Skip to main content

OCI Monitoring Should Have Group Change Alarm Configured

More Info:​

Alerts should fire on IamGroupChange. Monitoring group modifications helps prevent privilege escalation via unauthorized additions of users to highly privileged admin groups.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are step‑by‑step console instructions to configure an alarm/alert for IAM Group changes in OCI. The correct way in OCI is to use Events + Notifications (this is what most benchmarks refer to when they say “group change alarm”).

1. Create a Notifications Topic​

  1. In the OCI Console, open the Navigation menu.
  2. Go to Developer Services → Application Integration → Notifications.
  3. Make sure you are in the correct compartment.
  4. Click Create Topic.
  5. Give it a name like iam-group-change-alerts, add description if needed.
  6. Click Create.

Add a Subscription (e.g., Email / Slack / PagerDuty)​

  1. Open the topic you just created.
  2. Under Subscriptions, click Create Subscription.
  3. Choose Protocol (e.g., Email).
  4. Enter the endpoint (e.g., your email address).
  5. Click Create.
  6. Confirm the subscription (for email, click the link in the confirmation mail).

2. Create an Event Rule for IAM Group Changes​

  1. In the OCI Console, open the Navigation menu.
  2. Go to Observability & Management → Events Service → Rules.
  3. Ensure you’re in the right compartment.
  4. Click Create Rule.

Basic details​

  1. Name: e.g., iam-group-change-rule.
  2. Description: “Alert on create/update/delete group and user-group membership changes”.
  3. Rule Status: Enabled.

Condition: Match IAM Group Change Events​

Under Rule Conditions, select:

  1. Event Type:

    • Click Event Type, then select:
      • com.oraclecloud.identitycontrolplane.creategroup
      • com.oraclecloud.identitycontrolplane.updategroup
      • com.oraclecloud.identitycontrolplane.deletegroup
      • com.oraclecloud.identitycontrolplane.addusertogroup
      • com.oraclecloud.identitycontrolplane.removeuserfromgroup

    If you don’t see them in the picker, choose Custom and paste this JSON:

    {
      "eventType": [
        "com.oraclecloud.identitycontrolplane.creategroup",
        "com.oraclecloud.identitycontrolplane.updategroup",
        "com.oraclecloud.identitycontrolplane.deletegroup",
        "com.oraclecloud.identitycontrolplane.addusertogroup",
        "com.oraclecloud.identitycontrolplane.removeuserfromgroup"
      ]
    }

3. Set the Rule Target to Notifications (Alerting)​

  1. In the Actions / Rule Target section:
    • Choose Notifications as the target type.
    • Select the topic you created earlier, e.g., iam-group-change-alerts.
  2. Click Create Rule.

Now, every time an IAM Group is created, updated, deleted, or a user is added/removed from a group, the Event Service will trigger this rule and send an alert via the Notifications topic.

If you specifically need a Monitoring → Alarms object (for a policy requirement), you’d typically:

  • Export IAM group‑change events to a custom metric (via Service Connector from Audit to Monitoring), then
  • Create a Monitoring Alarm on that custom metric.

If you want those detailed Monitoring‑Alarm steps as well, say so and I’ll list them.

Using CLI

Below is a practical way to satisfy “Monitoring should have group change alarm configured” using the OCI Monitoring service and OCI CLI. It creates an alarm on Audit metrics detecting IAM group changes and notifies via Notifications.

Assumptions:

  • You have OCI CLI installed and configured.
  • You know your:
    • --compartment-id for IAM and Monitoring
    • --tenancy-id if needed
    • An email (or other endpoint) to notify.

1. Create a Notifications Topic​

oci ons topic create \
  --compartment-id <COMPARTMENT_OCID> \
  --name "group-change-alerts-topic" \
  --description "Alerts for IAM group changes"

Note the id from the output (this is the topic OCID): ocid1.onstopic...

2. Create a Subscription (e.g., Email)​

oci ons subscription create \
  --topic-id <TOPIC_OCID> \
  --protocol EMAIL \
  --endpoint you@example.com

Check your email and confirm the subscription.

3. Craft the Alarm Metric Query​

We will use the oci_audit metrics to detect IAM group changes (create/update/delete, add/remove user). Example metric query:

Query:
  oci_audit, AuditEvents[1m]{eventName IN ("CreateGroup","UpdateGroup","DeleteGroup","AddUserToGroup","RemoveUserFromGroup")}.count()

We will alarm when the count > 0 in a short interval.

4. Create the Alarm via OCI CLI​

oci monitoring alarm create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "IAM Group Change Alarm" \
  --metric-compartment-id <COMPARTMENT_OCID> \
  --namespace "oci_audit" \
  --query-text 'oci_audit, AuditEvents[1m]{eventName IN ("CreateGroup","UpdateGroup","DeleteGroup","AddUserToGroup","RemoveUserFromGroup")}.count()' \
  --severity "CRITICAL" \
  --destinations '["<TOPIC_OCID>"]' \
  --is-enabled true \
  --resolution "1m" \
  --pending-duration "0m" \
  --message-format "ONS_OPTIMIZED" \
  --body "IAM group change detected (create/update/delete or user added/removed from group)."

Key points:

  • --metric-compartment-id is typically the root (tenancy) or IAM compartment where Audit metrics are collected (often your root compartment).
  • --pending-duration "0m" sends immediately when a group change occurs.
  • Adjust resolution and event list as needed.

5. Verify the Alarm​

List alarms:

oci monitoring alarm list \
  --compartment-id <COMPARTMENT_OCID>

Show details:

oci monitoring alarm get \
  --alarm-id <ALARM_OCID>

Then perform a test IAM group change (e.g., create/delete a group or add/remove user) and confirm you receive the notification.

Using Python

Below is one way to remediate this using OCI Monitoring + Python:

Goal
Have an alarm that fires whenever an IAM Group is created/updated/deleted (i.e., “group change”) using OCI Monitoring.

1. Overall Architecture​

  1. Audit logs already record IAM group changes.
  2. Logging collects Audit logs into a log group.
  3. Service Connector turns matching Audit log events (group changes) into a custom metric.
  4. Monitoring Alarm (created via Python) watches that metric and alerts when it’s > 0.

Python is used in step 4 (creating the alarm). Steps 1–3 are typically one‑time console/API setup; I’ll outline them briefly first.

2. Prerequisites​

  • Python 3 and oci SDK installed:
pip install oci
  • Valid OCI config at ~/.oci/config with a profile (e.g., DEFAULT), including:
    • tenancy, user, fingerprint, key_file, region
  • OCIDs:
    • compartment OCID where you want the alarm
    • notification topic OCID (from OCI Notifications) for alarm actions

3. One‑time Setup (Console / API)​

3.1 Ensure Audit Logs → Logging​

  1. Go to Audit in OCI console (it’s enabled by default).
  2. Go to Logging → Log Groups, create a log group in a security/ops compartment.
  3. Inside that log group, Enable an Audit log (or confirm one exists).

3.2 Service Connector: Audit → Custom Metric​

The idea: filter Audit logs for IAM group changes, transform them into a metric such as:

  • Namespace: security_iam
  • Metric Name: group_change_count
  • Dimensions: e.g. eventName, compartmentId

Using console:

  1. Go to Service Connector Hub → Create service connector.
  2. Source: Logging (select your Audit log).
  3. Condition / Filter (examples, varies by region/console version):
    • Filter on data.eventType IN:
      • com.oraclecloud.identitycontrolplane.creategroup
      • com.oraclecloud.identitycontrolplane.updategroup
      • com.oraclecloud.identitycontrolplane.deletegroup
  4. Target: Monitoring.
  5. In the metric mapping, specify:
    • Namespace: security_iam
    • Metric: group_change_count
    • Value: 1
    • Dimensions: e.g. {"eventName": data.eventType}
  6. Save/enable service connector.

After a group change, you should see data points for security_iam.group_change_count in Monitoring → Metrics.

4. Create the Group Change Alarm with Python​

This script creates an alarm that fires when any group change metric datapoint is > 0 in the last 5 minutes.

4.1 Metric Query Example​

Alarm query syntax (Monitoring “MQL” style):

security_iam.group_change_count[5m].sum() > 0

You can add dimensions if you wish, e.g.:

security_iam.group_change_count[5m]{eventName = "*group*"}.sum() > 0

4.2 Python Code​

import oci
from datetime import datetime

# Adjust these
PROFILE = "DEFAULT"  # profile in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxxxxxxxxxxxxx"
TOPIC_OCID = "ocid1.onstopic.oc1..xxxxxxxxxxxxxxxx"
ALARM_DISPLAY_NAME = "IAM Group Change Alarm"
ALARM_BODY = "Alarm: IAM group has been created/updated/deleted in the last 5 minutes."

def main():
    # Load config
    config = oci.config.from_file("~/.oci/config", PROFILE)

    monitoring_client = oci.monitoring.MonitoringClient(config)
    alarms_client = oci.monitoring.AlarmsClient(config)

    # Alarm query for custom metric from Service Connector
    alarm_query = "security_iam.group_change_count[5m].sum() > 0"

    # Construct the alarm details
    create_alarm_details = oci.monitoring.models.CreateAlarmDetails(
        display_name=ALARM_DISPLAY_NAME,
        compartment_id=COMPARTMENT_OCID,
        metric_compartment_id=COMPARTMENT_OCID,  # compartment where metric lives
        metric_compartment_id_in_subtree=True,   # if metrics might be in subcompartments
        namespace="security_iam",
        query=alarm_query,
        severity="CRITICAL",
        destinations=[TOPIC_OCID],              # Notifications topic
        is_enabled=True,
        repeat_notification_duration="PT15M",    # re-notify every 15 minutes
        message_format="PRETTY_JSON",
        body=ALARM_BODY,
        pending_duration="PT0M",                # fire as soon as condition met
        resolution="5m"                          # evaluate every 5 minutes
    )

    # Create the alarm
    response = alarms_client.create_alarm(create_alarm_details)
    alarm = response.data

    print("Created alarm:")
    print(f"  OCID: {alarm.id}")
    print(f"  Name: {alarm.display_name}")
    print(f"  Query: {alarm.query}")

if __name__ == "__main__":
    main()

5. Validate​

  1. Make a test group change (create or delete a group).
  2. Wait a few minutes:
    • Check Monitoring → Metrics, select:
      • Namespace: security_iam
      • Metric: group_change_count
    • Confirm datapoints appear.
  3. Check Monitoring → Alarms:
    • The alarm should move to FIRING for that interval.
  4. Confirm Notifications (email, Slack, etc.) are received from the topic.

If you share your existing metric namespace/name (if you already have a Service Connector or custom metric), I can adjust the exact Python query and alarm parameters to match your environment.

Using Terraform
# OCI Monitoring alarms cannot be configured on IAM group-change events.
# OCI does not expose an IamGroupChange metric/namespace to oci_monitoring_alarm,
# so this specific finding cannot be remediated on the oci_monitoring_alarm resource.

# You must instead use an OCI Events rule (OCI Console: Developer Services → Events)
# listening on the "IamGroupChange" event type and route it to your notification topic.

This specific control cannot be implemented via oci_monitoring_alarm in Terraform because Monitoring only supports metric-based alarms; IAM group changes are event-based. Use an OCI Events rule (Terraform oci_events_rule) targeting your notification channel, or configure it directly in the Console. Running terraform plan against oci_monitoring_alarm will not show any valid arguments related to IamGroupChange.