Skip to main content

OCI IAM Users Should Have Valid Email Addresses

More Info:​

All IAM users should have valid email addresses configured. Valid emails ensure password reset notifications, security alerts, and audit communications reach the correct person.

Risk Level​

Medium

Address​

Compliance, Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AWS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • HIPAA
  • HITRUST CSF
  • ISO 27001
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST CSF
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • PCI
  • Reserve Bank of India (RBI) Master Direction – Information Technology Framework
  • SOC2
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate “OCI IAM Users Should Have Valid Email Addresses” using the OCI Console, you need to edit each affected user and add a valid email address.

Below are the steps for both models of IAM in OCI (classic tenancy-local users and IAM Identity Domains). Use the path that matches what you see in your console.

1. If you are using IAM Identity Domains (most newer tenancies)​

  1. Sign in to the OCI Console.
  2. In the left hamburger menu, go to
    Identity & Security → Identity Domains.
  3. Click the Identity Domain where your users are (often named like Default).
  4. In the left menu of the domain, click Users.
  5. Search for the user that was flagged as non-compliant.
  6. Click the user’s name to open their details.
  7. Go to the Contact Information or Profile section (naming can vary slightly by UI version).
  8. Find the Email field and enter a valid email address (e.g., user@example.com).
    • Make sure it’s:
      • In a valid email format.
      • An address the user actually controls (for notifications, password resets, etc.).
  9. Click Save or Update.
  10. Repeat steps 5–9 for all users flagged by your OCI IAM Monitoring / Cloud Guard finding.

2. If you are using Classic IAM (Tenancy-local users)​

  1. Sign in to the OCI Console.
  2. Open the left hamburger menu and go to
    Identity & Security → Identity → Users.
  3. Locate the users reported in the misconfiguration (you can:
    • Filter or search by name, or
    • Use the report from Cloud Guard / IAM Monitoring to know which usernames are affected).
  4. Click the user’s name to open the user details.
  5. Click Edit.
  6. In the Email field, enter a valid email address.
  7. Click Save Changes.
  8. Repeat steps 3–7 for all non-compliant users.

3. Verify remediation in your monitoring​

  1. After editing users, wait for the next OCI IAM Monitoring / Cloud Guard evaluation cycle (or manually re-run the detector if your tooling allows).
  2. Confirm that the finding “OCI IAM Users Should Have Valid Email Addresses” is now:
    • Marked as Resolved, or
    • No longer appears for the remediated users.

If you tell me which view you see (Identity Domains vs. classic Users page), I can tailor the exact clicks for your environment.

Using CLI

Below are the key steps and example OCI CLI commands to remediate “OCI IAM Users Should Have Valid Email Addresses” by identifying users without valid emails and updating them.

Assumptions:

  • You have OCI CLI installed and configured.
  • You know your tenancy OCID.
  • You (or an admin) know what each user’s correct email should be.

1. List All IAM Users and Find Those Without Email​

TENANCY_OCID="<your_tenancy_ocid>"

oci iam user list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --output table \
  --query "data[].{Name:name, OCID:id, Email:email, EmailVerified:email-verified}"

To isolate users missing an email (email is null or empty):

oci iam user list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?(!email || email=='')].{Name:name, OCID:id}" \
  --output table

This shows only users that need remediation.

2. Update a Single User’s Email​

Once you know the correct email for a given user (by OCID):

USER_OCID="<user_ocid>"
NEW_EMAIL="<user_email@example.com>"

oci iam user update \
  --user-id "$USER_OCID" \
  --email "$NEW_EMAIL"

Optionally mark it as verified (if you have already verified it out-of-band):

oci iam user update \
  --user-id "$USER_OCID" \
  --email "$NEW_EMAIL" \
  --email-verified true

3. Bulk Update from a CSV/JSON (Optional Automation)​

  1. Export users without email to JSON:
oci iam user list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?(!email || email=='')]" \
  --output json > users_missing_email.json

  1. Edit users_missing_email.json (or create a CSV mapping) to add the correct email for each user.

  2. Use a shell loop to update (example with a simple CSV: user_email_map.csv containing user_ocid,email):

while IFS=, read -r USER_OCID NEW_EMAIL
do
  [ -z "$USER_OCID" ] && continue
  oci iam user update \
    --user-id "$USER_OCID" \
    --email "$NEW_EMAIL" \
    --email-verified true
done < user_email_map.csv

4. Verify Remediation​

Re-list users and confirm emails are set:

oci iam user list \
  --compartment-id "$TENANCY_OCID" \
  --all \
  --query "data[?(!email || email=='')].{Name:name, OCID:id}" \
  --output table

If no rows are returned, all users now have email addresses.

These steps allow you to remediate the “valid email” requirement for OCI IAM users using only the OCI CLI.

Using Python

Below is a practical way to enforce “OCI IAM users should have valid email addresses” using Python and OCI’s APIs.

1. Prerequisites​

  1. Install OCI Python SDK:
pip install oci
  1. Configure OCI CLI-style config (for the SDK):
oci setup config

Note the:

  • tenancy
  • user
  • fingerprint
  • key_file
  • region

Use a user with permissions to:

  • inspect users in tenancy
  • manage users (if you want to auto-remediate)
  • use metrics in tenancy (if you want to push Monitoring metrics)

Example IAM policy:

Allow group IAM-Email-Audit-Group to inspect users in tenancy
Allow group IAM-Email-Audit-Group to manage users in tenancy
Allow group IAM-Email-Audit-Group to use metrics in tenancy

2. Decide Your Model​

You can:

  1. Detect-only:

    • Script lists all IAM users.
    • Flags those with missing/invalid email.
    • Pushes a custom metric / writes to log or report.

  2. Detect + auto-remediate:

    • Same as above, but calls UpdateUser to fix the email (e.g., from an external source or pattern).
    • Usually safer to only detect and let an admin fix the email.

Below is a detect-only script, then an optional remediation snippet.

3. Python: Detect invalid IAM user emails​

Logic:

  • List all users in the tenancy.
  • Validate email field:
    • Non-empty
    • Basic regex pattern for email
  • Print invalid users.
  • (Optional) Publish a count to OCI Monitoring as a custom metric.
import oci
import re
from datetime import datetime

# ---------- CONFIG ----------
CONFIG_FILE = "~/.oci/config"
CONFIG_PROFILE = "DEFAULT"
COMPARTMENT_OCID = "<tenancy-ocid>"  # tenancy as compartment for IAM
NAMESPACE = "custom_iam"
METRIC_NAME = "invalid_iam_user_email_count"
RESOURCE_GROUP = "iam_email_validation"

# Basic email regex (can be customized)
EMAIL_REGEX = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")

# ---------- HELPER FUNCTIONS ----------
def is_valid_email(email: str) -> bool:
    if not email:
        return False
    return EMAIL_REGEX.match(email) is not None

def main():
    # Load config
    config = oci.config.from_file(CONFIG_FILE, CONFIG_PROFILE)

    # IAM client
    identity_client = oci.identity.IdentityClient(config)

    # Monitoring client (optional)
    monitoring_client = oci.monitoring.MonitoringClient(config)

    invalid_users = []

    # List all users in the tenancy
    users = oci.pagination.list_call_get_all_results(
        identity_client.list_users,
        compartment_id=COMPARTMENT_OCID
    ).data

    for user in users:
        # user.email may be None or empty
        email = getattr(user, "email", None)
        if not is_valid_email(email):
            invalid_users.append({
                "id": user.id,
                "name": user.name,
                "email": email
            })

    # Print report
    print("=== IAM users with invalid/missing emails ===")
    for u in invalid_users:
        print(f"User: {u['name']} ({u['id']}) | email: {u['email']}")

    print(f"Total invalid users: {len(invalid_users)}")

    # ---------- OPTIONAL: push metric to OCI Monitoring ----------
    try:
        if len(invalid_users) >= 0:
            metric_data = oci.monitoring.models.PostMetricDataDetails(
                metric_data=[
                    oci.monitoring.models.MetricDataDetails(
                        namespace=NAMESPACE,
                        compartment_id=COMPARTMENT_OCID,
                        name=METRIC_NAME,
                        dimensions={
                            "resourceGroup": RESOURCE_GROUP
                        },
                        datapoints=[
                            oci.monitoring.models.Datapoint(
                                timestamp=datetime.utcnow(),
                                value=float(len(invalid_users))
                            )
                        ]
                    )
                ]
            )
            response = monitoring_client.post_metric_data(metric_data)
            print("Metric posted status:", response.data.failed_metrics_count, "failed")
    except Exception as e:
        print("Failed to post metric:", e)


if __name__ == "__main__":
    main()

How to use for monitoring:

  • Run this script periodically via:
    • OCI Functions + OCI Events Scheduler
    • A cron job on a bastion/automation host
  • In OCI Monitoring, create an alarm on the custom metric:
    • Query example: 
      custom_iam.invalid_iam_user_email_count[1m].max() > 0
    • Action: send notification to Email/Slack via OCI Notifications.

4. Optional: Auto-remediate by updating user email​

If you already know the “correct” email (e.g., via mapping), you can call UpdateUser.

Example snippet to update one user:

def update_user_email(identity_client, user_id, new_email):
    update_details = oci.identity.models.UpdateUserDetails(
        email=new_email
    )
    response = identity_client.update_user(
        user_id=user_id,
        update_user_details=update_details
    )
    return response.data

You would call this inside your loop once you decide the proper new email, for example:

for user in users:
    email = getattr(user, "email", None)
    if not is_valid_email(email):
        # Example remediation: derive email from username
        # WARNING: Only use if your org’s naming pattern is guaranteed
        new_email = f"{user.name}@example.com"
        print(f"Fixing {user.name}: {email} -> {new_email}")
        update_user_email(identity_client, user.id, new_email)

Usually, you should:

  • Start with detect-only.
  • Review invalid users.
  • Then either fix them manually in Console or implement a controlled auto-fix with clear mappings.

If you tell me how you want to run this (OCI Function, cron, etc.), I can adapt the script to that environment and add the exact deployment steps.

Using Terraform
resource "oci_identity_user" "OCI_IAM_MONITORING_USER" {
  # Existing required arguments
  compartment_id = "OCID_OF_TENANCY_OR_IAM_COMPARTMENT"
  name           = "OCI_IAM_MONITORING"
  description    = "IAM user for monitoring"

  # Remediation: ensure the user has a valid email address configured
  email = "VALID_MONITORING_USER_EMAIL@example.com"

  # Optional tags (if you already use them)
  # freeform_tags = {
  #   "KEY" = "VALUE"
  # }
  # defined_tags = {
  #   "NAMESPACE.KEY" = "VALUE"
  # }
}

This change is an in‑place update of the user’s email field and does not force resource replacement.

After applying the fix, terraform plan should show an update to oci_identity_user.OCI_IAM_MONITORING_USER with email changing from its previous value (or null) to VALID_MONITORING_USER_EMAIL@example.com.