OCI Monitoring Should Have Event Rule For IDP Group Mapping Changes

Using Console

Below are the exact steps to configure alerting in OCI (via Events + Notifications) for IdP Group Mapping changes using the OCI Console.

1. Identify/Decide Your Target Compartment

Log in to OCI Console.
In the top-left, select the correct region.
From the compartment selector (left side), choose the compartment where your IAM/Identity Domain resources and Events rule will live (often a central security/landing-zone compartment).

2. Create (or Reuse) a Notifications Topic

Open the navigation menu → Developer Services → Notifications → Topics.
Click Create Topic.
Enter:
- Name: e.g. idp-group-mapping-changes-topic
- Description: e.g. Alerts for IdP group mapping create/update/delete
- Compartment: same as chosen in step 1.
Click Create.

Add a Subscription (email, Slack, etc.)

Click the topic you just created.
Under Subscriptions, click Create Subscription.
Choose a Protocol:
- Email for simple alerts
- HTTPS, Slack (via HTTPS), etc. as needed.
Enter the endpoint (email address or webhook URL).
Click Create.
If you used Email, check your email and confirm the subscription (must be done once).

3. Create an Event Rule for IdP Group Mapping Changes

Open the navigation menu → Observability & Management → Events Service → Rules.
Click Create Rule.

3.1. Basic Info

Name: e.g. idp-group-mapping-change-rule
Description: e.g. Triggers when IdP group mappings are created, updated or deleted
Compartment: same as earlier (security/central compartment).

3.2. Define the Condition (Event Pattern)

You want to match IdP group mapping changes. These are IAM / Identity events. Depending on UI version and tenancy setup you’ll see one of the following patterns.

Option A – Using Event Type Picker (Preferred if Available)

Under Rule Condition, select Event Type.
Service: choose Identity (or IAM, or Identity Domains, depending on your tenancy UI).
Under Event Type, select all that apply for IdP Group Mappings, e.g. (names may vary slightly by region/tenant):
- com.oraclecloud.identitycontrolplane.createidpgroupprovisioning
- com.oraclecloud.identitycontrolplane.updateidpgroupprovisioning
- com.oraclecloud.identitycontrolplane.deleteidpgroupprovisioning
If the UI offers “IdP Group Mapping” as a resource type filter, select:
- Resource Type: IdpGroupMapping (or similar)
- Then pick the create/update/delete event types.

If you don’t see exactly those names, search for “idp”, “group mapping”, or “provisioning” in the event type dropdown and select the create/update/delete events that relate to IdP group mappings.

Option B – Using an Advanced Event Pattern (If Necessary)

Change the condition type to Event Pattern (Advanced).
Use a JSON pattern similar to:

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createIdpGroupMapping",
    "com.oraclecloud.identitycontrolplane.updateIdpGroupMapping",
    "com.oraclecloud.identitycontrolplane.deleteIdpGroupMapping"
  ]
}

Adjust eventType strings to match what’s documented/available for your tenancy (case and exact names matter).

3.3. Configure the Action

Under Actions, click Add Action.
Action Type: choose Notifications.
Topic: select the topic you created earlier, e.g. idp-group-mapping-changes-topic.
(Optional) Add a comment/description for the action.
Click Add Action.

4. Enable and Save the Rule

Ensure Rule State is set to Enabled.
Click Create Rule (or Save).

5. Test the Alert

Go to Identity & Security → Federation / Identity Providers (or Identity Domains, depending on your setup).
Perform a safe IdP group mapping change (for example, add a test mapping or modify a non-critical one).
Within a short period, confirm:
- The Events rule is listed as having triggered (Events → Rules → your rule → check metrics/logs if enabled).
- Your notification endpoint (email inbox, Slack channel, etc.) receives the alert message.

This configuration ensures any create, update, or delete of OCI IdP Group Mappings triggers an Event Rule and sends an alert via Notifications, satisfying the “OCI Monitoring Should Have Event Rule For IDP Group Mapping Changes” requirement using the OCI Console.

Using CLI

Below is a minimal, CLI-only way to set up an OCI Event Rule that alerts on IdP group mapping changes.Assumptions:

You have oci CLI configured with a profile that can manage Identity, Events, and Notifications.
You know your tenancy OCID and the compartment where you want the rule to live (typically the root compartment).

1. Set environment variables (for convenience)

export COMPARTMENT_ID="<ocid1.compartment.oc1..xxxx>"   # usually your root compartment / tenancy OCID
export REGION="<your-region-identifier>"                 # e.g. us-ashburn-1
export TOPIC_NAME="idp-group-mapping-alerts-topic"
export RULE_NAME="idp-group-mapping-change-rule"
export EMAIL_ADDRESS="you@example.com"

2. Create a Notifications topic

oci ons topic create \
  --name "$TOPIC_NAME" \
  --compartment-id "$COMPARTMENT_ID" \
  --region "$REGION"

Capture the topic-id from the output (or extract via jq):

export TOPIC_ID=$(oci ons topic list \
  --compartment-id "$COMPARTMENT_ID" \
  --region "$REGION" \
  --name "$TOPIC_NAME" \
  --all \
  --query "data[0].\"topic-id\"" \
  --raw-output)

3. Create an email subscription on the topic

oci ons subscription create \
  --topic-id "$TOPIC_ID" \
  --protocol EMAIL \
  --endpoint "$EMAIL_ADDRESS" \
  --region "$REGION"

Then confirm the subscription from the email you receive.

4. Prepare the Event Rule condition JSON

Create condition.json with the relevant event types for IdP group mapping changes:

cat > condition.json << 'EOF'
{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createidpgroupmapping",
    "com.oraclecloud.identitycontrolplane.updateidpgroupmapping",
    "com.oraclecloud.identitycontrolplane.deleteidpgroupmapping"
  ],
  "data": {
    "compartmentId": "<TENANCY_OR_ROOT_COMPARTMENT_OCID>"
  }
}
EOF

Replace <TENANCY_OR_ROOT_COMPARTMENT_OCID> with your actual COMPARTMENT_ID or tenancy OCID, then:

sed -i "s#<TENANCY_OR_ROOT_COMPARTMENT_OCID>#$COMPARTMENT_ID#g" condition.json

5. Prepare the Event Rule actions JSON

Create actions.json pointing to the Notifications topic:

cat > actions.json << EOF
{
  "actions": [
    {
      "kind": "ONS",
      "isEnabled": true,
      "topicId": "$TOPIC_ID",
      "description": "Send alert when IdP group mappings change"
    }
  ]
}
EOF

6. Create the Event Rule via OCI CLI

oci events rule create \
  --display-name "$RULE_NAME" \
  --is-enabled true \
  --compartment-id "$COMPARTMENT_ID" \
  --condition file://condition.json \
  --actions file://actions.json \
  --region "$REGION"

7. (Optional) Verify the rule

oci events rule list \
  --compartment-id "$COMPARTMENT_ID" \
  --region "$REGION" \
  --display-name "$RULE_NAME" \
  --all

This completes the monitoring/alerting setup for IdP group mapping changes via the OCI CLI.

Using Python

Below is a concrete way to enforce:“OCI Monitoring should have an event rule for IdP Group Mapping changes”using Python + OCI SDK (Events + Notifications), so that any IdP Group Mapping change triggers an alert.

1. What you will create

OCI Notifications Topic – target for alerts.
Subscription – e.g., email/Slack/HTTPS endpoint.
OCI Events Rule – listens for IdP Group Mapping changes in IAM and publishes to the topic.

You do this in a compartment (often the root compartment).

2. Prerequisites

Install OCI Python SDK:
pip install oci
Configure credentials:
oci setup config
This generates ~/.oci/config with:
- tenancy
- user
- fingerprint
- key_file
- region
Keep ready:
- COMPARTMENT_OCID – where to create the rule & topic (often root compartment).
- A working email (or webhook) to subscribe to the topic.

3. Event Types for IdP Group Mapping

OCI IAM emits events via the Events service. For IdP group mappings, typical event types (subject to region/tenancy support) are:

com.oraclecloud.identitycontrolplane.createidpgroupprovider
com.oraclecloud.identitycontrolplane.updateidpgroupprovider
com.oraclecloud.identitycontrolplane.deleteidpgroupprovider
com.oraclecloud.identitycontrolplane.createidentityprovidergroupmapping
com.oraclecloud.identitycontrolplane.updateidentityprovidergroupmapping
com.oraclecloud.identitycontrolplane.deleteidentityprovidergroupmapping

You can filter on the eventType field.

4. Python Script: Create Topic, Subscription, and Event Rule

import oci
import json
import time

# -----------------------------
# CONFIGURATION
# -----------------------------
CONFIG_FILE = "~/.oci/config"
CONFIG_PROFILE = "DEFAULT"

# Compartment OCID where Events Rule & Topic will live (often root)
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxxxxxxxxxxxxxxxxxxxxxxxx"

# A human-readable name/prefix for resources
RESOURCE_PREFIX = "idp-group-mapping-monitor"

# Notification settings
SUBSCRIPTION_PROTOCOL = "EMAIL"   # or "HTTPS", "SLACK", "PAGERDUTY" etc.
SUBSCRIPTION_ENDPOINT = "your-email@example.com"  # change to your receiver

# -----------------------------
# LOAD CONFIG AND INITIALIZE CLIENTS
# -----------------------------
config = oci.config.from_file(CONFIG_FILE, CONFIG_PROFILE)

notifications_client = oci.ons.NotificationDataPlaneClient(config)
notifications_cp_client = oci.ons.NotificationControlPlaneClient(config)
events_client = oci.events.EventsClient(config)

# -----------------------------
# 1) CREATE NOTIFICATIONS TOPIC
# -----------------------------
topic_name = f"{RESOURCE_PREFIX}-topic"
topic_details = oci.ons.models.CreateTopicDetails(
    name=topic_name,
    compartment_id=COMPARTMENT_OCID,
    description="Alerts for IAM IdP group mapping changes"
)

print(f"Creating Notifications topic '{topic_name}'...")
topic_response = notifications_cp_client.create_topic(topic_details)
topic_ocid = topic_response.data.topic_id
print(f"Topic OCID: {topic_ocid}")

# -----------------------------
# 2) CREATE SUBSCRIPTION
# -----------------------------
subscription_details = oci.ons.models.CreateSubscriptionDetails(
    topic_id=topic_ocid,
    protocol=SUBSCRIPTION_PROTOCOL.lower(),  # "email" / "https" / "slack" etc.
    endpoint=SUBSCRIPTION_ENDPOINT
)

print(f"Creating subscription ({SUBSCRIPTION_PROTOCOL}) to '{SUBSCRIPTION_ENDPOINT}'...")
sub_response = notifications_cp_client.create_subscription(subscription_details)
subscription_id = sub_response.data.id
print(f"Subscription OCID: {subscription_id}")
print("NOTE: For EMAIL, you must confirm the subscription via the email sent to you.")

# Optional: wait a few seconds for subscription to be usable
time.sleep(5)

# -----------------------------
# 3) CREATE EVENTS RULE
# -----------------------------
rule_display_name = f"{RESOURCE_PREFIX}-rule"

# Event pattern (filter) for IdP group mapping changes
# Adjust eventType list to what your tenancy supports.
event_pattern = {
    "eventType": [
        "com.oraclecloud.identitycontrolplane.createidentityprovidergroupmapping",
        "com.oraclecloud.identitycontrolplane.updateidentityprovidergroupmapping",
        "com.oraclecloud.identitycontrolplane.deleteidentityprovidergroupmapping"
    ]
    # You can further filter with "data.resourceName", "data.compartmentId", etc., if desired.
}

rule_details = oci.events.models.CreateRuleDetails(
    display_name=rule_display_name,
    description="Rule to trigger on OCI IAM IdP group mapping changes",
    is_enabled=True,
    compartment_id=COMPARTMENT_OCID,
    condition=json.dumps(event_pattern),
    actions=oci.events.models.ActionList(
        actions=[
            oci.events.models.NotificationAction(
                action_type="ONS",             # Notifications
                is_enabled=True,
                topic_id=topic_ocid
            )
        ]
    )
)

print(f"Creating Events rule '{rule_display_name}'...")
rule_response = events_client.create_rule(rule_details)
rule_ocid = rule_response.data.id
print(f"Rule OCID: {rule_ocid}")

print("\nSetup complete.")
print("Any future IdP group mapping changes should now publish an event to the topic,")
print("and you will receive alerts via the configured subscription (after confirmation).")

5. How this remediates the misconfiguration

Before: No monitoring rule for IdP Group Mapping changes.
After:
- An Events Rule specifically matching IdP group mapping event types is enabled.
- Rule action sends events to a Notifications Topic.
- You receive an alert (email/webhook/etc.) whenever IdP Group Mappings are created/updated/deleted.

If you want to integrate with Monitoring alarms (metrics), you’d typically have a downstream process (e.g., Function) that converts these events into custom metrics, then create a standard Monitoring Alarm on those metrics; but for pure “alert on change,” the Events + Notifications pattern above is normally sufficient.

Using Terraform

resource "oci_events_rule" "idp_group_mapping_changes" {
  # Monitors IdP-to-Group mapping changes and triggers an action (e.g., Notifications)
  compartment_id = COMPARTMENT_OCID   # replace with the OCID of the compartment where you want the rule
  display_name   = "idp-group-mapping-changes"
  description    = "Alert on create/update/delete of IdP-to-Group mappings"
  is_enabled     = true

  # Match Identity events for IdP group mapping changes
  condition = <<EOF
{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createIdpGroupMapping",
    "com.oraclecloud.identitycontrolplane.updateIdpGroupMapping",
    "com.oraclecloud.identitycontrolplane.deleteIdpGroupMapping"
  ]
}
EOF

  actions {
    actions {
      action_type = "ONS"
      is_enabled  = true
      description = "Send notification for IdP group mapping change"
      topic_id    = NOTIFICATIONS_TOPIC_OCID  # replace with the OCID of an OCI Notifications topic
    }
  }

  freeform_tags = {
    "SECURITY_USE" = "IDP_GROUP_MAPPING_MONITORING"
  }
}

Replace:

COMPARTMENT_OCID with the target compartment OCID for the Events rule.
NOTIFICATIONS_TOPIC_OCID with the OCID of the Notifications topic to receive alerts.

This change does not force replacement of other resources; it either creates a new oci_events_rule or updates the existing one in place.Verification: terraform plan should show an oci_events_rule.idp_group_mapping_changes resource with is_enabled = true and a condition that includes the three *IdpGroupMapping event types, plus the configured actions block.

OCI Misconfigurations

OCI Monitoring Should Have Event Rule For IDP Group Mapping Changes

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify/Decide Your Target Compartment

2. Create (or Reuse) a Notifications Topic

Add a Subscription (email, Slack, etc.)

3. Create an Event Rule for IdP Group Mapping Changes

3.1. Basic Info

3.2. Define the Condition (Event Pattern)

Option A – Using Event Type Picker (Preferred if Available)

Option B – Using an Advanced Event Pattern (If Necessary)

3.3. Configure the Action

4. Enable and Save the Rule

5. Test the Alert

1. Set environment variables (for convenience)

2. Create a Notifications topic

3. Create an email subscription on the topic

4. Prepare the Event Rule condition JSON

5. Prepare the Event Rule actions JSON

6. Create the Event Rule via OCI CLI

7. (Optional) Verify the rule

1. What you will create

2. Prerequisites

3. Event Types for IdP Group Mapping

4. Python Script: Create Topic, Subscription, and Event Rule

5. How this remediates the misconfiguration

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Identify/Decide Your Target Compartment

​2. Create (or Reuse) a Notifications Topic

​Add a Subscription (email, Slack, etc.)

​3. Create an Event Rule for IdP Group Mapping Changes

​3.1. Basic Info

​3.2. Define the Condition (Event Pattern)

​Option A – Using Event Type Picker (Preferred if Available)

​Option B – Using an Advanced Event Pattern (If Necessary)

​3.3. Configure the Action

​4. Enable and Save the Rule

​5. Test the Alert

​1. Set environment variables (for convenience)

​2. Create a Notifications topic

​3. Create an email subscription on the topic

​4. Prepare the Event Rule condition JSON

​5. Prepare the Event Rule actions JSON

​6. Create the Event Rule via OCI CLI

​7. (Optional) Verify the rule

​1. What you will create

​2. Prerequisites

​3. Event Types for IdP Group Mapping

​4. Python Script: Create Topic, Subscription, and Event Rule

​5. How this remediates the misconfiguration

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify/Decide Your Target Compartment

2. Create (or Reuse) a Notifications Topic

Add a Subscription (email, Slack, etc.)

3. Create an Event Rule for IdP Group Mapping Changes

3.1. Basic Info

3.2. Define the Condition (Event Pattern)

Option A – Using Event Type Picker (Preferred if Available)

Option B – Using an Advanced Event Pattern (If Necessary)

3.3. Configure the Action

4. Enable and Save the Rule

5. Test the Alert

1. Set environment variables (for convenience)

2. Create a Notifications topic

3. Create an email subscription on the topic

4. Prepare the Event Rule condition JSON

5. Prepare the Event Rule actions JSON

6. Create the Event Rule via OCI CLI

7. (Optional) Verify the rule

1. What you will create

2. Prerequisites

3. Event Types for IdP Group Mapping

4. Python Script: Create Topic, Subscription, and Event Rule

5. How this remediates the misconfiguration