OCI Monitoring Should Have Event Rule For IAM User Changes

Using Console

Below are the exact steps in the OCI Console to set up alerting for IAM user changes using Events + Notifications (which is what OCI “monitoring” for these changes relies on).

1. Prepare a Notification Channel (Topic + Subscription)

Sign in to the OCI Console.
In the left hamburger menu, go to Developer Services → Notifications.
Make sure you’re in the correct Compartment (top-left compartment selector).

1.1 Create a Topic

Click Create Topic.
Enter:
- Name: e.g., iam-user-changes-topic
- Description: e.g., Notifies on IAM user create/update/delete
Click Create.

1.2 Create a Subscription (e.g., Email)

On the topic detail page you just created, under Subscriptions, click Create Subscription.
Choose Protocol (e.g., Email).
Enter your Email address (or HTTPS/Slack/other endpoint if desired).
Click Create.
Confirm the email:
- Check your inbox and click the confirmation link in the OCI notification email.
- Status in OCI will change from Pending to Active once confirmed.

2. Create an Event Rule for IAM User Changes

In the OCI Console, go to Observability & Management → Events Service.
Ensure you are in the same Region and desired Compartment.
Click Create Rule.

2.1 Basic Rule Settings

Enter:
- Name: e.g., iam-user-changes-rule
- Description: Triggers when IAM users are created, updated, or deleted
- State: ensure Enabled is selected.

2.2 Define the Event Pattern (Filter)

Under Rule Conditions (Event Pattern):

For Service Name, select:
Identity
For Event Type, add event types related to user changes. Common ones:
- com.oraclecloud.identitycontrolplane.createuser
- com.oraclecloud.identitycontrolplane.updateuser
- com.oraclecloud.identitycontrolplane.deleteuser
Depending on your tenancy/version, you may see them grouped as:
- Identity - CreateUser
- Identity - UpdateUser
- Identity - DeleteUser
Select all that apply to user lifecycle changes in your environment.
(Optional) Use Attributes / Advanced Filtering (JSON) to:
- Limit to a specific compartment or tenancy,
- Or filter by certain user names or tags, if needed.

For most cases, selecting the Identity service and the three event types (create, update, delete) is enough.

3. Attach the Notification Action

Under Actions, select Notifications.
For Topic, choose the topic you created earlier, e.g., iam-user-changes-topic.
(Optional) You can add multiple actions if you want (e.g., Notifications + Function).
Click Create Rule.

4. Validate the Configuration

Perform a test IAM user change, e.g.:
- Create a test user, or
- Update an existing user (e.g., change description), or
- Delete a test user.
Wait a few minutes and verify:
- The email (or other subscription) receives a notification.
- If not, confirm:
  - The rule is Enabled.
  - The correct event types are selected.
  - Your subscription is in Active state.

This completes remediation: OCI Events now detects IAM user changes and uses Notifications to alert you (which is the standard “Monitoring/Alerting” pattern for IAM changes in OCI).

Using CLI

Below are concise, CLI‑focused steps to ensure OCI Monitoring/Alerting is configured via an Event Rule that triggers on IAM User changes.Assumptions (adjust as needed):

You have oci CLI configured.
You know your Tenancy OCID, Compartment OCID, and Region.
You want alerts via OCI Notifications (email) and/or to trigger other actions.

1. Set environment variables (for convenience)

export COMPARTMENT_OCID="<your-compartment-ocid>"   # usually root compartment for IAM
export TENANCY_OCID="<your-tenancy-ocid>"
export REGION="<your-region>"                        # e.g., us-ashburn-1
oci setup config # if not already done

Ensure your CLI profile has the correct region or set:

export OCI_CLI_REGION="$REGION"

2. Create a Notifications topic for IAM user change alerts

oci ons topic create \
  --name "iam-user-change-alerts" \
  --compartment-id "$COMPARTMENT_OCID" \
  --description "Alerts for IAM user create/update/delete events" \
  --region "$REGION"

Capture the Topic OCID from the response:

export TOPIC_OCID="<OCID-from-previous-command>"

3. Create a subscription (e.g., email)

oci ons subscription create \
  --topic-id "$TOPIC_OCID" \
  --protocol "EMAIL" \
  --endpoint "<your-email@example.com>" \
  --region "$REGION"

Confirm the email and set the subscription to “CONFIRMED”.

4. Add IAM policy so Events can publish to Notifications

In the root compartment (tenancy level), create a policy (if not already present):

oci iam policy create \
  --name "events-publish-to-notifications" \
  --compartment-id "$TENANCY_OCID" \
  --description "Allow Events service to publish to Notifications topics" \
  --statements '[
    "Allow service events to use ons-topics in tenancy"
  ]'

5. Create an Events rule for IAM user changes

Identity events for users typically include: com.oraclecloud.identitycontrolplane.createuser, updateuser, deleteuser, etc.
You can filter by these event types. Example rule:

Create the rule (disabled by default):

oci events rule create \
  --display-name "iam-user-changes-rule" \
  --compartment-id "$TENANCY_OCID" \
  --is-enabled false \
  --description "Triggers on IAM user create/update/delete events" \
  --condition '{
    "eventType": [
      "com.oraclecloud.identitycontrolplane.createuser",
      "com.oraclecloud.identitycontrolplane.updateuser",
      "com.oraclecloud.identitycontrolplane.deleteuser"
    ],
    "data": {
      "additionalDetails": {
        "compartmentId": ["'"$TENANCY_OCID"'"]
      }
    }
  }' \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "topicId": "'"$TOPIC_OCID"'",
        "isEnabled": true
      }
    ]
  }'

Note: If compartmentId filtering causes issues, remove the "data" block and just filter on eventType.

Enable the rule:

oci events rule update \
  --rule-id "<rule-ocid-from-create-output>" \
  --is-enabled true

6. (Optional) Integrate with Monitoring alarms

If you prefer to route to Monitoring via Notifications/alarm actions:

Use Monitoring alarms for metrics.
For IAM user changes (an event, not a metric), the canonical pattern is: Events → Notifications → email/Function/etc.

If you need to trigger a Function instead (for custom logic):

oci events rule update \
  --rule-id "<rule-ocid>" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "topicId": "'"$TOPIC_OCID"'",
        "isEnabled": true
      },
      {
        "actionType": "FAAS",
        "functionId": "<your-function-ocid>",
        "isEnabled": true
      }
    ]
  }'

7. Validate

Make a test IAM user change (create/update/delete) via Console/CLI.
Confirm:
- An Event is generated (Console → Observability & Management → Events).
- Notification is received (email, etc.).

If you share your tenancy/compartment layout or specific constraints (e.g., use Functions, Slack, PagerDuty), I can refine the exact CLI JSON filters and actions.

Using Python

Below is a minimal, step‑by‑step way to create an OCI Event Rule for IAM user changes and wire it to alerting via Notifications, implemented using Python + OCI SDK.

1. Prerequisites

Install / upgrade SDK:
pip install --upgrade oci

Have an OCI config file (usually ~/.oci/config) with a profile, e.g.:

[DEFAULT]
user=ocid1.user.oc1..aaaa...
fingerprint=...
key_file=~/.oci/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..aaaa...
region=us-phoenix-1

You need permissions in the target compartment to:
- Manage/Use ons-topics and ons-subscriptions
- Manage events-rules

2. Define What You’re Alerting On

For IAM user changes, typical OCI event types are:

com.oraclecloud.identitycontrolplane.createuser
com.oraclecloud.identitycontrolplane.updateuser
com.oraclecloud.identitycontrolplane.deleteuser

Event rule condition (over Identity service / all user changes):

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createuser",
    "com.oraclecloud.identitycontrolplane.updateuser",
    "com.oraclecloud.identitycontrolplane.deleteuser"
  ]
}

3. Python Script: Create Topic, Subscription, and Event Rule

This script will:

Create a Notifications topic.
Create an email subscription on that topic.
Create an Event Rule that matches IAM user change events and sends them to the topic.

import oci
from oci.events.models import ActionDetails, CreateRuleDetails, RuleActionDetails
from oci.ons.models import CreateTopicDetails, CreateSubscriptionDetails

# -----------------------------
# CONFIGURATION
# -----------------------------
PROFILE_NAME = "DEFAULT"  # profile in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxx"  # compartment where rule will live
TOPIC_NAME = "iam-user-changes-topic"
TOPIC_DESCRIPTION = "Alerts for OCI IAM user create/update/delete"
ALERT_EMAIL = "your-alerts@example.com"
RULE_DISPLAY_NAME = "iam-user-changes-rule"
RULE_DESCRIPTION = "Event rule for IAM user create/update/delete"

# Event condition for IAM user changes
EVENT_CONDITION = """
{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createuser",
    "com.oraclecloud.identitycontrolplane.updateuser",
    "com.oraclecloud.identitycontrolplane.deleteuser"
  ]
}
""".strip()

# -----------------------------
# SETUP CLIENTS
# -----------------------------
config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
ons_client = oci.ons.NotificationControlPlaneClient(config)
events_client = oci.events.EventsClient(config)

# -----------------------------
# 1. CREATE NOTIFICATIONS TOPIC
# -----------------------------
create_topic_details = CreateTopicDetails(
    name=TOPIC_NAME,
    compartment_id=COMPARTMENT_OCID,
    description=TOPIC_DESCRIPTION,
)

topic = ons_client.create_topic(create_topic_details).data
topic_ocid = topic.topic_id
print(f"Created topic: {topic_ocid}")

# -----------------------------
# 2. CREATE EMAIL SUBSCRIPTION
# -----------------------------
create_sub_details = CreateSubscriptionDetails(
    topic_id=topic_ocid,
    protocol="EMAIL",
    endpoint=ALERT_EMAIL,
)

subscription = ons_client.create_subscription(create_sub_details).data
print(f"Created subscription: {subscription.id}")
print("NOTE: Confirm the subscription from the email you receive.")

# -----------------------------
# 3. CREATE EVENT RULE
# -----------------------------
# Action: send to Notifications topic
action_details = ActionDetails(
    action_type="ONS",
    is_enabled=True,
    description="Send IAM user change events to Notifications topic",
    topic_id=topic_ocid,
)

rule_action_details = RuleActionDetails(
    actions=[action_details]
)

create_rule_details = CreateRuleDetails(
    display_name=RULE_DISPLAY_NAME,
    compartment_id=COMPARTMENT_OCID,
    description=RULE_DESCRIPTION,
    is_enabled=True,
    condition=EVENT_CONDITION,
    actions=rule_action_details,
)

rule = events_client.create_rule(create_rule_details).data
print(f"Created event rule: {rule.id}")

4. What This Gives You

When any IAM user is created, updated, or deleted, OCI Events will:
- Match the rule condition.
- Send an event to the Notifications topic.
- Notifications will immediately send an email alert to ALERT_EMAIL.

If you instead need alerts to appear in Monitoring specifically (as alarms on custom metrics), the pattern becomes:

Events Rule → 2. OCI Function → 3. Function writes custom metric via Monitoring API → 4. Monitoring Alarm on that metric.

I can provide that extended flow with code if you want to push IAM changes into Monitoring custom metrics instead of (or in addition to) email notifications.

Using Terraform

resource "oci_events_rule" "iam_user_changes" {
  # Replace with your compartment OCID
  compartment_id = "OCID_OF_COMPARTMENT_TO_MONITOR"

  display_name = "iam-user-changes-events-rule"
  description  = "Capture IAM user create/update/delete events for alerting"

  is_enabled = true

  # Event pattern to match IAM user lifecycle changes
  # Adjust region/compartment IDs if you want to scope more tightly
  condition = jsonencode({
    "eventType" : [
      "com.oraclecloud.identitycontrolplane.createuser",
      "com.oraclecloud.identitycontrolplane.updateuser",
      "com.oraclecloud.identitycontrolplane.deleteuser"
    ],
    "data" : {
      "identity" : {
        "compartmentId" : [
          "OCID_OF_TENANCY_OR_IDENTITY_COMPARTMENT"
        ]
      }
    }
  })

  # Example action: send to an OCI Notifications topic for alerting
  actions {
    actions {
      action_type = "ONS"
      is_enabled  = true

      # Replace with your Notifications topic OCID
      topic_id    = "OCID_OF_OCI_NOTIFICATIONS_TOPIC"

      description = "Notify on IAM user lifecycle changes"
    }
  }

  # Optional freeform or defined tags
  freeform_tags = {
    "OWNER" = "SECURITY_TEAM"
  }
}

This change does not force replacement of other resources; Terraform will create or update this oci_events_rule in place.Verification: terraform plan should show one oci_events_rule.iam_user_changes to be created (or updated) with is_enabled = true, the condition JSON including the three createuser/updateuser/deleteuser event types, and an ONS action pointing at your Notifications topic.

OCI Misconfigurations

OCI Monitoring Should Have Event Rule For IAM User Changes

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prepare a Notification Channel (Topic + Subscription)

1.1 Create a Topic

1.2 Create a Subscription (e.g., Email)

2. Create an Event Rule for IAM User Changes

2.1 Basic Rule Settings

2.2 Define the Event Pattern (Filter)

3. Attach the Notification Action

4. Validate the Configuration

1. Set environment variables (for convenience)

2. Create a Notifications topic for IAM user change alerts

3. Create a subscription (e.g., email)

4. Add IAM policy so Events can publish to Notifications

5. Create an Events rule for IAM user changes

6. (Optional) Integrate with Monitoring alarms

7. Validate

1. Prerequisites

2. Define What You’re Alerting On

3. Python Script: Create Topic, Subscription, and Event Rule

4. What This Gives You

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Prepare a Notification Channel (Topic + Subscription)

​1.1 Create a Topic

​1.2 Create a Subscription (e.g., Email)

​2. Create an Event Rule for IAM User Changes

​2.1 Basic Rule Settings

​2.2 Define the Event Pattern (Filter)

​3. Attach the Notification Action

​4. Validate the Configuration

​1. Set environment variables (for convenience)

​2. Create a Notifications topic for IAM user change alerts

​3. Create a subscription (e.g., email)

​4. Add IAM policy so Events can publish to Notifications

​5. Create an Events rule for IAM user changes

​6. (Optional) Integrate with Monitoring alarms

​7. Validate

​1. Prerequisites

​2. Define What You’re Alerting On

​3. Python Script: Create Topic, Subscription, and Event Rule

​4. What This Gives You

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Prepare a Notification Channel (Topic + Subscription)

1.1 Create a Topic

1.2 Create a Subscription (e.g., Email)

2. Create an Event Rule for IAM User Changes

2.1 Basic Rule Settings

2.2 Define the Event Pattern (Filter)

3. Attach the Notification Action

4. Validate the Configuration

1. Set environment variables (for convenience)

2. Create a Notifications topic for IAM user change alerts

3. Create a subscription (e.g., email)

4. Add IAM policy so Events can publish to Notifications

5. Create an Events rule for IAM user changes

6. (Optional) Integrate with Monitoring alarms

7. Validate

1. Prerequisites

2. Define What You’re Alerting On

3. Python Script: Create Topic, Subscription, and Event Rule

4. What This Gives You