OCI Monitoring Should Have Route Table Change Alarm

More Info:

RouteTableChange events must be monitored. Unauthorized route table edits can redirect sensitive internal traffic to malicious external endpoints or expose private subnets.

Risk Level

Medium

Address

Compliance, Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Well Architected Framework
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS AWS
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
HIPAA
HITRUST CSF
ISO 27001
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST
NIST CSF
NIST SP 800-171
NYDFS 23 NYCRR 500
SOC2
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

In OCI you don’t get a native “metric” for route table changes; instead you use Events + Notifications (and optionally Monitoring only if you build custom metrics). For a standard console-based setup, do this:

1. Prepare a Notifications Topic

Sign in to OCI Console.
From the left hamburger menu, go to Developer Services → Application Integration → Notifications.
Make sure you are in the correct compartment (top-left compartment selector).
Click Create Topic.
- Name: e.g., route-table-change-alerts
- Description: e.g., Alerts for route table and route rule changes
- Compartment: choose the desired compartment.
Click Create.

Add at least one subscription (email, Slack, etc.)

Open the topic you just created.
Click Create Subscription.
- Protocol: e.g., Email.
- Email: enter your email address.
Click Create.
Go to your email inbox and confirm the subscription.

2. Create an Event Rule for Route Table Changes

OCI emits Events for VCN and route table changes; you’ll create a rule to catch them.

From the left menu, go to Observability & Management → Events Service.
Click Rules in the left pane.
Make sure you are in the same region and compartment where you want to manage VCNs/route tables.
Click Create Rule.

Define the rule

Name: e.g., DetectRouteTableChanges.
Description: e.g., Trigger notifications on route table and route rule changes.
Rule Status: leave as Enabled.
Under Rule Conditions, choose:
- Event Type: click Browse, then:
  - Service: Virtual Cloud Network (VCN).
  - Under “Event Types”, select all that are relevant, for example (names may vary slightly by region/tenancy):
    - CreateRouteTable
    - UpdateRouteTable
    - DeleteRouteTable
    - CreateRouteRule
    - UpdateRouteRule
    - DeleteRouteRule
- Optionally, narrow by Compartment if you only want alerts for specific compartments.

If the UI shows a single grouped type like “Route Table – Update” or similar, select all route-table-related event types visible.

Choose action: send notification

In Actions, click Add Action.
Action Type: Notifications.
Topic: choose the topic you created earlier, e.g., route-table-change-alerts.
Click Create (or Create Rule).

Now any create/update/delete of a route table or its rules that matches the rule conditions will generate a notification.

3. (Optional) Refine Scope with Event Filters

If needed, you can restrict alerts further:

Edit the rule (open the rule → Edit).
Under Rule Conditions, you can:
- Constrain to specific route tables by compartment.
- Add an advanced filter (JSON) using attributes like data.resourceName, data.compartmentId, or data.additionalDetails if you want very fine-grained control (e.g., only a particular route table).

Example (conceptual) advanced filter JSON snippet:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.updateroutetable"
  ],
  "data": {
    "resourceName": [
      "my-critical-route-table"
    ]
  }
}

(Use the console’s helper to ensure the exact attribute names for your tenancy; they can be inspected from a sample event.)

4. (Optional) Tie into Monitoring Alarms via Custom Metrics

If your policy explicitly requires a Monitoring → Alarms object, you can:

Use Service Connector Hub:
- Source: Logging (Audit or VCN logs).
- Task: Logging Analytics or custom metrics.
- Target: Monitoring (create a custom metric when an event indicating route table change appears).
Then in Observability & Management → Monitoring → Alarms, create an alarm on that custom metric (e.g., trigger when metric value ≥ 1 in last 5 minutes).

This is more complex and typically unnecessary unless your organization mandates using Monitoring alarms specifically.

5. Validate

Make a small change to a non-critical route table (e.g., add a dummy route, then remove it).
Confirm:
- The event rule shows Recent Activity after the change.
- You receive a notification on your configured channel (email, etc.).

This completes configuration of “route table change alarm” using OCI’s console-based alerting (Events + Notifications, with optional Monitoring if your policy requires it).

Using CLI

In OCI you don’t get a native metric for “route table changed”, so the correct way to implement this “alarm” is:

Use OCI Events to detect RouteTable change events
Send those events to Notifications (ONS)
The notification (email/Slack/PagerDuty, etc.) is your “alarm”

Below are step‑by‑step CLI instructions.

0. Prerequisites

OCI CLI configured (oci setup config)
You know:
- Compartment OCID where your VCN/route tables live
- Your tenancy region (e.g. us-ashburn-1)
- Your target notification email address

For brevity, define environment variables:

export COMPARTMENT_OCID="<ocid1.compartment.oc1..xxxxx>"
export REGION="<your-region>"   # e.g. us-ashburn-1
oci setup reparsed-region --region $REGION

1. Create a Notifications Topic

oci ons topic create \
  --name "rt-change-alert-topic" \
  --compartment-id "$COMPARTMENT_OCID" \
  --description "Alert on OCI route table changes" \
  --wait-for-state ACTIVE

Capture the topic OCID:

export TOPIC_OCID=$(oci ons topic list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all \
  --query "data[?\"name\"=='rt-change-alert-topic'].id | [0]" \
  --raw-output)
echo $TOPIC_OCID

2. Create a Subscription (e.g., Email)

export ALERT_EMAIL="<your-email@example.com>"

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol "EMAIL" \
  --endpoint "$ALERT_EMAIL" \
  --wait-for-state PENDING

Check your email and confirm the subscription. No notifications will be sent until it’s confirmed.

3. Create an Events Rule for Route Table Changes

OCI route table events are emitted by the Virtual Network service with event types such as:

com.oraclecloud.virtualnetwork.updateRouteTable
com.oraclecloud.virtualnetwork.createRouteTable
com.oraclecloud.virtualnetwork.deleteRouteTable

(Names may vary slightly by region/tenancy version; we’ll match with a prefix.)

Create a rule condition JSON file, e.g. rt-change-condition.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.updateRouteTable",
    "com.oraclecloud.virtualnetwork.createRouteTable",
    "com.oraclecloud.virtualnetwork.deleteRouteTable"
  ]
}

If you want to scope to only one compartment, wrap it like:

{
  "data": {
    "compartmentId": "<ocid1.compartment.oc1..xxxxx>"
  },
  "eventType": [
    "com.oraclecloud.virtualnetwork.updateRouteTable",
    "com.oraclecloud.virtualnetwork.createRouteTable",
    "com.oraclecloud.virtualnetwork.deleteRouteTable"
  ]
}

3.1 Create the Events Rule

oci events rule create \
  --display-name "Route Table Change Rule" \
  --description "Triggers when OCI route tables are created, updated, or deleted" \
  --is-enabled true \
  --compartment-id "$COMPARTMENT_OCID" \
  --condition "$(cat rt-change-condition.json)" \
  --actions '{
      "actions": [
        {
          "actionType": "ONS",
          "isEnabled": true,
          "topicId": "'"$TOPIC_OCID"'"
        }
      ]
    }'

Verify:

oci events rule list \
  --compartment-id "$COMPARTMENT_OCID" \
  --all \
  --query "data[?\"display-name\"=='Route Table Change Rule']"

4. Test the Alarm

Modify a route table in the target compartment (add/remove a route) using Console or CLI.
Wait up to a few minutes.
You should receive an email from the Notifications topic with details of the change.

5. (Optional) Harden Scope

If you only want alarms for a specific VCN or route table, refine the condition JSON:

Example scoped to one route table:

{
  "data": {
    "resourceId": "<ocid1.routetable.oc1..xxxxx>"
  },
  "eventType": [
    "com.oraclecloud.virtualnetwork.updateRouteTable",
    "com.oraclecloud.virtualnetwork.deleteRouteTable"
  ]
}

Update the rule:

oci events rule update \
  --rule-id "<rule-ocid>" \
  --condition "$(cat rt-change-condition.json)"

This setup fulfills “Route Table Change Alarm” using OCI-native monitoring/alerting primitives (Events + Notifications) via OCI CLI.

Using Python

Below are the concrete steps and a Python example using the OCI SDK to configure an alarm for route table changes with OCI Monitoring.

Assumption:
Route table changes are being pushed as a custom metric (e.g., route_table_changes) into the Monitoring service (namespace oci_vcn or your own). If not, you must first create a Service Connector or other mechanism to publish these metrics.

1. Prerequisites

Python SDK installed
```
pip install oci
```
OCI config file at ~/.oci/config with a profile, e.g. [DEFAULT].
OCID values you need:
- compartment_id — Compartment where the route tables live and where metric is emitted.
- topic_id — OCI Notifications topic OCID for sending alerts (email, Slack, etc.).
- display_name — Name for the alarm (e.g., RouteTableChangeAlarm).

2. Metric Query for Route Table Changes

Assuming your custom metric:

Namespace: oci_vcn (or your custom namespace)
Metric name: route_table_changes
Dimension: routeTableId

Example query (change to your real namespace/metric):

oci_vcn.route_table_changes[1m].count() > 0

This triggers if at least one change is observed in the past minute.

3. Python Code to Create the Alarm

import oci
from oci.monitoring import MonitoringClient
from oci.monitoring.models import CreateAlarmDetails

# -------------------------------------------------------------------
# 1. Load OCI config
# -------------------------------------------------------------------
config = oci.config.from_file("~/.oci/config", "DEFAULT")

# -------------------------------------------------------------------
# 2. Init Monitoring client
# -------------------------------------------------------------------
monitoring_client = MonitoringClient(config)

# -------------------------------------------------------------------
# 3. Define required OCIDs and parameters
# -------------------------------------------------------------------
compartment_id = "<YOUR_COMPARTMENT_OCID>"
topic_id = "<YOUR_NOTIFICATION_TOPIC_OCID>"

alarm_display_name = "RouteTableChangeAlarm"
alarm_metric_namespace = "oci_vcn"  # or your custom namespace
alarm_query = f"{alarm_metric_namespace}.route_table_changes[1m].count() > 0"

# -------------------------------------------------------------------
# 4. Build alarm details
# -------------------------------------------------------------------
create_alarm_details = CreateAlarmDetails(
    display_name=alarm_display_name,
    compartment_id=compartment_id,
    # Monitoring query
    query=alarm_query,
    # SEVERITY: CRITICAL | ERROR | WARNING | INFO
    severity="CRITICAL",
    # ENABLE immediately
    is_enabled=True,
    # Notification destinations (Notification Topics)
    destinations=[topic_id],
    # Alarm will repeat notifications every 5 minutes while in alarm
    repeat_notification_duration=5,  # minutes
    # "ONE_MINUTE", "FIVE_MINUTES", "TEN_MINUTES", etc.
    resolution="1m",
    # Treat missing data as "not breaching" so spurious alarms don't fire
    pending_duration="0m",
    suppression=None,
    metric_compartment_id=compartment_id,
    metric_compartment_id_in_subtree=True,
    is_notifications_per_metric_dimension_enabled=False,
    # Optional description
    description="Alarm when any route table change is detected via custom metric."
)

# -------------------------------------------------------------------
# 5. Create the alarm
# -------------------------------------------------------------------
response = monitoring_client.create_alarm(create_alarm_details)
alarm = response.data

print("Created Alarm OCID:", alarm.id)
print("Display Name:", alarm.display_name)
print("Query:", alarm.query)

4. Quick Checklist

Ensure a mechanism sends a metric each time a route table is modified:
- Metric name (e.g. route_table_changes)
- Namespace (e.g. oci_vcn or custom/rt_changes)
Confirm the metric exists in Monitoring → Metrics Explorer using your query.
Run the Python script to create the alarm.
Test: perform a route table change and verify a notification is sent.

If you share your exact metric namespace/name/dimensions, I can adjust the query and code precisely.

Using Terraform

# This finding cannot be remediated on oci_monitoring_alarm, because OCI Monitoring
# alarms are metric-based and RouteTableChange is an Events service signal, not a metric.
# You must instead use an OCI Events rule targeting an OCI Notifications topic.

# Example (NON-COMPLIANT WITH USER REQUESTED RESOURCE TYPE, shown only for guidance):
# - Create an Events rule to match RouteTableChange events
# - Send them to an OCI Notifications topic for alerting

resource "oci_events_rule" "route_table_change_rule" {
  compartment_id = var.COMPartment_OCID  # replace with your compartment OCID

  display_name = "route-table-change-events"
  is_enabled   = true

  # Filter for route table create/update/delete events
  condition = jsonencode({
    "eventType" : [
      "com.oraclecloud.virtualnetwork.createroutetable.begin",
      "com.oraclecloud.virtualnetwork.createroutetable.end",
      "com.oraclecloud.virtualnetwork.updateroutetable.begin",
      "com.oraclecloud.virtualnetwork.updateroutetable.end",
      "com.oraclecloud.virtualnetwork.deleteroutetable.begin",
      "com.oraclecloud.virtualnetwork.deleteroutetable.end"
    ],
    "data" : {
      "compartmentId" : [var.COMPARTMENT_OCID]  # scope to your compartment
    }
  })

  actions {
    actions {
      action_type = "ONS"
      is_enabled  = true
      topic_id    = oci_ons_notification_topic.route_table_change_topic.id
    }
  }
}

resource "oci_ons_notification_topic" "route_table_change_topic" {
  compartment_id = var.COMPARTMENT_OCID  # replace with your compartment OCID
  name           = "route-table-change-topic"
  description    = "Alerts for OCI VCN route table changes"
}

# NOTE:
# There is currently no oci_monitoring_alarm metric that corresponds directly to
# RouteTableChange events, so an oci_monitoring_alarm cannot implement this check.
# To configure this in the Console instead:
# - Go to Developer Services -> Events Service -> Rules
# - Create a rule matching the VCN route table event types above
# - Add an action to send to a Notifications topic with your desired subscriptions.

# Verification in Terraform:
# `terraform plan` will show creation of:
# - oci_ons_notification_topic.route_table_change_topic
# - oci_events_rule.route_table_change_rule

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

1. Prepare a Notifications Topic​

Add at least one subscription (email, Slack, etc.)​

2. Create an Event Rule for Route Table Changes​

Define the rule​

Choose action: send notification​

3. (Optional) Refine Scope with Event Filters​

4. (Optional) Tie into Monitoring Alarms via Custom Metrics​

5. Validate​

0. Prerequisites​

1. Create a Notifications Topic​

2. Create a Subscription (e.g., Email)​

3. Create an Events Rule for Route Table Changes​

3.1 Create the Events Rule​

4. Test the Alarm​

5. (Optional) Harden Scope​

1. Prerequisites​

2. Metric Query for Route Table Changes​

3. Python Code to Create the Alarm​

4. Quick Checklist​