User modifications. Tracking user lifecycle events ensures rogue accounts created by threat actors are instantly flagged and disabled.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are the exact steps in the OCI Console to set up alerting for IAM user changes using Events + Notifications (which is what OCI “monitoring” for these changes relies on).

1. Prepare a Notification Channel (Topic + Subscription)​

  1. Sign in to the OCI Console.
  2. In the left hamburger menu, go to Developer Services → Notifications.
  3. Make sure you’re in the correct Compartment (top-left compartment selector).

1.1 Create a Topic​

  1. Click Create Topic.
  2. Enter:
    • Name: e.g., iam-user-changes-topic
    • Description: e.g., Notifies on IAM user create/update/delete
  3. Click Create.

1.2 Create a Subscription (e.g., Email)​

  1. On the topic detail page you just created, under Subscriptions, click Create Subscription.
  2. Choose Protocol (e.g., Email).
  3. Enter your Email address (or HTTPS/Slack/other endpoint if desired).
  4. Click Create.
  5. Confirm the email:
    • Check your inbox and click the confirmation link in the OCI notification email.
    • Status in OCI will change from Pending to Active once confirmed.

2. Create an Event Rule for IAM User Changes​

  1. In the OCI Console, go to Observability & Management → Events Service.
  2. Ensure you are in the same Region and desired Compartment.
  3. Click Create Rule.

2.1 Basic Rule Settings​

  1. Enter:
    • Name: e.g., iam-user-changes-rule
    • Description: Triggers when IAM users are created, updated, or deleted
    • State: ensure Enabled is selected.

2.2 Define the Event Pattern (Filter)​

Under Rule Conditions (Event Pattern):

  1. For Service Name, select:
    Identity

  2. For Event Type, add event types related to user changes. Common ones:

    • com.oraclecloud.identitycontrolplane.createuser
    • com.oraclecloud.identitycontrolplane.updateuser
    • com.oraclecloud.identitycontrolplane.deleteuser

    Depending on your tenancy/version, you may see them grouped as:

    • Identity - CreateUser
    • Identity - UpdateUser
    • Identity - DeleteUser

    Select all that apply to user lifecycle changes in your environment.

  3. (Optional) Use Attributes / Advanced Filtering (JSON) to:

    • Limit to a specific compartment or tenancy,
    • Or filter by certain user names or tags, if needed.

For most cases, selecting the Identity service and the three event types (create, update, delete) is enough.

3. Attach the Notification Action​

  1. Under Actions, select Notifications.

  2. For Topic, choose the topic you created earlier, e.g., iam-user-changes-topic.

  3. (Optional) You can add multiple actions if you want (e.g., Notifications + Function).

  4. Click Create Rule.

4. Validate the Configuration​

  1. Perform a test IAM user change, e.g.:
    • Create a test user, or
    • Update an existing user (e.g., change description), or
    • Delete a test user.
  2. Wait a few minutes and verify:
    • The email (or other subscription) receives a notification.
    • If not, confirm:
      • The rule is Enabled.
      • The correct event types are selected.
      • Your subscription is in Active state.

This completes remediation: OCI Events now detects IAM user changes and uses Notifications to alert you (which is the standard “Monitoring/Alerting” pattern for IAM changes in OCI).

Using CLI

Below are concise, CLI‑focused steps to ensure OCI Monitoring/Alerting is configured via an Event Rule that triggers on IAM User changes.

Assumptions (adjust as needed):

  • You have oci CLI configured.
  • You know your Tenancy OCID, Compartment OCID, and Region.
  • You want alerts via OCI Notifications (email) and/or to trigger other actions.

1. Set environment variables (for convenience)​

export COMPARTMENT_OCID="<your-compartment-ocid>"   # usually root compartment for IAM
export TENANCY_OCID="<your-tenancy-ocid>"
export REGION="<your-region>"                        # e.g., us-ashburn-1
oci setup config # if not already done

Ensure your CLI profile has the correct region or set:

export OCI_CLI_REGION="$REGION"

2. Create a Notifications topic for IAM user change alerts​

oci ons topic create \
  --name "iam-user-change-alerts" \
  --compartment-id "$COMPARTMENT_OCID" \
  --description "Alerts for IAM user create/update/delete events" \
  --region "$REGION"

Capture the Topic OCID from the response:

export TOPIC_OCID="<OCID-from-previous-command>"

3. Create a subscription (e.g., email)​

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol "EMAIL" \
  --endpoint "<your-email@example.com>" \
  --region "$REGION"

Confirm the email and set the subscription to "CONFIRMED".

4. Add IAM policy so Events can publish to Notifications​

In the root compartment (tenancy level), create a policy (if not already present):

oci iam policy create \
  --name "events-publish-to-notifications" \
  --compartment-id "$TENANCY_OCID" \
  --description "Allow Events service to publish to Notifications topics" \
  --statements '[
    "Allow service events to use ons-topics in tenancy"
  ]'

5. Create an Events rule for IAM user changes​

Identity events for users typically include: com.oraclecloud.identitycontrolplane.createuser, updateuser, deleteuser, etc.
You can filter by these event types. Example rule:

  1. Create the rule (disabled by default):
oci events rule create \
  --display-name "iam-user-changes-rule" \
  --compartment-id "$TENANCY_OCID" \
  --is-enabled false \
  --description "Triggers on IAM user create/update/delete events" \
  --condition '{
    "eventType": [
      "com.oraclecloud.identitycontrolplane.createuser",
      "com.oraclecloud.identitycontrolplane.updateuser",
      "com.oraclecloud.identitycontrolplane.deleteuser"
    ],
    "data": {
      "additionalDetails": {
        "compartmentId": ["'"$TENANCY_OCID"'"]
      }
    }
  }' \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "topicId": "'"$TOPIC_OCID"'",
        "isEnabled": true
      }
    ]
  }'

Note: If compartmentId filtering causes issues, remove the "data" block and just filter on eventType.

  1. Enable the rule:
oci events rule update \
  --rule-id "<rule-ocid-from-create-output>" \
  --is-enabled true

6. (Optional) Integrate with Monitoring alarms​

If you prefer to route to Monitoring via Notifications/alarm actions:

  • Use Monitoring alarms for metrics.
  • For IAM user changes (an event, not a metric), the canonical pattern is: Events → Notifications → email/Function/etc.

If you need to trigger a Function instead (for custom logic):

oci events rule update \
  --rule-id "<rule-ocid>" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "topicId": "'"$TOPIC_OCID"'",
        "isEnabled": true
      },
      {
        "actionType": "FAAS",
        "functionId": "<your-function-ocid>",
        "isEnabled": true
      }
    ]
  }'

7. Validate​

  • Make a test IAM user change (create/update/delete) via Console/CLI.
  • Confirm:
    • An Event is generated (Console → Observability & Management → Events).
    • Notification is received (email, etc.).

If you share your tenancy/compartment layout or specific constraints (e.g., use Functions, Slack, PagerDuty), I can refine the exact CLI JSON filters and actions.

Using Python

Below is a minimal, step‑by‑step way to create an OCI Event Rule for IAM user changes and wire it to alerting via Notifications, implemented using Python + OCI SDK.

1. Prerequisites​

  1. Install / upgrade SDK:

    pip install --upgrade oci

  2. Have an OCI config file (usually ~/.oci/config) with a profile, e.g.:

    [DEFAULT]
    user=ocid1.user.oc1..aaaa...
    fingerprint=...
    key_file=~/.oci/oci_api_key.pem
    tenancy=ocid1.tenancy.oc1..aaaa...
    region=us-phoenix-1

  3. You need permissions in the target compartment to:

    • Manage/Use ons-topics and ons-subscriptions
    • Manage events-rules

2. Define What You’re Alerting On​

For IAM user changes, typical OCI event types are:

  • com.oraclecloud.identitycontrolplane.createuser
  • com.oraclecloud.identitycontrolplane.updateuser
  • com.oraclecloud.identitycontrolplane.deleteuser

Event rule condition (over Identity service / all user changes):

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createuser",
    "com.oraclecloud.identitycontrolplane.updateuser",
    "com.oraclecloud.identitycontrolplane.deleteuser"
  ]
}

3. Python Script: Create Topic, Subscription, and Event Rule​

This script will:

  1. Create a Notifications topic.
  2. Create an email subscription on that topic.
  3. Create an Event Rule that matches IAM user change events and sends them to the topic.
import oci
from oci.events.models import ActionDetails, CreateRuleDetails, RuleActionDetails
from oci.ons.models import CreateTopicDetails, CreateSubscriptionDetails

# -----------------------------
# CONFIGURATION
# -----------------------------
PROFILE_NAME = "DEFAULT"  # profile in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxx"  # compartment where rule will live
TOPIC_NAME = "iam-user-changes-topic"
TOPIC_DESCRIPTION = "Alerts for OCI IAM user create/update/delete"
ALERT_EMAIL = "your-alerts@example.com"
RULE_DISPLAY_NAME = "iam-user-changes-rule"
RULE_DESCRIPTION = "Event rule for IAM user create/update/delete"

# Event condition for IAM user changes
EVENT_CONDITION = """
{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createuser",
    "com.oraclecloud.identitycontrolplane.updateuser",
    "com.oraclecloud.identitycontrolplane.deleteuser"
  ]
}
""".strip()

# -----------------------------
# SETUP CLIENTS
# -----------------------------
config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
ons_client = oci.ons.NotificationControlPlaneClient(config)
events_client = oci.events.EventsClient(config)

# -----------------------------
# 1. CREATE NOTIFICATIONS TOPIC
# -----------------------------
create_topic_details = CreateTopicDetails(
    name=TOPIC_NAME,
    compartment_id=COMPARTMENT_OCID,
    description=TOPIC_DESCRIPTION,
)

topic = ons_client.create_topic(create_topic_details).data
topic_ocid = topic.topic_id
print(f"Created topic: {topic_ocid}")

# -----------------------------
# 2. CREATE EMAIL SUBSCRIPTION
# -----------------------------
create_sub_details = CreateSubscriptionDetails(
    topic_id=topic_ocid,
    protocol="EMAIL",
    endpoint=ALERT_EMAIL,
)

subscription = ons_client.create_subscription(create_sub_details).data
print(f"Created subscription: {subscription.id}")
print("NOTE: Confirm the subscription from the email you receive.")

# -----------------------------
# 3. CREATE EVENT RULE
# -----------------------------
# Action: send to Notifications topic
action_details = ActionDetails(
    action_type="ONS",
    is_enabled=True,
    description="Send IAM user change events to Notifications topic",
    topic_id=topic_ocid,
)

rule_action_details = RuleActionDetails(
    actions=[action_details]
)

create_rule_details = CreateRuleDetails(
    display_name=RULE_DISPLAY_NAME,
    compartment_id=COMPARTMENT_OCID,
    description=RULE_DESCRIPTION,
    is_enabled=True,
    condition=EVENT_CONDITION,
    actions=rule_action_details,
)

rule = events_client.create_rule(create_rule_details).data
print(f"Created event rule: {rule.id}")

4. What This Gives You​

  • When any IAM user is created, updated, or deleted, OCI Events will:
    • Match the rule condition.
    • Send an event to the Notifications topic.
    • Notifications will immediately send an email alert to ALERT_EMAIL.

If you instead need alerts to appear in Monitoring specifically (as alarms on custom metrics), the pattern becomes:

  1. Events Rule → 2. OCI Function → 3. Function writes custom metric via Monitoring API → 4. Monitoring Alarm on that metric.

I can provide that extended flow with code if you want to push IAM changes into Monitoring custom metrics instead of (or in addition to) email notifications.

Using Terraform
resource "oci_events_rule" "iam_user_changes" {
  # Replace with your compartment OCID
  compartment_id = "OCID_OF_COMPARTMENT_TO_MONITOR"

  display_name = "iam-user-changes-events-rule"
  description  = "Capture IAM user create/update/delete events for alerting"

  is_enabled = true

  # Event pattern to match IAM user lifecycle changes
  # Adjust region/compartment IDs if you want to scope more tightly
  condition = jsonencode({
    "eventType" : [
      "com.oraclecloud.identitycontrolplane.createuser",
      "com.oraclecloud.identitycontrolplane.updateuser",
      "com.oraclecloud.identitycontrolplane.deleteuser"
    ],
    "data" : {
      "identity" : {
        "compartmentId" : [
          "OCID_OF_TENANCY_OR_IDENTITY_COMPARTMENT"
        ]
      }
    }
  })

  # Example action: send to an OCI Notifications topic for alerting
  actions {
    actions {
      action_type = "ONS"
      is_enabled  = true

      # Replace with your Notifications topic OCID
      topic_id    = "OCID_OF_OCI_NOTIFICATIONS_TOPIC"

      description = "Notify on IAM user lifecycle changes"
    }
  }

  # Optional freeform or defined tags
  freeform_tags = {
    "OWNER" = "SECURITY_TEAM"
  }
}

This change does not force replacement of other resources; Terraform will create or update this oci_events_rule in place.

Verification: terraform plan should show one oci_events_rule.iam_user_changes to be created (or updated) with is_enabled = true, the condition JSON including the three createuser/updateuser/deleteuser event types, and an ONS action pointing at your Notifications topic.