> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Event Rule For Identity Provider Changes

### More Info:

Event rules must monitor Identity Provider configurations. An attacker modifying SAML or IdP settings can create persistent, untraceable backdoor access to the cloud environment.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the steps to configure an **Event Rule in OCI for Identity Provider changes** and wire it into **alerting** using the **OCI Console**.

        ***

        ## 1. Prerequisites

        1. You need permissions to:
           * Manage Events rules
           * Manage Notifications topics/subscriptions
           * Read IAM events\
             (Typically `manage events-rules`, `manage ons-topics`, etc., in the target compartment.)

        2. Decide which **compartment** you want the rule to apply to (usually your IAM “home” compartment or root compartment).

        ***

        ## 2. Create / Verify a Notifications Topic

        1. In the OCI Console, open the menu and go to:\
           **Observability & Management → Notifications**.
        2. On the **Topics** page, choose the correct **compartment**.
        3. Click **Create Topic** (or select an existing topic if you already have one).
        4. Enter:
           * **Name**: e.g., `idp-change-alerts-topic`
           * **Description**: e.g., `Alerts when OCI Identity Providers are created, updated, or deleted`
        5. Click **Create Topic**.

        ### Add a Subscription (email / other)

        1. Open the topic you just created.
        2. Click **Create Subscription**.
        3. Choose **Protocol** (e.g., `Email`).
        4. Enter the **Endpoint** (e.g., your email address).
        5. Click **Create**.
        6. Check your email and **confirm** the subscription.

        ***

        ## 3. Create an Event Rule for Identity Provider Changes

        1. In the OCI Console, open the menu:\
           **Observability & Management → Events Service → Rules**.
        2. Choose the **compartment** where you want the rule.
        3. Click **Create Rule**.

        ### Configure Basic Details

        1. **Name**: `idp-change-detection-rule`
        2. **Description**: `Triggers when Identity Providers are created, updated, or deleted`
        3. **Rule Status**: leave as **Enabled**.

        ### Set the Condition (Event Pattern)

        1. Under **Rule Conditions**, choose:
           * **Condition Type**: `Event Type`
        2. Select:
           * **Service Name**: `Identity and Access Management`
           * **Event Types**: Select all that are relevant, for example (names may be shown in your region as):
             * `CreateIdentityProvider`
             * `UpdateIdentityProvider`
             * `DeleteIdentityProvider`
        3. If there is a **compartment scope** option, ensure it covers:
           * The compartment(s) where your IdPs reside (often the tenancy root).

        (If the UI presents a JSON event pattern editor, ensure the `eventType` list includes the IdP events, e.g. `com.oraclecloud.identity.createidentityprovider`, `updateidentityprovider`, `deleteidentityprovider`.)

        ***

        ## 4. Attach an Action to Send Alerts

        1. In the **Actions** section of the rule:
           * Choose **Action Type**: `Notifications`
        2. Select the **Topic** you created earlier:\
           `idp-change-alerts-topic`
        3. Save the action.

        ***

        ## 5. Create the Rule

        1. Review all details.
        2. Click **Create** (or **Create Rule**).

        The rule is now active: **any Identity Provider create/update/delete operation will publish an event**, which the rule forwards to the **Notifications topic**, which in turn **sends alerts** (email, PagerDuty, HTTPS, etc., depending on your subscriptions).

        ***

        ## 6. (Optional) Test the Setup

        1. Make a safe change to an Identity Provider (e.g., tweak a description) or create a test IdP.
        2. Confirm you receive the notification through your configured subscription.

        ***

        This completes configuring “OCI Monitoring/Alerting” for Identity Provider changes using the **Events Service + Notifications** in the OCI Console.
      </Accordion>

      <Accordion title="Using CLI">
        Below are concise, step‑by‑step instructions to create an Event Rule for Identity Provider (IdP) changes and wire it into OCI Monitoring/Alerting using the OCI CLI.

        Assumptions:

        * You have OCI CLI configured (`oci setup config` already done).
        * You know your:
          * `COMPARTMENT_OCID`
          * `TOPIC_NAME` for notifications (you can create one)
          * Region/profile set in `~/.oci/config`.

        ***

        ## 1. Create an OCI Notifications Topic (if you don’t already have one)

        ```bash theme={null}
        COMPARTMENT_OCID="<your_compartment_ocid>"
        TOPIC_NAME="idp-change-alerts"

        oci ons topic create \
          --compartment-id "$COMPARTMENT_OCID" \
          --name "$TOPIC_NAME" \
          --description "Alerts for Identity Provider configuration changes" \
          --query "data.id" \
          --raw-output
        ```

        Save the output as `TOPIC_OCID`.

        ```bash theme={null}
        TOPIC_OCID="<output_from_previous_command>"
        ```

        ***

        ## 2. (Optional) Add a Subscription to the Topic

        Example: email subscription

        ```bash theme={null}
        SUBSCRIPTION_ENDPOINT="your.email@example.com"

        oci ons subscription create \
          --topic-id "$TOPIC_OCID" \
          --protocol "EMAIL" \
          --endpoint "$SUBSCRIPTION_ENDPOINT"
        ```

        Confirm the subscription via the email you receive.

        ***

        ## 3. Build the Event Rule Condition for IdP Changes

        Create a JSON file named `idp-events-condition.json`:

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createidentityprovider",
            "com.oraclecloud.identitycontrolplane.updateidentityprovider",
            "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
          ]
        }
        ```

        These event types cover create, update, and delete of Identity Providers.

        ***

        ## 4. Create the Event Rule with Action to Send to Notifications

        Create a JSON file for actions, `idp-events-actions.json`:

        ```json theme={null}
        {
          "actions": [
            {
              "actionType": "ONS",
              "isEnabled": true,
              "description": "Send IdP change events to Notifications topic",
              "topicId": "<TOPIC_OCID>"
            }
          ]
        }
        ```

        Replace `<TOPIC_OCID>` with the real OCID (or use env substitution before calling).

        Now create the Event Rule:

        ```bash theme={null}
        RULE_DISPLAY_NAME="IdentityProvider-Change-Rule"

        oci events rule create \
          --compartment-id "$COMPARTMENT_OCID" \
          --display-name "$RULE_DISPLAY_NAME" \
          --is-enabled true \
          --condition "$(cat idp-events-condition.json)" \
          --actions "$(cat idp-events-actions.json)"
        ```

        This creates an Event Rule that:

        * Listens for Identity Provider create/update/delete events in the compartment.
        * Sends those events to your Notifications topic.

        ***

        ## 5. (Optional) Confirm the Rule

        List rules:

        ```bash theme={null}
        oci events rule list \
          --compartment-id "$COMPARTMENT_OCID" \
          --all
        ```

        Show rule details:

        ```bash theme={null}
        RULE_OCID="<rule_ocid_from_list>"

        oci events rule get --rule-id "$RULE_OCID"
        ```

        ***

        ## 6. (Optional) Integrate with Monitoring Alarms (if needed)

        If you want Monitoring alarms (metrics-based) in addition to Event Notifications, the common pattern is:

        1. Use Event Rule → Service Connector → Logging or Streaming.
        2. From logs/stream, derive metrics or alerts.

        Most compliance checks for “Event Rule for Identity Provider Changes” are satisfied simply by the Event Rule + Notifications created above.

        ***

        If you tell me your exact compartment OCID and preferred notification type (email / Slack via HTTPS / PagerDuty, etc.), I can give you the exact ready‑to‑paste CLI commands.
      </Accordion>

      <Accordion title="Using Python">
        Below is a practical way to set up an OCI Event Rule that detects Identity Provider changes and triggers an alert using Python and the OCI SDK.

        ***

        ## 1. Prerequisites

        * OCI CLI config file (`~/.oci/config`) with a profile that has:
          * `events-rules-manage`
          * `ons-topics-manage`
          * `ons-subscriptions-manage`
          * Permissions in a policy such as:
            ```text theme={null}
            allow group <your_group> to manage events-rules in compartment <your_compartment_name>
            allow group <your_group> to manage ons-topics in compartment <your_compartment_name>
            allow group <your_group> to manage ons-subscriptions in compartment <your_compartment_name>
            ```

        * Python packages:
          ```bash theme={null}
          pip install oci
          ```

        * Know your:
          * `compartment_ocid`
          * `region`
          * Notification target email (or HTTPS endpoint).

        ***

        ## 2. What we’re creating

        1. **Notifications Topic** (ONS).
        2. **Subscription** (e.g., email).
        3. **Events Rule** that matches Identity Provider changes and sends events to the topic.

        Event types for Identity Provider changes (Identity Control Plane):

        * `com.oraclecloud.identitycontrolplane.createidentityprovider`
        * `com.oraclecloud.identitycontrolplane.updateidentityprovider`
        * `com.oraclecloud.identitycontrolplane.deleteidentityprovider`

        ***

        ## 3. Python Script

        ```python theme={null}
        import oci

        # -----------------------
        # CONFIG
        # -----------------------
        PROFILE_NAME = "DEFAULT"        # profile in ~/.oci/config
        COMPARTMENT_OCID = "<your_compartment_ocid>"
        ALERT_EMAIL = "you@example.com"
        TOPIC_DISPLAY_NAME = "IdP-Change-Alerts-Topic"
        RULE_DISPLAY_NAME = "IdP-Change-Event-Rule"
        REGION = "us-ashburn-1"         # set your region if needed

        # -----------------------
        # INIT CLIENTS
        # -----------------------
        config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
        # Optionally override region if you want:
        config["region"] = REGION

        ons_client = oci.ons.NotificationControlPlaneClient(config)
        events_client = oci.events.EventsClient(config)

        # -----------------------
        # 1. CREATE NOTIFICATIONS TOPIC
        # -----------------------
        create_topic_details = oci.ons.models.CreateTopicDetails(
            name=TOPIC_DISPLAY_NAME,          # system name
            compartment_id=COMPARTMENT_OCID,
            description="Alerts for OCI Identity Provider changes"
        )

        topic = ons_client.create_topic(create_topic_details).data
        topic_id = topic.topic_id
        print(f"Created topic: {topic_id}")

        # -----------------------
        # 2. CREATE SUBSCRIPTION (EMAIL)
        # -----------------------
        create_sub_details = oci.ons.models.CreateSubscriptionDetails(
            compartment_id=COMPARTMENT_OCID,
            topic_id=topic_id,
            protocol="EMAIL",
            endpoint=ALERT_EMAIL
        )
        subscription = ons_client.create_subscription(create_sub_details).data
        print(f"Created subscription: {subscription.id}")
        print("Confirm the subscription from the email you receive before expecting alerts.")

        # -----------------------
        # 3. CREATE EVENT RULE FOR IDENTITY PROVIDER CHANGES
        # -----------------------
        # Events condition JSON string
        condition = """
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createidentityprovider",
            "com.oraclecloud.identitycontrolplane.updateidentityprovider",
            "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
          ]
        }
        """.strip()

        # Action: send event to Notifications topic
        action_details = oci.events.models.ActionDetails(
            action_type="ONS",
            is_enabled=True,
            description="Send IdP change events to Notifications",
            topic_id=topic_id
        )

        create_rule_details = oci.events.models.CreateRuleDetails(
            compartment_id=COMPARTMENT_OCID,
            display_name=RULE_DISPLAY_NAME,
            description="Trigger notification when Identity Provider is created, updated, or deleted",
            is_enabled=True,
            condition=condition,
            actions=oci.events.models.RuleActions(
                actions=[action_details]
            )
        )

        rule = events_client.create_rule(create_rule_details).data
        print(f"Created event rule: {rule.id}")
        print("Event rule is enabled and will alert on IdP changes.")
        ```

        ***

        ## 4. Verification steps

        1. **Confirm email subscription** from the OCI Notifications email.
        2. Perform a test Identity Provider change:
           * Create, update, or delete an IdP in IAM (Federation → Identity Providers).
        3. Check your inbox for alert emails triggered by the event rule.

        This script fully automates the remediation: OCI Monitoring/Alerting for Identity Provider changes via Events + Notifications using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_events_rule" "identity_provider_changes" {
          # Replace with the OCID of the compartment that owns your IdPs
          compartment_id = "OCID_OF_IDENTITY_COMPARTMENT"
          display_name   = "Identity Provider Configuration Change Rule"
          description    = "Triggers notifications when OCI Identity Provider configuration changes occur"
          is_enabled     = true

          # Event pattern to catch IdP configuration changes
          condition = <<EOF
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createidentityprovider",
            "com.oraclecloud.identitycontrolplane.updateidentityprovider",
            "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
          ]
        }
        EOF

          # Route events to an Notifications topic used by your monitoring/alerting
          actions {
            actions {
              action_type = "ONS"
              is_enabled  = true
              # Replace with your Notifications topic OCID that feeds alerting/monitoring
              topic_id    = "OCID_OF_NOTIFICATIONS_TOPIC_FOR_ALERTING"
            }
          }
        }
        ```

        This update is in-place; it does not force replacement of the rule, only changes its match condition and target. After applying, `terraform plan` should show the `oci_events_rule.identity_provider_changes` either being created or having its `condition`, `is_enabled`, and/or `actions` updated to match the above.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>