OCI Monitoring Should Have Event Rule For Identity Provider

More Info:

Event rules must monitor Identity Provider configurations. An attacker modifying SAML or IdP settings can create persistent, untraceable backdoor access to the cloud environment.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Well Architected Framework
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS AWS
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
HIPAA
HITRUST CSF
ISO 27001
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
PCI
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

Below are the steps to configure an Event Rule in OCI for Identity Provider changes and wire it into alerting using the OCI Console.

1. Prerequisites

You need permissions to:
- Manage Events rules
- Manage Notifications topics/subscriptions
- Read IAM events
  (Typically manage events-rules, manage ons-topics, etc., in the target compartment.)
Decide which compartment you want the rule to apply to (usually your IAM “home” compartment or root compartment).

2. Create / Verify a Notifications Topic

In the OCI Console, open the menu and go to:
Observability & Management → Notifications.
On the Topics page, choose the correct compartment.
Click Create Topic (or select an existing topic if you already have one).
Enter:
- Name: e.g., idp-change-alerts-topic
- Description: e.g., Alerts when OCI Identity Providers are created, updated, or deleted
Click Create Topic.

Add a Subscription (email / other)

Open the topic you just created.
Click Create Subscription.
Choose Protocol (e.g., Email).
Enter the Endpoint (e.g., your email address).
Click Create.
Check your email and confirm the subscription.

3. Create an Event Rule for Identity Provider Changes

In the OCI Console, open the menu:
Observability & Management → Events Service → Rules.
Choose the compartment where you want the rule.
Click Create Rule.

Configure Basic Details

Name: idp-change-detection-rule
Description: Triggers when Identity Providers are created, updated, or deleted
Rule Status: leave as Enabled.

Set the Condition (Event Pattern)

Under Rule Conditions, choose:
- Condition Type: Event Type
Select:
- Service Name: Identity and Access Management
- Event Types: Select all that are relevant, for example (names may be shown in your region as):
  - CreateIdentityProvider
  - UpdateIdentityProvider
  - DeleteIdentityProvider
If there is a compartment scope option, ensure it covers:
- The compartment(s) where your IdPs reside (often the tenancy root).

(If the UI presents a JSON event pattern editor, ensure the eventType list includes the IdP events, e.g. com.oraclecloud.identity.createidentityprovider, updateidentityprovider, deleteidentityprovider.)

4. Attach an Action to Send Alerts

In the Actions section of the rule:
- Choose Action Type: Notifications
Select the Topic you created earlier:
idp-change-alerts-topic
Save the action.

5. Create the Rule

Review all details.
Click Create (or Create Rule).

The rule is now active: any Identity Provider create/update/delete operation will publish an event, which the rule forwards to the Notifications topic, which in turn sends alerts (email, PagerDuty, HTTPS, etc., depending on your subscriptions).

6. (Optional) Test the Setup

Make a safe change to an Identity Provider (e.g., tweak a description) or create a test IdP.
Confirm you receive the notification through your configured subscription.

This completes configuring “OCI Monitoring/Alerting” for Identity Provider changes using the Events Service + Notifications in the OCI Console.

Using CLI

Below are concise, step‑by‑step instructions to create an Event Rule for Identity Provider (IdP) changes and wire it into OCI Monitoring/Alerting using the OCI CLI.

Assumptions:

You have OCI CLI configured (oci setup config already done).
You know your:
- COMPARTMENT_OCID
- TOPIC_NAME for notifications (you can create one)
- Region/profile set in ~/.oci/config.

1. Create an OCI Notifications Topic (if you don’t already have one)

COMPARTMENT_OCID="<your_compartment_ocid>"
TOPIC_NAME="idp-change-alerts"

oci ons topic create \
  --compartment-id "$COMPARTMENT_OCID" \
  --name "$TOPIC_NAME" \
  --description "Alerts for Identity Provider configuration changes" \
  --query "data.id" \
  --raw-output

Save the output as TOPIC_OCID.

TOPIC_OCID="<output_from_previous_command>"

2. (Optional) Add a Subscription to the Topic

Example: email subscription

SUBSCRIPTION_ENDPOINT="your.email@example.com"

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol "EMAIL" \
  --endpoint "$SUBSCRIPTION_ENDPOINT"

Confirm the subscription via the email you receive.

3. Build the Event Rule Condition for IdP Changes

Create a JSON file named idp-events-condition.json:

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createidentityprovider",
    "com.oraclecloud.identitycontrolplane.updateidentityprovider",
    "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
  ]
}

These event types cover create, update, and delete of Identity Providers.

4. Create the Event Rule with Action to Send to Notifications

Create a JSON file for actions, idp-events-actions.json:

{
  "actions": [
    {
      "actionType": "ONS",
      "isEnabled": true,
      "description": "Send IdP change events to Notifications topic",
      "topicId": "<TOPIC_OCID>"
    }
  ]
}

Replace <TOPIC_OCID> with the real OCID (or use env substitution before calling).

Now create the Event Rule:

RULE_DISPLAY_NAME="IdentityProvider-Change-Rule"

oci events rule create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$RULE_DISPLAY_NAME" \
  --is-enabled true \
  --condition "$(cat idp-events-condition.json)" \
  --actions "$(cat idp-events-actions.json)"

This creates an Event Rule that:

Listens for Identity Provider create/update/delete events in the compartment.
Sends those events to your Notifications topic.

5. (Optional) Confirm the Rule

List rules:

oci events rule list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all

Show rule details:

RULE_OCID="<rule_ocid_from_list>"

oci events rule get --rule-id "$RULE_OCID"

6. (Optional) Integrate with Monitoring Alarms (if needed)

If you want Monitoring alarms (metrics-based) in addition to Event Notifications, the common pattern is:

Use Event Rule → Service Connector → Logging or Streaming.
From logs/stream, derive metrics or alerts.

Most compliance checks for “Event Rule for Identity Provider Changes” are satisfied simply by the Event Rule + Notifications created above.

If you tell me your exact compartment OCID and preferred notification type (email / Slack via HTTPS / PagerDuty, etc.), I can give you the exact ready‑to‑paste CLI commands.

Using Python

Below is a practical way to set up an OCI Event Rule that detects Identity Provider changes and triggers an alert using Python and the OCI SDK.

1. Prerequisites

OCI CLI config file (~/.oci/config) with a profile that has:

events-rules-manage
ons-topics-manage
ons-subscriptions-manage

Permissions in a policy such as:

allow group <your_group> to manage events-rules in compartment <your_compartment_name>
allow group <your_group> to manage ons-topics in compartment <your_compartment_name>
allow group <your_group> to manage ons-subscriptions in compartment <your_compartment_name>

Python packages:
```
pip install oci
```
Know your:
- compartment_ocid
- region
- Notification target email (or HTTPS endpoint).

2. What we’re creating

Notifications Topic (ONS).
Subscription (e.g., email).
Events Rule that matches Identity Provider changes and sends events to the topic.

Event types for Identity Provider changes (Identity Control Plane):

com.oraclecloud.identitycontrolplane.createidentityprovider
com.oraclecloud.identitycontrolplane.updateidentityprovider
com.oraclecloud.identitycontrolplane.deleteidentityprovider

3. Python Script

import oci

# -----------------------
# CONFIG
# -----------------------
PROFILE_NAME = "DEFAULT"        # profile in ~/.oci/config
COMPARTMENT_OCID = "<your_compartment_ocid>"
ALERT_EMAIL = "you@example.com"
TOPIC_DISPLAY_NAME = "IdP-Change-Alerts-Topic"
RULE_DISPLAY_NAME = "IdP-Change-Event-Rule"
REGION = "us-ashburn-1"         # set your region if needed

# -----------------------
# INIT CLIENTS
# -----------------------
config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
# Optionally override region if you want:
config["region"] = REGION

ons_client = oci.ons.NotificationControlPlaneClient(config)
events_client = oci.events.EventsClient(config)

# -----------------------
# 1. CREATE NOTIFICATIONS TOPIC
# -----------------------
create_topic_details = oci.ons.models.CreateTopicDetails(
    name=TOPIC_DISPLAY_NAME,          # system name
    compartment_id=COMPARTMENT_OCID,
    description="Alerts for OCI Identity Provider changes"
)

topic = ons_client.create_topic(create_topic_details).data
topic_id = topic.topic_id
print(f"Created topic: {topic_id}")

# -----------------------
# 2. CREATE SUBSCRIPTION (EMAIL)
# -----------------------
create_sub_details = oci.ons.models.CreateSubscriptionDetails(
    compartment_id=COMPARTMENT_OCID,
    topic_id=topic_id,
    protocol="EMAIL",
    endpoint=ALERT_EMAIL
)
subscription = ons_client.create_subscription(create_sub_details).data
print(f"Created subscription: {subscription.id}")
print("Confirm the subscription from the email you receive before expecting alerts.")

# -----------------------
# 3. CREATE EVENT RULE FOR IDENTITY PROVIDER CHANGES
# -----------------------
# Events condition JSON string
condition = """
{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createidentityprovider",
    "com.oraclecloud.identitycontrolplane.updateidentityprovider",
    "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
  ]
}
""".strip()

# Action: send event to Notifications topic
action_details = oci.events.models.ActionDetails(
    action_type="ONS",
    is_enabled=True,
    description="Send IdP change events to Notifications",
    topic_id=topic_id
)

create_rule_details = oci.events.models.CreateRuleDetails(
    compartment_id=COMPARTMENT_OCID,
    display_name=RULE_DISPLAY_NAME,
    description="Trigger notification when Identity Provider is created, updated, or deleted",
    is_enabled=True,
    condition=condition,
    actions=oci.events.models.RuleActions(
        actions=[action_details]
    )
)

rule = events_client.create_rule(create_rule_details).data
print(f"Created event rule: {rule.id}")
print("Event rule is enabled and will alert on IdP changes.")

4. Verification steps

Confirm email subscription from the OCI Notifications email.
Perform a test Identity Provider change:
- Create, update, or delete an IdP in IAM (Federation → Identity Providers).
Check your inbox for alert emails triggered by the event rule.

This script fully automates the remediation: OCI Monitoring/Alerting for Identity Provider changes via Events + Notifications using Python.

Using Terraform

resource "oci_events_rule" "identity_provider_changes" {
  # Replace with the OCID of the compartment that owns your IdPs
  compartment_id = "OCID_OF_IDENTITY_COMPARTMENT"
  display_name   = "Identity Provider Configuration Change Rule"
  description    = "Triggers notifications when OCI Identity Provider configuration changes occur"
  is_enabled     = true

  # Event pattern to catch IdP configuration changes
  condition = <<EOF
{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createidentityprovider",
    "com.oraclecloud.identitycontrolplane.updateidentityprovider",
    "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
  ]
}
EOF

  # Route events to an Notifications topic used by your monitoring/alerting
  actions {
    actions {
      action_type = "ONS"
      is_enabled  = true
      # Replace with your Notifications topic OCID that feeds alerting/monitoring
      topic_id    = "OCID_OF_NOTIFICATIONS_TOPIC_FOR_ALERTING"
    }
  }
}

This update is in-place; it does not force replacement of the rule, only changes its match condition and target. After applying, terraform plan should show the oci_events_rule.identity_provider_changes either being created or having its condition, is_enabled, and/or actions updated to match the above.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Prerequisites​

2. Create / Verify a Notifications Topic​

Add a Subscription (email / other)​

3. Create an Event Rule for Identity Provider Changes​

Configure Basic Details​

Set the Condition (Event Pattern)​

4. Attach an Action to Send Alerts​

5. Create the Rule​

6. (Optional) Test the Setup​

1. Create an OCI Notifications Topic (if you don’t already have one)​

2. (Optional) Add a Subscription to the Topic​

3. Build the Event Rule Condition for IdP Changes​

4. Create the Event Rule with Action to Send to Notifications​

5. (Optional) Confirm the Rule​

6. (Optional) Integrate with Monitoring Alarms (if needed)​

1. Prerequisites​

2. What we’re creating​

3. Python Script​

4. Verification steps​

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prerequisites

2. Create / Verify a Notifications Topic

Add a Subscription (email / other)

3. Create an Event Rule for Identity Provider Changes

Configure Basic Details

Set the Condition (Event Pattern)

4. Attach an Action to Send Alerts

5. Create the Rule

6. (Optional) Test the Setup

1. Create an OCI Notifications Topic (if you don’t already have one)

2. (Optional) Add a Subscription to the Topic

3. Build the Event Rule Condition for IdP Changes

4. Create the Event Rule with Action to Send to Notifications

5. (Optional) Confirm the Rule

6. (Optional) Integrate with Monitoring Alarms (if needed)

1. Prerequisites

2. What we’re creating

3. Python Script

4. Verification steps