> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Event Rule For IAM Group Changes

### More Info:

Ensure Event Rules capture IAM Group creation, updates, and deletions. Real-time event triggers for group mutation enable automated remediation pipelines to revert unauthorized privilege grants.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact steps in the OCI Console to set up an Event Rule that alerts on IAM group changes (via Notifications / “alerting monitoring”).

        ***

        ### 1. Prepare a Notifications Topic (for alerts)

        1. In the OCI Console, open the **Navigation Menu**.
        2. Go to **Developer Services** → **Notifications** → **Topics**.
        3. Click **Create Topic**.
           * Name: `iam-group-changes-topic` (or similar)
           * Description: `Alerts on IAM group changes`
           * Click **Create**.
        4. Open the topic you just created.
        5. Under **Subscriptions**, click **Create Subscription**.
           * Protocol: typically **Email** (or HTTPS/Slack/PagerDuty as needed)
           * Email: your alert email
           * Click **Create**.
        6. Confirm the subscription from the email you received.

        ***

        ### 2. Create an Event Rule for IAM Group Changes

        1. Open **Navigation Menu** → **Observability & Management** → **Events Service** → **Rules**.

        2. Make sure you are in the **correct compartment** where you want the rule to live.

        3. Click **Create Rule**.

        4. Fill in:
           * **Display name**: `iam-group-change-rule`
           * **Description**: `Triggers on IAM group create/update/delete and membership changes`
           * **Rule Conditions**:
             * **Condition Type**: *Event Type*
             * **Rule is matching**: *Any of the following*.

        5. Under **Condition**, configure events for IAM groups. Depending on your tenancy (IDCS vs IAM/Identity Domains) you will see variants, but generally:

           * **Service Name / Event Source**: `Identity`
           * Then add event types such as (names may vary slightly by console version):
             * `Group - Create`
             * `Group - Update`
             * `Group - Delete`
             * `Group Membership - Add User`
             * `Group Membership - Remove User`

           If using the JSON editor, a typical pattern looks like:

           ```json theme={null}
           {
             "eventType": [
               "com.oraclecloud.identitycontrolplane.creategroup",
               "com.oraclecloud.identitycontrolplane.updategroup",
               "com.oraclecloud.identitycontrolplane.deletegroup",
               "com.oraclecloud.identitycontrolplane.addusertogroup",
               "com.oraclecloud.identitycontrolplane.removeuserfromgroup"
             ]
           }
           ```

           Use the console’s event type picker where possible; only use JSON if you can’t find the specific types in the UI.

        6. Under **Actions**, click **Add Action**:
           * **Action Type**: **Notifications**
           * **Topic**: select the topic you created earlier (e.g., `iam-group-changes-topic`).
           * Optionally set:
             * **Action Name**: `SendNotificationOnIAMGroupChange`.

        7. Click **Create Rule** (and ensure the rule is in **Enabled** state).

        ***

        ### 3. (Optional) Test the Configuration

        1. Make a safe IAM group change (e.g., create a test group or add/remove a test user to a test group).
        2. Confirm you receive an email (or chosen channel) alert from the Notifications topic.

        ***

        This setup provides “alerting monitoring” for OCI IAM Group changes entirely via the OCI Console, using Events + Notifications.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a simple end‑to‑end remediation using OCI CLI so that **any IAM Group change triggers an event rule and sends an alert** (e.g., email).

        ***

        ## 1. Prerequisites

        Make sure:

        * OCI CLI is installed and configured (`oci setup config`).
        * You have:
          * `COMPARTMENT_OCID` where you’ll create the rule and topic (often root compartment / tenancy).
          * An email address (for the notification subscription).

        Export variables for convenience:

        ```bash theme={null}
        export COMPARTMENT_OCID="<your-compartment-ocid>"
        export TENANCY_OCID="<your-tenancy-ocid>"   # often same as root compartment
        export REGION="<your-region-identifier>"    # e.g., us-ashburn-1
        ```

        ***

        ## 2. Create a Notifications Topic

        ```bash theme={null}
        oci ons topic create \
          --name "iam-group-change-topic" \
          --compartment-id "$COMPARTMENT_OCID" \
          --description "Alerts on IAM group changes"
        ```

        Capture the `topic-id` from the output, or:

        ```bash theme={null}
        export TOPIC_OCID=$(oci ons topic list \
          --compartment-id "$COMPARTMENT_OCID" \
          --all \
          --query "data[?\"name\"=='iam-group-change-topic'].id | [0]" \
          --raw-output)
        ```

        ***

        ## 3. Create an Email Subscription to the Topic

        ```bash theme={null}
        oci ons subscription create \
          --topic-id "$TOPIC_OCID" \
          --protocol EMAIL \
          --endpoint "<your-alert-email@example.com>"
        ```

        Then go to your email inbox and **confirm** the subscription.

        ***

        ## 4. Define the Event Rule Condition (IAM Group Changes)

        Create a JSON file `iam-group-events-condition.json`:

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.creategroup",
            "com.oraclecloud.identitycontrolplane.updategroup",
            "com.oraclecloud.identitycontrolplane.deletegroup",
            "com.oraclecloud.identitycontrolplane.addusertogroup",
            "com.oraclecloud.identitycontrolplane.removeuserfromgroup"
          ]
        }
        ```

        This matches all major IAM group change events.

        ***

        ## 5. Define the Event Rule Actions (Send to Notifications)

        Create a JSON file `iam-group-events-actions.json`:

        ```json theme={null}
        {
          "actions": [
            {
              "actionType": "ONS",
              "isEnabled": true,
              "description": "Send alert when IAM group changes occur",
              "topicId": "<TOPIC_OCID_PLACEHOLDER>"
            }
          ]
        }
        ```

        Replace `<TOPIC_OCID_PLACEHOLDER>` with your real `$TOPIC_OCID`, or generate the file with sed:

        ```bash theme={null}
        cat > iam-group-events-actions.json <<EOF
        {
          "actions": [
            {
              "actionType": "ONS",
              "isEnabled": true,
              "description": "Send alert when IAM group changes occur",
              "topicId": "$TOPIC_OCID"
            }
          ]
        }
        EOF
        ```

        ***

        ## 6. Create the Event Rule via OCI CLI

        ```bash theme={null}
        oci events rule create \
          --display-name "iam-group-change-rule" \
          --description "Event rule to alert on IAM group creation, update, delete, and membership changes" \
          --compartment-id "$COMPARTMENT_OCID" \
          --is-enabled true \
          --condition file://iam-group-events-condition.json \
          --actions file://iam-group-events-actions.json
        ```

        This creates an **Events** rule in the specified compartment. Any matching IAM group event will be sent to the Notification topic, which then sends email to your subscription.

        ***

        ## 7. (Optional) Verify the Rule

        List rules:

        ```bash theme={null}
        oci events rule list \
          --compartment-id "$COMPARTMENT_OCID" \
          --all
        ```

        Trigger a test by creating/updating a group in the Console or via CLI (e.g., change a group description), then confirm you receive an email.

        ***

        These steps implement “OCI Monitoring/Alerting for IAM Group Changes” fully via OCI CLI using Events + Notifications.
      </Accordion>

      <Accordion title="Using Python">
        Below is a minimal, step‑by‑step way to:

        1. Detect IAM Group changes using OCI Events
        2. Send alerts via OCI Notifications (which is what Monitoring “Alerting” uses for delivery)
        3. Do it programmatically with Python (OCI SDK)

        ***

        ## 1. Prerequisites

        1. **OCI Python SDK installed**

        ```bash theme={null}
        pip install oci
        ```

        2. **Config file** (`~/.oci/config`) with a profile, e.g. `DEFAULT`

        3. **IAM policies** (in the tenancy root or relevant compartment):

        ```text theme={null}
        Allow service events to use ons-topics in compartment <COMPARTMENT_NAME>
        Allow service events to read compartments in tenancy
        Allow service events to read groups in tenancy
        ```

        If you create the topic in another compartment, adjust policy scope accordingly.

        ***

        ## 2. Create a Notifications Topic (for alerts)

        ```python theme={null}
        import oci

        config = oci.config.from_file("~/.oci/config", "DEFAULT")

        ons_client = oci.ons.NotificationControlPlaneClient(config)

        compartment_id = "<COMPARTMENT_OCID>"  # where you want the topic

        create_topic_details = oci.ons.models.CreateTopicDetails(
            name="iam-group-changes-topic",
            compartment_id=compartment_id,
            description="Alerts for IAM group changes from Events"
        )

        topic = ons_client.create_topic(create_topic_details).data
        print("Topic OCID:", topic.topic_id)
        ```

        Add a subscription (e.g., email):

        ```python theme={null}
        subscription_details = oci.ons.models.CreateSubscriptionDetails(
            compartment_id=compartment_id,
            topic_id=topic.topic_id,
            protocol="EMAIL",
            endpoint="you@example.com"
        )

        sub = ons_client.create_subscription(subscription_details).data
        print("Subscription OCID:", sub.id)
        ```

        Confirm the subscription from your email.

        ***

        ## 3. Create an Events Rule for IAM Group Changes

        OCI IAM group events (non‑exhaustive) typically look like:

        * `com.oraclecloud.identitycontrolplane.creategroup`
        * `com.oraclecloud.identitycontrolplane.updategroup`
        * `com.oraclecloud.identitycontrolplane.deletegroup`
        * `com.oraclecloud.identitycontrolplane.adduserstogroup`
        * `com.oraclecloud.identitycontrolplane.removeusersfromgroup`

        We’ll create a rule that matches all of these and sends the event to the Notifications topic.

        ```python theme={null}
        events_client = oci.events.EventsClient(config)

        # Compartment where the rule is defined (often the root / tenancy compartment)
        rule_compartment_id = "<TENANCY_OR_COMPARTMENT_OCID>"

        # Event pattern for IAM group changes
        # Use identity domain / realm event types appropriate to your environment if needed
        event_pattern = {
            "eventType": [
                "com.oraclecloud.identitycontrolplane.creategroup",
                "com.oraclecloud.identitycontrolplane.updategroup",
                "com.oraclecloud.identitycontrolplane.deletegroup",
                "com.oraclecloud.identitycontrolplane.adduserstogroup",
                "com.oraclecloud.identitycontrolplane.removeusersfromgroup"
            ]
        }

        create_rule_details = oci.events.models.CreateRuleDetails(
            compartment_id=rule_compartment_id,
            display_name="iam-group-changes-rule",
            description="Triggers on IAM group create/update/delete and membership changes",
            is_enabled=True,
            # Condition is a JSON string
            condition=oci.util.to_json(event_pattern),
            actions=oci.events.models.ActionList(
                actions=[
                    oci.events.models.NotificationActionDetails(
                        action_type="ONS",
                        is_enabled=True,
                        topic_id=topic.topic_id
                    )
                ]
            )
        )

        rule = events_client.create_rule(create_rule_details).data
        print("Rule OCID:", rule.id)
        ```

        This rule will:

        * Listen for any of the IAM group change events in the tenancy/compartment scope
        * Push a message to the Notifications topic you created
        * Notifications will then send email (or other channels you configure)

        ***

        ## 4. (Optional) Tie in Monitoring Alarms

        If you specifically want **Monitoring Alarm** objects to send alerts (rather than directly from Events):

        1. You still use the **Notifications topic** for alarm delivery.
        2. You create a **custom metric** and a **Monitoring Alarm** on that metric.
        3. Your Events Rule target would be a **Function** or **Streaming** that increments a custom metric, and then the alarm fires.

        That is more complex; for most “IAM group change alert” use cases, Events → Notifications is the standard pattern and is what OCI’s “alerting” usually refers to for control-plane events.

        ***

        If you share your tenancy region and whether you use IAM domains, I can adjust the exact `eventType` values and pattern for your environment.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_events_rule" "iam_group_changes" {
          compartment_id = VAR_COMPARTMENT_OCID            # replace with your compartment OCID
          display_name   = "iam-group-changes-events-rule"
          description    = "Capture IAM group create, update, and delete events for monitoring/automation"
          is_enabled     = true

          # Match IAM group mutations
          condition = jsonencode({
            "eventType" : [
              "com.oraclecloud.identitycontrolplane.creategroup",
              "com.oraclecloud.identitycontrolplane.updategroup",
              "com.oraclecloud.identitycontrolplane.deletegroup"
            ]
          })

          # Optional: send events to an OCI Notifications topic that your monitoring/alerting consumes
          actions {
            actions {
              action_type = "ONS"
              is_enabled  = true
              topic_id    = oci_ons_notification_topic.iam_group_changes.id
            }
          }
        }

        resource "oci_ons_notification_topic" "iam_group_changes" {
          compartment_id = VAR_COMPARTMENT_OCID            # same or appropriate compartment OCID
          name           = "iam-group-changes-topic"
          description    = "Notifications for IAM group create/update/delete events"
        }
        ```

        This change is additive (new rule/topic) and does not force replacement of existing resources unless you bind this rule to an existing `oci_events_rule` by renaming/importing. After updating Terraform, `terraform plan` should show one new `oci_events_rule` (and `oci_ons_notification_topic` if added) being created with the `condition` listing the three IAM group event types.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>