Skip to main content

OCI Monitoring Should Have Policy Change Alarm Configured

More Info:​

Monitor IamPolicyChange events. Unauthorized modifications to IAM policies can silently elevate privileges, allowing attackers to establish persistence or exfiltrate data.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

Below are step‑by‑step instructions to configure a policy‑change alert in OCI using the Console, leveraging Events + Notifications (email/SNS), which is the standard way to get alerted on configuration changes like IAM policy updates.

1. Prerequisites​

  1. You must have permissions to manage:
    • events-rules in the target compartment
    • ons-topics and ons-subscriptions (Notifications)
  2. Audit is on by default in OCI; no extra action needed for that.

2. Create a Notification Topic (for email/other alerts)​

  1. In the OCI Console, open the Navigation menu.
  2. Go to Developer Services → Notifications (or Application Integration → Notifications, depending on UI version).
  3. Make sure you’re in the correct compartment.
  4. Click Create Topic.
    • Name: e.g. policy-change-alerts-topic
    • Description: Alerts for IAM policy changes
  5. Click Create.

Add an Email Subscription​

  1. In the same topic page, click on the topic you just created.
  2. Under Subscriptions, click Create Subscription.
  3. Choose Protocol = Email.
  4. Enter the email address to receive the alerts.
  5. Click Create.
  6. Go to your email inbox and confirm the subscription via the confirmation link.

(Repeat with other protocols if needed: PagerDuty, Slack (via HTTPS), etc.)

3. Create an Event Rule for Policy Changes​

You’ll now create an Events rule that listens for IAM policy change events and forwards them to the Notifications topic.

  1. In the OCI Console, open Navigation menu → Observability & Management → Events Service (or Events).
  2. Ensure you’re in the desired compartment.
  3. Click Create Rule.

Fill in the rule details:

  1. Name: policy-change-events-rule
  2. Description: Trigger notifications when IAM policies are created, updated, or deleted.
  3. Rule Status: Ensure it is Enabled.
  4. Condition (Rule Type): Select Event Type or Service Connector–style condition depending on the UI; you want an event pattern that matches IAM policy changes.

3.1. Define the Event Pattern for Policy Changes​

Use the JSON editor (or the UI equivalent) to match IAM policy changes. Example event pattern:

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createpolicy",
    "com.oraclecloud.identitycontrolplane.updatepolicy",
    "com.oraclecloud.identitycontrolplane.deletepolicy"
  ]
}

If the console offers dropdowns instead of raw JSON:

  • Service Name: Identity (or “Identity and Access Management” / “iam”)
  • Event Types: select the ones matching:
    • CreatePolicy
    • UpdatePolicy
    • DeletePolicy

(The exact wording can differ slightly by region/UI, but look for “policy” in the Identity event types.)

3.2. Set the Action to Your Notification Topic​

Still in the rule creation:

  1. Under Actions, choose Notifications.

  2. Select the Topic you created earlier: policy-change-alerts-topic.

  3. (Optional) Add multiple actions if you want messages to multiple topics or Functions.

  4. Click Create Rule.

The rule should now be Enabled and pointing to your Notifications topic.

4. (Optional) Test the Policy Change Alert​

  1. In the OCI Console, go to Identity & Security → Policies.
  2. In a test compartment or tenancy (be careful in production), do one of:
    • Create a temporary test policy.
    • Edit (update) an existing test policy.
    • Delete a test policy (if appropriate).
  3. Wait a few minutes.
  4. Check the email (or other channel) subscribed to the notification topic for an alert.

You should receive a message containing the event details (who changed the policy, what was changed, timestamp, etc.).

5. (Optional) Refine or Scope the Rule​

To reduce noise, you can further refine the event pattern to specific compartments or policies by using conditions on attributes like:

  • data.resourceName
  • data.compartmentId
  • data.additionalDetails.compartmentName

For example (conceptual):

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.updatepolicy"
  ],
  "data": {
    "compartmentName": [
      "Prod-Compartment"
    ]
  }
}

Adjust depending on what the Events UI accepts.

This configuration ensures that any IAM policy creation, update, or deletion in OCI will trigger a notification, satisfying the requirement that “Monitoring should have policy change alarm configured,” using OCI’s native Events + Notifications via the Console.

Using CLI

Below is a CLI-based way to configure an OCI Monitoring alarm that fires on IAM policy changes (create/update/delete) using the Audit metrics.

Assumptions:

  • You already have oci CLI configured.
  • You know your COMPARTMENT_OCID (typically your root compartment for IAM policies).
  • You have permission to create Notifications resources and Alarms.

1. Create a Notifications Topic​

oci ons topic create \
  --compartment-id "<COMPARTMENT_OCID>" \
  --name "policy-change-alerts" \
  --description "Alerts for IAM policy changes"

Note the returned "id" as TOPIC_OCID.

2. (Optional) Add a Subscription to the Topic​

Example: email subscription.

oci ons subscription create \
  --topic-id "<TOPIC_OCID>" \
  --protocol "EMAIL" \
  --endpoint "security-team@example.com"

Confirm the subscription from the email if required.

3. Build the Alarm Query for Policy Changes​

Audit metrics namespace is oci_audit.
We’ll alarm when any policy is created/updated/deleted.

Example query:

sum(AuditEventCount[1m]{resourceType = "policy" && (eventName = "CreatePolicy" || eventName = "UpdatePolicy" || eventName = "DeletePolicy")}) > 0

You can also constrain by compartment if desired with compartmentId.

4. Create the Alarm via CLI​

oci monitoring alarm create \
  --compartment-id "<COMPARTMENT_OCID>" \
  --display-name "OCI Policy Change Alarm" \
  --metric-compartment-id "<COMPARTMENT_OCID>" \
  --namespace "oci_audit" \
  --query 'sum(AuditEventCount[1m]{resourceType = "policy" && (eventName = "CreatePolicy" || eventName = "UpdatePolicy" || eventName = "DeletePolicy")}) > 0' \
  --severity "CRITICAL" \
  --destinations '["<TOPIC_OCID>"]' \
  --is-enabled true \
  --pending-duration "PT1M" \
  --resolution "1m" \
  --body "IAM policy change detected. Check Audit logs immediately." \
  --message-format "ONS_OPTIMIZED"

Key options:

  • --metric-compartment-id is where the Audit metrics are emitted (often the same root compartment).
  • --pending-duration = how long the condition must be true before firing.
  • --resolution = evaluation interval.

5. Verify the Alarm​

List alarms:

oci monitoring alarm list \
  --compartment-id "<COMPARTMENT_OCID>"

Get details:

oci monitoring alarm get \
  --alarm-id "<ALARM_OCID>"

If you share your specific compartment layout (root vs subcompartments) I can refine the exact query and compartment filters.

Using Python

In OCI, “policy change alerts” are usually implemented with Events + Notifications, not with a classic Monitoring metric alarm, because IAM policy changes are emitted as events, not metrics. You can still treat this as “alerting/monitoring,” but you wire it through:

  1. Events – detect IAM policy changes
  2. Notifications – send email/Slack/HTTPS, etc.
  3. (Optional) Monitoring Alarm – only if you have a custom metric for policy changes

Below is a minimal end‑to‑end Python approach using the OCI SDK.

1. Prerequisites​

  • Python 3 + oci SDK installed: 
    pip install oci
  • A configured OCI CLI profile (e.g. DEFAULT) at ~/.oci/config with:
    • tenancy OCID
    • user OCID
    • region
    • API key
  • The compartment OCID where you want to create the Events rule and topic.

2. Create a Notifications Topic + Subscription (email) via Python​

import oci

config = oci.config.from_file("~/.oci/config", "DEFAULT")
identity = oci.identity.IdentityClient(config)
notification_client = oci.ons.NotificationControlPlaneClient(config)

compartment_id = "<YOUR_COMPARTMENT_OCID>"
email_address = "you@example.com"

# 1) Create topic
topic_details = oci.ons.models.CreateTopicDetails(
    name="policy-change-alerts-topic",
    compartment_id=compartment_id,
    description="Topic for OCI IAM policy change alerts"
)

topic = notification_client.create_topic(topic_details).data
topic_id = topic.topic_id
print("Created topic:", topic_id)

# 2) Create email subscription
subscription_details = oci.ons.models.CreateSubscriptionDetails(
    compartment_id=compartment_id,
    topic_id=topic_id,
    protocol="EMAIL",
    endpoint=email_address
)

subscription = notification_client.create_subscription(subscription_details).data
print("Created subscription:", subscription.id)
print("Check your email and confirm the subscription.")

After running this:

  • Confirm the subscription from the confirmation email.

3. Create an Events Rule for IAM Policy Changes via Python​

OCI emits specific event types for IAM policy operations, e.g.:

  • com.oraclecloud.identitycontrolplane.CreatePolicy
  • com.oraclecloud.identitycontrolplane.UpdatePolicy
  • com.oraclecloud.identitycontrolplane.DeletePolicy

The following creates a rule that triggers on those for your tenancy (or a compartment):

events_client = oci.events.EventsClient(config)

rule_compartment_id = compartment_id  # can be tenancy or specific compartment

# Event pattern to catch create/update/delete policy operations
event_pattern = """
{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.CreatePolicy",
    "com.oraclecloud.identitycontrolplane.UpdatePolicy",
    "com.oraclecloud.identitycontrolplane.DeletePolicy"
  ],
  "data": {
    "compartmentId": [
      "%s"
    ]
  }
}
""" % rule_compartment_id

rule_details = oci.events.models.CreateRuleDetails(
    display_name="policy-change-rule",
    compartment_id=rule_compartment_id,
    description="Rule to detect IAM policy changes and send notifications",
    is_enabled=True,
    condition=event_pattern,
    actions=oci.events.models.ActionDetailsList(
        actions=[
            oci.events.models.NotificationActionDetails(
                action_type="ONS",
                topic_id=topic_id
            )
        ]
    )
)

rule = events_client.create_rule(rule_details).data
print("Created Events rule:", rule.id)

Now, any Create/Update/Delete of an IAM Policy in that compartment will trigger:

  • Events rule → Notifications topic → email to you.

4. (Optional) Create a Monitoring Alarm on a Custom “PolicyChange” Metric​

If you already push a custom metric (e.g. policy_changes_count) to OCI Monitoring (via Logging or custom code), you can add a classic Monitoring alarm:

from oci.monitoring import MonitoringClient
from oci.monitoring.models import (
    CreateAlarmDetails,
    NotificationDetails
)

monitoring_client = MonitoringClient(config)

# Example metric query (adjust for your metric namespace/name)
query = "policy_changes[1m].count() > 0"

alarm_details = CreateAlarmDetails(
    display_name="policy-change-metric-alarm",
    compartment_id=compartment_id,
    namespace="custom_metrics_namespace",
    query=query,
    severity="CRITICAL",
    destinations=[topic_id],  # Send alarm to same Notifications topic
    is_enabled=True,
    metric_compartment_id=compartment_id,
    message_format="ONS_OPTIMIZED"
)

alarm = monitoring_client.create_alarm(alarm_details).data
print("Created Monitoring alarm:", alarm.id)

If you don’t already have such a metric, you can rely solely on the Events rule (step 3) for policy-change alerting, which is the standard remediation.

Using Terraform
resource "oci_monitoring_alarm" "iam_policy_change_alarm" {
  # Create an alarm that fires whenever at least one IAM policy change event is recorded.
  compartment_id         = "COMPARTMENT_OCID"          # Replace with the OCID of the compartment whose IAM policy changes you want to monitor
  display_name           = "IAM Policy Change Alarm"
  is_enabled             = true
  severity               = "CRITICAL"
  namespace              = "oci_audit"                 # Audit events metric namespace
  metric_compartment_id  = "COMPARTMENT_OCID"          # Typically the same as compartment_id
  metric_compartment_id_in_subtree = true              # Optional: include subcompartments, set to false if not desired

  # Alarm query: count IAM policy change events over the last 5 minutes and fire if at least one occurs.
  # Adjust the window [5m] if your standard is different; the threshold here is ">= 1 event".
  query = "IamPolicyChange[5m].count() >= 1"

  # Where to send notifications when the alarm triggers
  destinations = [
    "NOTIFICATION_TOPIC_OCID",                         # Replace with an oci ons topic OCID (e.g., for email, PagerDuty, etc.)
  ]

  # Optional: fine-tune behavior
  resolution           = "1m"
  pending_duration     = "PT0M"
  message_format       = "TEXT"
  repeat_notification_duration = "PT60M"
}

Changing query, namespace, or severity on an existing oci_monitoring_alarm updates the alarm in place and does not force replacement; terraform plan should show an in-place update (~ update in-place) to the existing alarm, or a + create for a new one if it does not yet exist.