OCI Monitoring Should Have Event Rule For Network Gateway Changes

Using Console

Below are the exact steps in the OCI Console to ensure you have an Event Rule that alerts on network gateway changes (e.g., Internet Gateways, NAT Gateways, DRGs) using Events + Notifications.

1. Create (or verify) a Notifications Topic

In the OCI Console, open the menu and go to:
Developer Services → Application Integration → Notifications
Click Topics (left side) → Create Topic.
Enter:
- Name: e.g., network-gateway-changes-topic
- Description: e.g., Alerts for OCI network gateway changes
Click Create.

Add a subscription (email example)

Open the topic you just created.
Click Create Subscription.
Protocol: Email
Endpoint: enter your email address.
Click Create.
Confirm the subscription via the email you receive (must click the confirmation link).

2. Create the Event Rule for Network Gateway Changes

From the main menu go to:
Observability & Management → Events Service → Rules
Click Create Rule.

Rule Details

Name: e.g., network-gateway-change-rule
Description: e.g., Triggers when OCI network gateways are created, updated, or deleted
Compartment: select the compartment that contains the gateways you want to monitor.
Rule Status: ensure it is Enabled.

Define the Events (Conditions)

Under Rule Conditions, choose:
- Rule Type: Event Rules (when an event occurs)
In Event Type, filter by Service = Virtual Cloud Network (or similar naming; varies slightly by console version).
Select all event types relevant to network gateways, for example (names may vary slightly by region/tenancy, but look for): For Internet Gateway:
- CreateInternetGateway
- UpdateInternetGateway
- DeleteInternetGateway
- (sometimes prefixed as com.oraclecloud.virtualnetwork.createinternetgateway, etc.)
For NAT Gateway:
- CreateNatGateway
- UpdateNatGateway
- DeleteNatGateway
For Dynamic Routing Gateway (DRG), if desired:
- CreateDrg
- UpdateDrg
- DeleteDrg
- AttachDrgRouteTable, UpdateDrgRouteTable, etc. (if you want route change alerts as well)
Include all gateway types you require according to your policy.

If the UI only offers a generic filter builder, choose:

Service: virtualnetwork

Event Type: then select the specific gateway events from the dropdown.

3. Add the Action (Send to Notifications)

In Actions, choose Notifications.
Compartment: same compartment where the topic exists.
Topic: select the topic you created earlier:
network-gateway-changes-topic
(Optional) Add tags for governance.
Click Create Rule.

4. Verify

Perform a test change in a non‑production compartment (e.g., update the display name of an Internet Gateway).
Confirm that:
- An Event is visible under Events Service → Events.
- You receive an email notification (or whatever subscription you configured).

This completes remediation for: “OCI Monitoring Should Have Event Rule For Network Gateway Changes” using the OCI Console.

Using CLI

Below is a minimal end‑to‑end approach using OCI CLI to:

Create a Notifications topic
(Optionally) add an email subscription
Create an OCI Events rule that fires on network gateway changes and sends alerts to the topic

You can adjust to your tenancy/compartment as needed.

0. Prerequisites

OCI CLI configured (oci setup config)
Your compartment OCID
A region where Events and Notifications are enabled
IAM policy that allows Events service to publish to Notifications, for example at tenancy or target compartment level:

Allow service events to use ons-topics in compartment <COMPARTMENT_NAME>

1. Create a Notifications Topic

TOPIC_NAME="network-gateway-changes-topic"
COMPARTMENT_OCID="<your_compartment_ocid>"

oci ons topic create \
  --compartment-id "$COMPARTMENT_OCID" \
  --name "$TOPIC_NAME" \
  --description "Alerts for OCI network gateway changes"

Capture the returned topic-id (OCID). For convenience:

TOPIC_OCID="<topic_ocid_from_above_command>"

2. (Optional) Add an Email Subscription

EMAIL_ADDRESS="you@example.com"

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol "EMAIL" \
  --endpoint "$EMAIL_ADDRESS"

Confirm the subscription from the email you receive.

3. Prepare the Event Rule Condition

Create a JSON file gateway-events-condition.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createinternetgateway.begin",
    "com.oraclecloud.virtualnetwork.createinternetgateway.end",
    "com.oraclecloud.virtualnetwork.updateinternetgateway.begin",
    "com.oraclecloud.virtualnetwork.updateinternetgateway.end",
    "com.oraclecloud.virtualnetwork.deleteinternetgateway.begin",
    "com.oraclecloud.virtualnetwork.deletenatgateway.begin",
    "com.oraclecloud.virtualnetwork.createnatgateway.begin",
    "com.oraclecloud.virtualnetwork.createnatgateway.end",
    "com.oraclecloud.virtualnetwork.updatenatgateway.begin",
    "com.oraclecloud.virtualnetwork.updatenatgateway.end",
    "com.oraclecloud.virtualnetwork.createservicegateway.begin",
    "com.oraclecloud.virtualnetwork.createservicegateway.end",
    "com.oraclecloud.virtualnetwork.deleteservicegateway.begin",
    "com.oraclecloud.virtualnetwork.createlocalpeeringgateway.begin",
    "com.oraclecloud.virtualnetwork.createlocalpeeringgateway.end",
    "com.oraclecloud.virtualnetwork.deletelocalpeeringgateway.begin",
    "com.oraclecloud.virtualnetwork.createdrg.begin",
    "com.oraclecloud.virtualnetwork.createdrg.end",
    "com.oraclecloud.virtualnetwork.updatedrg.begin",
    "com.oraclecloud.virtualnetwork.updatedrg.end",
    "com.oraclecloud.virtualnetwork.deletedrg.begin"
  ]
}

You can add/remove specific event types as required.
(Full list is in the Events service docs for Virtual Cloud Network / gateway resources.)

4. Create the Event Rule

RULE_NAME="network-gateway-changes-rule"
DISPLAY_NAME="Network Gateway Change Alerts"

oci events rule create \
  --compartment-id "$COMPARTMENT_OCID" \
  --display-name "$DISPLAY_NAME" \
  --is-enabled true \
  --condition "$(cat gateway-events-condition.json)" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "'"$TOPIC_OCID"'"
      }
    ]
  }'

This rule:

Listens for the specified network gateway events (Internet Gateway, NAT Gateway, Service Gateway, Local Peering Gateway, DRG, etc.)
Sends a notification to the specified Notifications topic when any of them occur

5. (Optional) Verify the Rule

List rules in the compartment:

oci events rule list \
  --compartment-id "$COMPARTMENT_OCID"

Get rule details:

RULE_OCID="<rule_ocid_from_list>"
oci events rule get --rule-id "$RULE_OCID"

You now have OCI monitoring/alerting for network gateway configuration changes via Events + Notifications, created entirely with OCI CLI.

Using Python

Below is a minimal, step‑by‑step way to ensure OCI Events raises alerts when Network Gateway resources change, using Python + OCI SDK.You will:

Create a Notifications topic (if you don’t already have one).
(Optionally) Add a subscription (email, Slack via HTTPS, etc.).
Create an Event Rule that listens for Network Gateway changes and sends them to the topic.

0. Prerequisites

oci SDK installed:
pip install oci
~/.oci/config correctly set up with:
- tenancy
- user
- fingerprint
- key_file
- region
- a profile name (e.g. DEFAULT)
Have your compartment OCID ready: compartment_id = "ocid1.compartment.oc1...."

1. Decide Which Gateways / Events You Want

Common network gateway types in OCI:

Internet Gateway (com.oraclecloud.virtualnetwork.internetgateway)
NAT Gateway (com.oraclecloud.virtualnetwork.natgateway)
Dynamic Routing Gateway, DRG (com.oraclecloud.virtualnetwork.drg)
Service Gateway (com.oraclecloud.virtualnetwork.servicegateway)
Local Peering Gateway, LPG (com.oraclecloud.virtualnetwork.localpeeringgateway)

Common event types:

com.oraclecloud.virtualnetwork.create*
com.oraclecloud.virtualnetwork.update*
com.oraclecloud.virtualnetwork.delete*

You can match all events under the Network service or only specific ones with eventType.

2. Example Python Script (End‑to‑End)

This script:

Creates a Notifications topic (if not present).
Adds an email subscription.
Creates an Event Rule for Network Gateway changes.
Routes Events → Notifications topic → your email (or other endpoint).

import oci
from oci.config import from_file

# -------------------
# CONFIG
# -------------------
PROFILE = "DEFAULT"  # profile in ~/.oci/config
compartment_id = "ocid1.compartment.oc1..xxxxxxxxxxxxxxxxx"
topic_name = "network-gateway-changes-topic"
rule_display_name = "NetworkGatewayChangesRule"
notification_email = "you@example.com"  # change or remove if not needed

config = from_file(profile_name=PROFILE)

ons_client = oci.ons.NotificationControlPlaneClient(config)
events_client = oci.events.EventsClient(config)

# -------------------
# 1. Create (or get) Notifications Topic
# -------------------
def get_or_create_topic():
    existing = ons_client.list_topics(compartment_id=compartment_id).data
    for t in existing:
        if t.name == topic_name:
            print(f"Using existing topic: {t.topic_id}")
            return t

    create_details = oci.ons.models.CreateTopicDetails(
        name=topic_name,
        compartment_id=compartment_id,
        description="Alerts for OCI network gateway changes"
    )
    topic = ons_client.create_topic(create_details).data
    print(f"Created topic: {topic.topic_id}")
    return topic

topic = get_or_create_topic()

# -------------------
# 2. (Optional) Create Email Subscription
# -------------------
def get_or_create_email_subscription(topic_id, email):
    subs = ons_client.list_subscriptions(
        compartment_id=compartment_id,
        topic_id=topic_id
    ).data
    for s in subs:
        if s.protocol == "EMAIL" and s.endpoint.lower() == email.lower():
            print(f"Using existing email subscription: {s.id}")
            return s

    create_sub = oci.ons.models.CreateSubscriptionDetails(
        topic_id=topic_id,
        protocol="EMAIL",
        endpoint=email
    )
    sub = ons_client.create_subscription(create_sub).data
    print(f"Created email subscription (confirm via email): {sub.id}")
    return sub

if notification_email:
    get_or_create_email_subscription(topic.topic_id, notification_email)

# -------------------
# 3. Create Event Rule for Network Gateway Changes
# -------------------
# Event pattern for Network service – you can refine with specific resource types/eventTypes
event_pattern = {
    "eventType": [
        # INTERNET GATEWAY
        "com.oraclecloud.virtualnetwork.createinternetgateway",
        "com.oraclecloud.virtualnetwork.updateinternetgateway",
        "com.oraclecloud.virtualnetwork.deleteinternetgateway",
        # NAT GATEWAY
        "com.oraclecloud.virtualnetwork.createnatgateway",
        "com.oraclecloud.virtualnetwork.updatenatgateway",
        "com.oraclecloud.virtualnetwork.deletenatgateway",
        # DRG
        "com.oraclecloud.virtualnetwork.createdrg",
        "com.oraclecloud.virtualnetwork.updatedrg",
        "com.oraclecloud.virtualnetwork.deletedrg",
        # SERVICE GATEWAY
        "com.oraclecloud.virtualnetwork.createservicegateway",
        "com.oraclecloud.virtualnetwork.updateservicegateway",
        "com.oraclecloud.virtualnetwork.deleteservicegateway",
        # LOCAL PEERING GATEWAY
        "com.oraclecloud.virtualnetwork.createlocalpeeringgateway",
        "com.oraclecloud.virtualnetwork.updatelocalpeeringgateway",
        "com.oraclecloud.virtualnetwork.deletelocalpeeringgateway"
    ]
}

# Build action to send events to Notifications topic
action = oci.events.models.CreateActionDetails(
    action_type="ONS",
    is_enabled=True,
    description="Send network gateway change events to Notifications",
    topic_id=topic.topic_id
)

create_rule_details = oci.events.models.CreateRuleDetails(
    display_name=rule_display_name,
    description="Rule to capture all network gateway create/update/delete events",
    is_enabled=True,
    compartment_id=compartment_id,
    # pattern must be JSON string
    condition=str(event_pattern).replace("'", '"'),  # simple way to get JSON string
    actions=oci.events.models.ActionDetailsList(
        actions=[action]
    )
)

# Check if rule already exists
existing_rules = events_client.list_rules(compartment_id=compartment_id).data
for r in existing_rules:
    if r.display_name == rule_display_name:
        print(f"Rule '{rule_display_name}' already exists: {r.id}")
        break
else:
    rule = events_client.create_rule(create_rule_details).data
    print(f"Created Events rule: {rule.id}")

3. How This Satisfies “Monitoring / Alerting”

Monitoring: OCI Events listens for control‑plane events (create / update / delete) on gateway resources.
Alerting: Events rule sends those events to an OCI Notifications topic.
- Subscriptions (email, HTTPS, Slack via Webhook, PagerDuty etc.) receive alerts on each event.

If you want to integrate with OCI Monitoring service alarms instead, you would typically:

Use Events → Notifications → Function (optional) to write metrics.
Or directly set up Monitoring metrics + alarms for data‑plane metrics (e.g., gateway traffic) — which is separate from “config change” events.

If you tell me your exact gateway types and where you want alerts (email, Slack, webhook, etc.), I can adjust the event pattern and action code accordingly.

Using Terraform

resource "oci_events_rule" "network_gateway_changes" {
  # Replace with your compartment OCID
  compartment_id = "OCID_OF_COMPARTMENT"

  display_name = "network-gateway-change-events"
  description  = "Track create, update, and delete operations on Internet, NAT, and Service Gateways"
  is_enabled   = true

  # Condition: emit events on any create, update, or delete of internet, NAT, or service gateways
  condition = jsonencode({
    "anyOf" = [
      # Internet Gateway
      { "eventType" = "com.oraclecloud.virtualnetwork.createinternetgateway" },
      { "eventType" = "com.oraclecloud.virtualnetwork.updateinternetgateway" },
      { "eventType" = "com.oraclecloud.virtualnetwork.deleteinternetgateway" },

      # NAT Gateway
      { "eventType" = "com.oraclecloud.virtualnetwork.createnatgateway" },
      { "eventType" = "com.oraclecloud.virtualnetwork.updatenatgateway" },
      { "eventType" = "com.oraclecloud.virtualnetwork.deletenatgateway" },

      # Service Gateway
      { "eventType" = "com.oraclecloud.virtualnetwork.createservicegateway" },
      { "eventType" = "com.oraclecloud.virtualnetwork.updateservicegateway" },
      { "eventType" = "com.oraclecloud.virtualnetwork.deleteservicegateway" }
    ]
  })

  actions {
    # Configure at least one action so the rule produces an alert/notification.
    # This example sends to an OCI Notifications topic.
    actions {
      action_type = "ONS"

      # Replace with your Notifications topic OCID
      is_enabled = true
      topic_id   = "OCID_OF_OCI_NOTIFICATIONS_TOPIC"
    }
  }
}

This change is an in-place update if the rule already exists; it does not force replacement of the rule or any gateway resources.For verification, terraform plan should show either:

a new oci_events_rule.network_gateway_changes to be created, or
an update to the existing rule where the condition (and possibly actions) argument changes to match the configuration above.

OCI Misconfigurations

OCI Monitoring Should Have Event Rule For Network Gateway Changes

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create (or verify) a Notifications Topic

Add a subscription (email example)

2. Create the Event Rule for Network Gateway Changes

Rule Details

Define the Events (Conditions)

3. Add the Action (Send to Notifications)

4. Verify

0. Prerequisites

1. Create a Notifications Topic

2. (Optional) Add an Email Subscription

3. Prepare the Event Rule Condition

4. Create the Event Rule

5. (Optional) Verify the Rule

0. Prerequisites

1. Decide Which Gateways / Events You Want

2. Example Python Script (End‑to‑End)

3. How This Satisfies “Monitoring / Alerting”

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Create (or verify) a Notifications Topic

​Add a subscription (email example)

​2. Create the Event Rule for Network Gateway Changes

​Rule Details

​Define the Events (Conditions)

​3. Add the Action (Send to Notifications)

​4. Verify

​0. Prerequisites

​1. Create a Notifications Topic

​2. (Optional) Add an Email Subscription

​3. Prepare the Event Rule Condition

​4. Create the Event Rule

​5. (Optional) Verify the Rule

​0. Prerequisites

​1. Decide Which Gateways / Events You Want

​2. Example Python Script (End‑to‑End)

​3. How This Satisfies “Monitoring / Alerting”

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create (or verify) a Notifications Topic

Add a subscription (email example)

2. Create the Event Rule for Network Gateway Changes

Rule Details

Define the Events (Conditions)

3. Add the Action (Send to Notifications)

4. Verify

0. Prerequisites

1. Create a Notifications Topic

2. (Optional) Add an Email Subscription

3. Prepare the Event Rule Condition

4. Create the Event Rule

5. (Optional) Verify the Rule

0. Prerequisites

1. Decide Which Gateways / Events You Want

2. Example Python Script (End‑to‑End)

3. How This Satisfies “Monitoring / Alerting”