Skip to main content

OCI Monitoring Should Have Gateway Change Alarm Configured

More Info:​

Monitor changes to Internet and Dynamic Routing Gateways. Unauthorized gateway provisioning can create illicit bridges between secure private networks and the internet.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Here’s how to configure an alert in OCI so you’re notified when gateways are changed, using only the OCI Console. This uses Events + Notifications, which is the correct way to monitor configuration changes (Monitoring service is metric-based).

1. Create a Notification Topic​

  1. In the OCI Console, open the menu (☰) and go to:
    Developer Services → Application Integration → Notifications
  2. Make sure you’re in the correct compartment.
  3. Click Create Topic.
  4. Enter:
    • Name: e.g., gateway-change-alerts-topic
    • Description: e.g., Alerts for OCI gateway create/update/delete changes
  5. Click Create.

2. Add a Subscription (e.g., Email or PagerDuty/Webhook)​

  1. On the topic you just created, click its name to open it.
  2. Under Subscriptions, click Create Subscription.
  3. Choose Protocol:
    • For email: choose Email and enter your address.
    • For webhook/Slack/PagerDuty: choose HTTPS and enter the endpoint.
  4. Click Create.
  5. For email, check your inbox and confirm the subscription.

3. Create an Events Rule for Gateway Changes​

  1. Open the menu (☰) and go to:
    Observability & Management → Events Service
  2. Pick the compartment where the gateways reside (or a higher-level compartment if you want broader coverage).
  3. Click Create Rule.
  4. Enter:
    • Rule Name: e.g., gateway-change-events-rule
    • Description: e.g., Triggers on create/update/delete of gateways
    • State: leave as Enabled.
  5. Under Rule Conditions, choose:
    • Condition Type: Event Type
  6. In Service Name, select Virtual Cloud Network (VCN) (or “Networking” depending on console wording).
  7. In Event Type, select all gateway-related change events you care about, for example:
    • CreateInternetGateway
    • UpdateInternetGateway
    • DeleteInternetGateway
    • CreateNatGateway
    • UpdateNatGateway
    • DeleteNatGateway
    • CreateDynamicRoutingGateway
    • UpdateDynamicRoutingGateway
    • DeleteDynamicRoutingGateway
    • CreateServiceGateway
    • UpdateServiceGateway
    • DeleteServiceGateway (Names may appear as com.oraclecloud.virtualnetwork.createinternetgateway etc.; select the create/update/delete events for each gateway type.)
  8. (Optional) Add Condition (Attributes) if you want to restrict to certain compartments, VCNs, or tags:
    • Example: set data.additionalDetails.compartmentId to a specific Compartment OCID.
  9. Under Actions, click + Add Action:
    • Action Type: Notifications
    • Topic: select the topic you created (gateway-change-alerts-topic).
  10. Click Create Rule.

4. (Optional) Test the Alert​

  1. Make a controlled gateway change in the target compartment, for example:
    • Edit an Internet Gateway (change display name) or
    • Create a temporary NAT Gateway and then delete it.
  2. Verify:
    • The Events rule shows recent matches.
    • You receive an email/webhook alert from the Notifications topic.

If you need the rule narrowed down (e.g., only for Internet Gateways or only in production compartments), tell me which gateway types and compartments you use, and I can give you an exact event filter JSON.

Using CLI

In OCI, “gateway change alerts” are best implemented with Events + Notifications, not a Monitoring metric alarm, because changes are configuration events, not metrics. You can still treat this as part of your alerting/monitoring posture.

Below are step‑by‑step OCI CLI commands to create an email alert whenever a gateway (e.g., Internet Gateway) is created/updated/deleted.

1. Set required variables​

Replace the values with your own and export them (or just inline them into the commands).

export COMPARTMENT_ID="<ocid.of.your.compartment>"
export REGION="<your-region-identifier>"        # e.g. us-phoenix-1
export EMAIL_ADDRESS="<your-email@example.com>"
export TOPIC_NAME="gateway-change-topic"
export SUBSCRIPTION_PROTOCOL="EMAIL"
export EVENTS_RULE_DISPLAY_NAME="gateway-change-rule"

Make sure your CLI is configured for the correct tenancy/profile and region:

oci setup config
oci iam region-subscription list
oci --region $REGION iam compartment list

2. Create a Notifications topic​

oci ons topic create \
  --name "$TOPIC_NAME" \
  --compartment-id "$COMPARTMENT_ID" \
  --region "$REGION" \
  --wait-for-state ACTIVE

Capture the topic OCID:

export TOPIC_ID=$(oci ons topic list \
  --compartment-id "$COMPARTMENT_ID" \
  --region "$REGION" \
  --name "$TOPIC_NAME" \
  --query "data[0].\"topic-id\"" \
  --raw-output)

3. Create an email subscription​

oci ons subscription create \
  --topic-id "$TOPIC_ID" \
  --protocol "$SUBSCRIPTION_PROTOCOL" \
  --endpoint "$EMAIL_ADDRESS" \
  --region "$REGION" \
  --wait-for-state PENDING

Then confirm the subscription from the email you receive; otherwise alerts won’t be delivered.

4. Create an Events rule for gateway changes​

Below is an example rule for Internet Gateway changes via the VCN service (you can expand to NAT/DRG/etc. as needed).

Create an event pattern JSON file gateway-change-pattern.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.updateinternetgateway",
    "com.oraclecloud.virtualnetwork.createinternetgateway",
    "com.oraclecloud.virtualnetwork.deleteinternetgateway"
  ],
  "data": {
    "compartmentId": [
      "<ocid.of.your.compartment>"
    ]
  }
}

Or if you want this to apply to any compartment in the tenancy, omit the compartmentId filter.

Now create the Events rule:

oci events rule create \
  --compartment-id "$COMPARTMENT_ID" \
  --display-name "$EVENTS_RULE_DISPLAY_NAME" \
  --is-enabled true \
  --condition "$(cat gateway-change-pattern.json)" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "'"$TOPIC_ID"'"
      }
    ]
  }' \
  --region "$REGION"

This rule sends a notification to the topic whenever an Internet Gateway is created, updated, or deleted.

5. (Optional) Extend to other gateway types​

Add additional eventType values in gateway-change-pattern.json as needed, for example:

  • NAT Gateway:
    • com.oraclecloud.virtualnetwork.createnatgateway
    • com.oraclecloud.virtualnetwork.updatenatgateway
    • com.oraclecloud.virtualnetwork.deletenatgateway
  • Dynamic Routing Gateway (DRG):
    • com.oraclecloud.virtualnetwork.createdrg
    • com.oraclecloud.virtualnetwork.updatedrg
    • com.oraclecloud.virtualnetwork.deletedrg

Example expanded pattern:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createinternetgateway",
    "com.oraclecloud.virtualnetwork.updateinternetgateway",
    "com.oraclecloud.virtualnetwork.deleteinternetgateway",
    "com.oraclecloud.virtualnetwork.createnatgateway",
    "com.oraclecloud.virtualnetwork.updatenatgateway",
    "com.oraclecloud.virtualnetwork.deletenatgateway",
    "com.oraclecloud.virtualnetwork.createdrg",
    "com.oraclecloud.virtualnetwork.updatedrg",
    "com.oraclecloud.virtualnetwork.deletedrg"
  ]
}

Update the rule if you change the file:

export RULE_ID=$(oci events rule list \
  --compartment-id "$COMPARTMENT_ID" \
  --display-name "$EVENTS_RULE_DISPLAY_NAME" \
  --query "data[0].id" \
  --raw-output)

oci events rule update \
  --rule-id "$RULE_ID" \
  --condition "$(cat gateway-change-pattern.json)" \
  --is-enabled true

This setup satisfies “gateway change alarm configured” using OCI’s native alerting pipeline (Audit → Events → Notifications) via the OCI CLI. If you specifically need a Monitoring alarm on a custom metric instead, you’d first send these events to a custom metric (via Service Connector Hub) and then create an oci monitoring alarm create on that metric.

Using Python

You remediate this by creating an automated alert whenever a gateway (Internet/NAT/DRG/etc.) is changed, using OCI Events + Notifications via the Python SDK.

Below is a minimal step‑by‑step plus example Python code that you can adapt.

1. Prerequisites​

  1. Install OCI SDK:
pip install oci
  1. Configure your OCI credentials (user API key) in ~/.oci/config:
[DEFAULT]
user=ocid1.user.oc1..xxxx
fingerprint=xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..xxxx
region=eu-frankfurt-1
  1. Have:
  • compartment_ocid where gateways are located
  • An email address for alerts

2. High-level steps​

  1. Create a Notifications topic.
  2. Create a subscription to that topic (e.g., email).
  3. Create an Events rule that:
    • Listens to Audit events for VCN gateways in your compartment.
    • Targets the Notifications topic.
  4. Test by updating/deleting a gateway and confirm email is sent.

3. Python example (end‑to‑end)​

Important:
You must fill in the correct event types for gateway changes. Get them from:

  • Audit log of a sample gateway change in the OCI Console, or
  • Events Console → “Create Rule” wizard → “Virtual Cloud Network (VCN)” → “Show JSON”.

Replace GATEWAY_EVENT_TYPES with the list you get.

import oci

# -------------------------
# CONFIG
# -------------------------
CONFIG_PROFILE = "DEFAULT"  # section in ~/.oci/config

TENANCY_OCID = "ocid1.tenancy.oc1..xxxx"
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxx"
REGION = "eu-frankfurt-1"

ALERT_EMAIL = "you@example.com"

TOPIC_NAME = "gateway-change-alerts"
RULE_DISPLAY_NAME = "Gateway Change Alert Rule"

# Fill these from OCI Console / Audit logs
# Example placeholders – REPLACE with actual event types:
GATEWAY_EVENT_TYPES = [
    # These names are examples; confirm from OCI before using.
    "com.oraclecloud.virtualnetwork.updateinternetgateway",
    "com.oraclecloud.virtualnetwork.deleteinternetgateway",
    "com.oraclecloud.virtualnetwork.createnatgateway",
    "com.oraclecloud.virtualnetwork.updatenatgateway",
    "com.oraclecloud.virtualnetwork.deletenatgateway",
    "com.oraclecloud.virtualnetwork.updatedynamicroutinggateway",
    "com.oraclecloud.virtualnetwork.deletedynamicroutinggateway",
]

def main():
    config = oci.config.from_file(profile_name=CONFIG_PROFILE)
    config["region"] = REGION

    ons_client = oci.ons.NotificationControlPlaneClient(config)
    events_client = oci.events.EventsClient(config)

    # -------------------------------------------------
    # 1. Create Notifications topic
    # -------------------------------------------------
    print("Creating Notifications topic...")
    create_topic_details = oci.ons.models.CreateTopicDetails(
        name=TOPIC_NAME,
        compartment_id=COMPARTMENT_OCID,
        description="Alerts when VCN gateways are created/updated/deleted."
    )
    topic = ons_client.create_topic(create_topic_details).data
    topic_id = topic.topic_id
    print(f"Topic OCID: {topic_id}")

    # -------------------------------------------------
    # 2. Create email subscription
    # -------------------------------------------------
    print("Creating email subscription...")
    create_sub_details = oci.ons.models.CreateSubscriptionDetails(
        topic_id=topic_id,
        protocol="EMAIL",
        endpoint=ALERT_EMAIL
    )
    subscription = ons_client.create_subscription(create_sub_details).data
    print(f"Subscription OCID: {subscription.id}")
    print("You must CONFIRM this subscription from the email you receive.")

    # -------------------------------------------------
    # 3. Create Events rule for gateway changes
    # -------------------------------------------------
    # Condition is JSON as a string. It filters by:
    # - compartmentId = the compartment you care about
    # - eventType in list of gateway-related events
    condition = {
        "eventType": GATEWAY_EVENT_TYPES,
        "data": {
            "compartmentId": [COMPARTMENT_OCID]
        }
    }

    import json
    condition_str = json.dumps(condition)

    print("Creating Events rule...")
    create_rule_details = oci.events.models.CreateRuleDetails(
        display_name=RULE_DISPLAY_NAME,
        compartment_id=COMPARTMENT_OCID,
        is_enabled=True,
        condition=condition_str,
        actions=oci.events.models.ActionList(
            actions=[
                oci.events.models.NotificationAction(
                    description="Send notification on gateway change",
                    is_enabled=True,
                    topic_id=topic_id
                )
            ]
        )
    )

    rule = events_client.create_rule(create_rule_details).data
    print(f"Rule OCID: {rule.id}")
    print("Gateway change alert rule created.")

if __name__ == "__main__":
    main()

4. How this satisfies “gateway change alarm” requirement​

  • Any Audit event that matches one of GATEWAY_EVENT_TYPES in the target compartment will:
    • Trigger the Events rule.
    • Send a message to the Notifications topic.
    • Deliver an email (or other channel) to your configured endpoint.

To adapt:

  • Change COMPARTMENT_OCID if you want tenancy‑wide monitoring.
  • Add/remove event types to cover Internet Gateways, NAT Gateways, DRGs, Local Peering Gateways, etc.
  • Replace email with Slack/HTTPS, etc., by adjusting the subscription protocol.
Using Terraform
# OCI Monitoring alarms cannot be configured to detect configuration changes
# (such as create/update/delete of Internet Gateways or DRGs). They only work
# on metrics in the Monitoring service. Gateway provisioning changes are
# surfaced via the Events and Audit services, not as Monitoring metrics.

# To detect unauthorized gateway provisioning you must use:
# - oci_events_rule to match Audit events for Internet Gateway and DRG changes
# - oci_ons_notification_topic + oci_events_rule_actions or similar for alerting

# This cannot be remediated on oci_monitoring_alarm; there is no argument or
# metric in the Monitoring service that corresponds to "gateway changed".

# Example (for reference only – NOT an oci_monitoring_alarm):
# resource "oci_events_rule" "gateway_change_rule" { ... }

This finding cannot be fixed on oci_monitoring_alarm because OCI Monitoring does not expose gateway-change events as metrics. Use the Events service (in the Console: Developer Services → Events → Create rule, filtering on Audit events for Internet Gateway and Dynamic Routing Gateway create/update/delete) and attach a Notifications topic for alerting.