> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Event Rule For IAM User Changes

### More Info:

Ensure Event Rules capture IAM User modifications. Tracking user lifecycle events ensures rogue accounts created by threat actors are instantly flagged and disabled.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact steps in the OCI Console to set up alerting for IAM user changes using Events + Notifications (which is what OCI “monitoring” for these changes relies on).

        ***

        ## 1. Prepare a Notification Channel (Topic + Subscription)

        1. **Sign in** to the OCI Console.
        2. In the left hamburger menu, go to **Developer Services → Notifications**.
        3. Make sure you’re in the **correct Compartment** (top-left compartment selector).

        ### 1.1 Create a Topic

        4. Click **Create Topic**.
        5. Enter:
           * **Name**: e.g., `iam-user-changes-topic`
           * **Description**: e.g., `Notifies on IAM user create/update/delete`
        6. Click **Create**.

        ### 1.2 Create a Subscription (e.g., Email)

        7. On the topic detail page you just created, under **Subscriptions**, click **Create Subscription**.
        8. Choose **Protocol** (e.g., `Email`).
        9. Enter your **Email address** (or HTTPS/Slack/other endpoint if desired).
        10. Click **Create**.
        11. Confirm the email:
            * Check your inbox and click the **confirmation link** in the OCI notification email.
            * Status in OCI will change from `Pending` to `Active` once confirmed.

        ***

        ## 2. Create an Event Rule for IAM User Changes

        1. In the OCI Console, go to **Observability & Management → Events Service**.
        2. Ensure you are in the **same Region** and desired **Compartment**.
        3. Click **Create Rule**.

        ### 2.1 Basic Rule Settings

        4. Enter:
           * **Name**: e.g., `iam-user-changes-rule`
           * **Description**: `Triggers when IAM users are created, updated, or deleted`
           * **State**: ensure **Enabled** is selected.

        ### 2.2 Define the Event Pattern (Filter)

        Under **Rule Conditions (Event Pattern)**:

        5. For **Service Name**, select:\
           `Identity`

        6. For **Event Type**, add event types related to user changes. Common ones:

           * `com.oraclecloud.identitycontrolplane.createuser`
           * `com.oraclecloud.identitycontrolplane.updateuser`
           * `com.oraclecloud.identitycontrolplane.deleteuser`

           Depending on your tenancy/version, you may see them grouped as:

           * `Identity - CreateUser`
           * `Identity - UpdateUser`
           * `Identity - DeleteUser`

           Select all that apply to user lifecycle changes in your environment.

        7. (Optional) Use **Attributes** / **Advanced Filtering (JSON)** to:
           * Limit to a specific compartment or tenancy,
           * Or filter by certain user names or tags, if needed.

        For most cases, selecting the Identity service and the three event types (create, update, delete) is enough.

        ***

        ## 3. Attach the Notification Action

        8. Under **Actions**, select **Notifications**.

        9. For **Topic**, choose the topic you created earlier, e.g., `iam-user-changes-topic`.

        10. (Optional) You can add multiple actions if you want (e.g., Notifications + Function).

        11. Click **Create Rule**.

        ***

        ## 4. Validate the Configuration

        1. Perform a **test IAM user change**, e.g.:
           * Create a test user, or
           * Update an existing user (e.g., change description), or
           * Delete a test user.
        2. Wait a few minutes and verify:
           * The **email (or other subscription)** receives a notification.
           * If not, confirm:
             * The **rule is Enabled**.
             * The **correct event types** are selected.
             * Your **subscription** is in `Active` state.

        ***

        This completes remediation: OCI Events now detects IAM user changes and uses Notifications to alert you (which is the standard “Monitoring/Alerting” pattern for IAM changes in OCI).
      </Accordion>

      <Accordion title="Using CLI">
        Below are concise, CLI‑focused steps to ensure OCI Monitoring/Alerting is configured via an Event Rule that triggers on IAM User changes.

        Assumptions (adjust as needed):

        * You have `oci` CLI configured.
        * You know your Tenancy OCID, Compartment OCID, and Region.
        * You want alerts via OCI Notifications (email) and/or to trigger other actions.

        ***

        ## 1. Set environment variables (for convenience)

        ```bash theme={null}
        export COMPARTMENT_OCID="<your-compartment-ocid>"   # usually root compartment for IAM
        export TENANCY_OCID="<your-tenancy-ocid>"
        export REGION="<your-region>"                        # e.g., us-ashburn-1
        oci setup config # if not already done
        ```

        Ensure your CLI profile has the correct region or set:

        ```bash theme={null}
        export OCI_CLI_REGION="$REGION"
        ```

        ***

        ## 2. Create a Notifications topic for IAM user change alerts

        ```bash theme={null}
        oci ons topic create \
          --name "iam-user-change-alerts" \
          --compartment-id "$COMPARTMENT_OCID" \
          --description "Alerts for IAM user create/update/delete events" \
          --region "$REGION"
        ```

        Capture the Topic OCID from the response:

        ```bash theme={null}
        export TOPIC_OCID="<OCID-from-previous-command>"
        ```

        ***

        ## 3. Create a subscription (e.g., email)

        ```bash theme={null}
        oci ons subscription create \
          --topic-id "$TOPIC_OCID" \
          --protocol "EMAIL" \
          --endpoint "<your-email@example.com>" \
          --region "$REGION"
        ```

        Confirm the email and set the subscription to "CONFIRMED".

        ***

        ## 4. Add IAM policy so Events can publish to Notifications

        In the root compartment (tenancy level), create a policy (if not already present):

        ```bash theme={null}
        oci iam policy create \
          --name "events-publish-to-notifications" \
          --compartment-id "$TENANCY_OCID" \
          --description "Allow Events service to publish to Notifications topics" \
          --statements '[
            "Allow service events to use ons-topics in tenancy"
          ]'
        ```

        ***

        ## 5. Create an Events rule for IAM user changes

        Identity events for users typically include: `com.oraclecloud.identitycontrolplane.createuser`, `updateuser`, `deleteuser`, etc.\
        You can filter by these event types. Example rule:

        1. Create the rule (disabled by default):

        ```bash theme={null}
        oci events rule create \
          --display-name "iam-user-changes-rule" \
          --compartment-id "$TENANCY_OCID" \
          --is-enabled false \
          --description "Triggers on IAM user create/update/delete events" \
          --condition '{
            "eventType": [
              "com.oraclecloud.identitycontrolplane.createuser",
              "com.oraclecloud.identitycontrolplane.updateuser",
              "com.oraclecloud.identitycontrolplane.deleteuser"
            ],
            "data": {
              "additionalDetails": {
                "compartmentId": ["'"$TENANCY_OCID"'"]
              }
            }
          }' \
          --actions '{
            "actions": [
              {
                "actionType": "ONS",
                "topicId": "'"$TOPIC_OCID"'",
                "isEnabled": true
              }
            ]
          }'
        ```

        Note: If `compartmentId` filtering causes issues, remove the `"data"` block and just filter on `eventType`.

        2. Enable the rule:

        ```bash theme={null}
        oci events rule update \
          --rule-id "<rule-ocid-from-create-output>" \
          --is-enabled true
        ```

        ***

        ## 6. (Optional) Integrate with Monitoring alarms

        If you prefer to route to Monitoring via Notifications/alarm actions:

        * Use Monitoring alarms for metrics.
        * For IAM user changes (an event, not a metric), the canonical pattern is:
          Events → Notifications → email/Function/etc.

        If you need to trigger a Function instead (for custom logic):

        ```bash theme={null}
        oci events rule update \
          --rule-id "<rule-ocid>" \
          --actions '{
            "actions": [
              {
                "actionType": "ONS",
                "topicId": "'"$TOPIC_OCID"'",
                "isEnabled": true
              },
              {
                "actionType": "FAAS",
                "functionId": "<your-function-ocid>",
                "isEnabled": true
              }
            ]
          }'
        ```

        ***

        ## 7. Validate

        * Make a test IAM user change (create/update/delete) via Console/CLI.
        * Confirm:
          * An Event is generated (Console → Observability & Management → Events).
          * Notification is received (email, etc.).

        If you share your tenancy/compartment layout or specific constraints (e.g., use Functions, Slack, PagerDuty), I can refine the exact CLI JSON filters and actions.
      </Accordion>

      <Accordion title="Using Python">
        Below is a minimal, step‑by‑step way to **create an OCI Event Rule for IAM user changes** and wire it to **alerting via Notifications**, implemented using **Python + OCI SDK**.

        ***

        ## 1. Prerequisites

        1. Install / upgrade SDK:
           ```bash theme={null}
           pip install --upgrade oci
           ```

        2. Have an OCI config file (usually `~/.oci/config`) with a profile, e.g.:
           ```ini theme={null}
           [DEFAULT]
           user=ocid1.user.oc1..aaaa...
           fingerprint=...
           key_file=~/.oci/oci_api_key.pem
           tenancy=ocid1.tenancy.oc1..aaaa...
           region=us-phoenix-1
           ```

        3. You need permissions in the target compartment to:
           * Manage/Use `ons-topics` and `ons-subscriptions`
           * Manage `events-rules`

        ***

        ## 2. Define What You’re Alerting On

        For IAM user changes, typical OCI event types are:

        * `com.oraclecloud.identitycontrolplane.createuser`
        * `com.oraclecloud.identitycontrolplane.updateuser`
        * `com.oraclecloud.identitycontrolplane.deleteuser`

        Event rule condition (over Identity service / all user changes):

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createuser",
            "com.oraclecloud.identitycontrolplane.updateuser",
            "com.oraclecloud.identitycontrolplane.deleteuser"
          ]
        }
        ```

        ***

        ## 3. Python Script: Create Topic, Subscription, and Event Rule

        This script will:

        1. Create a Notifications topic.
        2. Create an email subscription on that topic.
        3. Create an Event Rule that matches IAM user change events and sends them to the topic.

        ```python theme={null}
        import oci
        from oci.events.models import ActionDetails, CreateRuleDetails, RuleActionDetails
        from oci.ons.models import CreateTopicDetails, CreateSubscriptionDetails

        # -----------------------------
        # CONFIGURATION
        # -----------------------------
        PROFILE_NAME = "DEFAULT"  # profile in ~/.oci/config
        COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxx"  # compartment where rule will live
        TOPIC_NAME = "iam-user-changes-topic"
        TOPIC_DESCRIPTION = "Alerts for OCI IAM user create/update/delete"
        ALERT_EMAIL = "your-alerts@example.com"
        RULE_DISPLAY_NAME = "iam-user-changes-rule"
        RULE_DESCRIPTION = "Event rule for IAM user create/update/delete"

        # Event condition for IAM user changes
        EVENT_CONDITION = """
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createuser",
            "com.oraclecloud.identitycontrolplane.updateuser",
            "com.oraclecloud.identitycontrolplane.deleteuser"
          ]
        }
        """.strip()

        # -----------------------------
        # SETUP CLIENTS
        # -----------------------------
        config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
        ons_client = oci.ons.NotificationControlPlaneClient(config)
        events_client = oci.events.EventsClient(config)

        # -----------------------------
        # 1. CREATE NOTIFICATIONS TOPIC
        # -----------------------------
        create_topic_details = CreateTopicDetails(
            name=TOPIC_NAME,
            compartment_id=COMPARTMENT_OCID,
            description=TOPIC_DESCRIPTION,
        )

        topic = ons_client.create_topic(create_topic_details).data
        topic_ocid = topic.topic_id
        print(f"Created topic: {topic_ocid}")

        # -----------------------------
        # 2. CREATE EMAIL SUBSCRIPTION
        # -----------------------------
        create_sub_details = CreateSubscriptionDetails(
            topic_id=topic_ocid,
            protocol="EMAIL",
            endpoint=ALERT_EMAIL,
        )

        subscription = ons_client.create_subscription(create_sub_details).data
        print(f"Created subscription: {subscription.id}")
        print("NOTE: Confirm the subscription from the email you receive.")

        # -----------------------------
        # 3. CREATE EVENT RULE
        # -----------------------------
        # Action: send to Notifications topic
        action_details = ActionDetails(
            action_type="ONS",
            is_enabled=True,
            description="Send IAM user change events to Notifications topic",
            topic_id=topic_ocid,
        )

        rule_action_details = RuleActionDetails(
            actions=[action_details]
        )

        create_rule_details = CreateRuleDetails(
            display_name=RULE_DISPLAY_NAME,
            compartment_id=COMPARTMENT_OCID,
            description=RULE_DESCRIPTION,
            is_enabled=True,
            condition=EVENT_CONDITION,
            actions=rule_action_details,
        )

        rule = events_client.create_rule(create_rule_details).data
        print(f"Created event rule: {rule.id}")
        ```

        ***

        ## 4. What This Gives You

        * When any IAM user is **created**, **updated**, or **deleted**, OCI Events will:
          * Match the rule condition.
          * Send an event to the **Notifications topic**.
          * Notifications will immediately send an **email alert** to `ALERT_EMAIL`.

        If you instead need alerts to appear in **Monitoring** specifically (as alarms on custom metrics), the pattern becomes:

        1. Events Rule → 2. OCI Function → 3. Function writes custom metric via Monitoring API → 4. Monitoring Alarm on that metric.

        I can provide that extended flow with code if you want to push IAM changes into Monitoring custom metrics instead of (or in addition to) email notifications.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_events_rule" "iam_user_changes" {
          # Replace with your compartment OCID
          compartment_id = "OCID_OF_COMPARTMENT_TO_MONITOR"

          display_name = "iam-user-changes-events-rule"
          description  = "Capture IAM user create/update/delete events for alerting"

          is_enabled = true

          # Event pattern to match IAM user lifecycle changes
          # Adjust region/compartment IDs if you want to scope more tightly
          condition = jsonencode({
            "eventType" : [
              "com.oraclecloud.identitycontrolplane.createuser",
              "com.oraclecloud.identitycontrolplane.updateuser",
              "com.oraclecloud.identitycontrolplane.deleteuser"
            ],
            "data" : {
              "identity" : {
                "compartmentId" : [
                  "OCID_OF_TENANCY_OR_IDENTITY_COMPARTMENT"
                ]
              }
            }
          })

          # Example action: send to an OCI Notifications topic for alerting
          actions {
            actions {
              action_type = "ONS"
              is_enabled  = true

              # Replace with your Notifications topic OCID
              topic_id    = "OCID_OF_OCI_NOTIFICATIONS_TOPIC"

              description = "Notify on IAM user lifecycle changes"
            }
          }

          # Optional freeform or defined tags
          freeform_tags = {
            "OWNER" = "SECURITY_TEAM"
          }
        }
        ```

        This change does not force replacement of other resources; Terraform will create or update this `oci_events_rule` in place.

        Verification: `terraform plan` should show one `oci_events_rule.iam_user_changes` to be created (or updated) with `is_enabled = true`, the `condition` JSON including the three `createuser/updateuser/deleteuser` event types, and an ONS action pointing at your Notifications topic.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>