> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Event Rule For IDP Group Mapping Changes

### More Info:

Event rules must monitor IdP-to-Group mappings. Modifying mappings allows an attacker to map standard federated users to highly privileged OCI administrator groups.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are the exact steps to configure alerting in OCI (via Events + Notifications) for IdP Group Mapping changes using the OCI Console.

        ***

        ## 1. Identify/Decide Your Target Compartment

        1. Log in to OCI Console.
        2. In the top-left, select the **correct region**.
        3. From the compartment selector (left side), choose the **compartment** where your IAM/Identity Domain resources and Events rule will live (often a central security/landing-zone compartment).

        ***

        ## 2. Create (or Reuse) a Notifications Topic

        1. Open the navigation menu → **Developer Services** → **Notifications** → **Topics**.
        2. Click **Create Topic**.
        3. Enter:
           * **Name:** e.g. `idp-group-mapping-changes-topic`
           * **Description:** e.g. `Alerts for IdP group mapping create/update/delete`
           * **Compartment:** same as chosen in step 1.
        4. Click **Create**.

        ### Add a Subscription (email, Slack, etc.)

        1. Click the topic you just created.
        2. Under **Subscriptions**, click **Create Subscription**.
        3. Choose a **Protocol**:
           * **Email** for simple alerts
           * **HTTPS**, **Slack (via HTTPS)**, etc. as needed.
        4. Enter the **endpoint** (email address or webhook URL).
        5. Click **Create**.
        6. If you used **Email**, check your email and **confirm** the subscription (must be done once).

        ***

        ## 3. Create an Event Rule for IdP Group Mapping Changes

        1. Open the navigation menu → **Observability & Management** → **Events Service** → **Rules**.
        2. Click **Create Rule**.

        ### 3.1. Basic Info

        1. **Name:** e.g. `idp-group-mapping-change-rule`
        2. **Description:** e.g. `Triggers when IdP group mappings are created, updated or deleted`
        3. **Compartment:** same as earlier (security/central compartment).

        ### 3.2. Define the Condition (Event Pattern)

        You want to match IdP group mapping changes. These are IAM / Identity events. Depending on UI version and tenancy setup you’ll see one of the following patterns.

        #### Option A – Using Event Type Picker (Preferred if Available)

        1. Under **Rule Condition**, select **Event Type**.
        2. **Service:** choose **Identity** (or **IAM**, or **Identity Domains**, depending on your tenancy UI).
        3. Under **Event Type**, select all that apply for IdP Group Mappings, e.g. (names may vary slightly by region/tenant):

           * `com.oraclecloud.identitycontrolplane.createidpgroupprovisioning`
           * `com.oraclecloud.identitycontrolplane.updateidpgroupprovisioning`
           * `com.oraclecloud.identitycontrolplane.deleteidpgroupprovisioning`

           If the UI offers “IdP Group Mapping” as a resource type filter, select:

           * **Resource Type:** `IdpGroupMapping` (or similar)
           * Then pick the create/update/delete event types.

        > If you don’t see exactly those names, search for “idp”, “group mapping”, or “provisioning” in the event type dropdown and select the create/update/delete events that relate to IdP group mappings.

        #### Option B – Using an Advanced Event Pattern (If Necessary)

        1. Change the condition type to **Event Pattern (Advanced)**.
        2. Use a JSON pattern similar to:

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createIdpGroupMapping",
            "com.oraclecloud.identitycontrolplane.updateIdpGroupMapping",
            "com.oraclecloud.identitycontrolplane.deleteIdpGroupMapping"
          ]
        }
        ```

        Adjust eventType strings to match what’s documented/available for your tenancy (case and exact names matter).

        ***

        ### 3.3. Configure the Action

        1. Under **Actions**, click **Add Action**.
        2. **Action Type:** choose **Notifications**.
        3. **Topic:** select the topic you created earlier, e.g. `idp-group-mapping-changes-topic`.
        4. (Optional) Add a comment/description for the action.
        5. Click **Add Action**.

        ***

        ## 4. Enable and Save the Rule

        1. Ensure **Rule State** is set to **Enabled**.
        2. Click **Create Rule** (or **Save**).

        ***

        ## 5. Test the Alert

        1. Go to **Identity & Security** → **Federation / Identity Providers** (or **Identity Domains**, depending on your setup).
        2. Perform a **safe** IdP group mapping change (for example, add a test mapping or modify a non-critical one).
        3. Within a short period, confirm:
           * The **Events** rule is listed as having triggered (Events → Rules → your rule → check metrics/logs if enabled).
           * Your **notification endpoint** (email inbox, Slack channel, etc.) receives the alert message.

        ***

        This configuration ensures any create, update, or delete of OCI IdP Group Mappings triggers an Event Rule and sends an alert via Notifications, satisfying the “OCI Monitoring Should Have Event Rule For IDP Group Mapping Changes” requirement using the OCI Console.
      </Accordion>

      <Accordion title="Using CLI">
        Below is a minimal, CLI-only way to set up an OCI Event Rule that alerts on IdP group mapping changes.

        Assumptions:

        * You have `oci` CLI configured with a profile that can manage Identity, Events, and Notifications.
        * You know your tenancy OCID and the compartment where you want the rule to live (typically the root compartment).

        ***

        ## 1. Set environment variables (for convenience)

        ```bash theme={null}
        export COMPARTMENT_ID="<ocid1.compartment.oc1..xxxx>"   # usually your root compartment / tenancy OCID
        export REGION="<your-region-identifier>"                 # e.g. us-ashburn-1
        export TOPIC_NAME="idp-group-mapping-alerts-topic"
        export RULE_NAME="idp-group-mapping-change-rule"
        export EMAIL_ADDRESS="you@example.com"
        ```

        ***

        ## 2. Create a Notifications topic

        ```bash theme={null}
        oci ons topic create \
          --name "$TOPIC_NAME" \
          --compartment-id "$COMPARTMENT_ID" \
          --region "$REGION"
        ```

        Capture the `topic-id` from the output (or extract via `jq`):

        ```bash theme={null}
        export TOPIC_ID=$(oci ons topic list \
          --compartment-id "$COMPARTMENT_ID" \
          --region "$REGION" \
          --name "$TOPIC_NAME" \
          --all \
          --query "data[0].\"topic-id\"" \
          --raw-output)
        ```

        ***

        ## 3. Create an email subscription on the topic

        ```bash theme={null}
        oci ons subscription create \
          --topic-id "$TOPIC_ID" \
          --protocol EMAIL \
          --endpoint "$EMAIL_ADDRESS" \
          --region "$REGION"
        ```

        Then **confirm the subscription** from the email you receive.

        ***

        ## 4. Prepare the Event Rule condition JSON

        Create `condition.json` with the relevant event types for IdP group mapping changes:

        ```bash theme={null}
        cat > condition.json << 'EOF'
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createidpgroupmapping",
            "com.oraclecloud.identitycontrolplane.updateidpgroupmapping",
            "com.oraclecloud.identitycontrolplane.deleteidpgroupmapping"
          ],
          "data": {
            "compartmentId": "<TENANCY_OR_ROOT_COMPARTMENT_OCID>"
          }
        }
        EOF
        ```

        Replace `<TENANCY_OR_ROOT_COMPARTMENT_OCID>` with your actual `COMPARTMENT_ID` or tenancy OCID, then:

        ```bash theme={null}
        sed -i "s#<TENANCY_OR_ROOT_COMPARTMENT_OCID>#$COMPARTMENT_ID#g" condition.json
        ```

        ***

        ## 5. Prepare the Event Rule actions JSON

        Create `actions.json` pointing to the Notifications topic:

        ```bash theme={null}
        cat > actions.json << EOF
        {
          "actions": [
            {
              "kind": "ONS",
              "isEnabled": true,
              "topicId": "$TOPIC_ID",
              "description": "Send alert when IdP group mappings change"
            }
          ]
        }
        EOF
        ```

        ***

        ## 6. Create the Event Rule via OCI CLI

        ```bash theme={null}
        oci events rule create \
          --display-name "$RULE_NAME" \
          --is-enabled true \
          --compartment-id "$COMPARTMENT_ID" \
          --condition file://condition.json \
          --actions file://actions.json \
          --region "$REGION"
        ```

        ***

        ## 7. (Optional) Verify the rule

        ```bash theme={null}
        oci events rule list \
          --compartment-id "$COMPARTMENT_ID" \
          --region "$REGION" \
          --display-name "$RULE_NAME" \
          --all
        ```

        This completes the monitoring/alerting setup for IdP group mapping changes via the OCI CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below is a concrete way to enforce:

        **“OCI Monitoring should have an event rule for IdP Group Mapping changes”**

        using **Python + OCI SDK** (Events + Notifications), so that any **IdP Group Mapping change triggers an alert**.

        ***

        ## 1. What you will create

        1. **OCI Notifications Topic** – target for alerts.
        2. **Subscription** – e.g., email/Slack/HTTPS endpoint.
        3. **OCI Events Rule** – listens for **IdP Group Mapping changes** in IAM and publishes to the topic.

        You do this in a **compartment** (often the root compartment).

        ***

        ## 2. Prerequisites

        1. Install OCI Python SDK:
           ```bash theme={null}
           pip install oci
           ```

        2. Configure credentials:
           ```bash theme={null}
           oci setup config
           ```
           This generates `~/.oci/config` with:
           * tenancy
           * user
           * fingerprint
           * key\_file
           * region

        3. Keep ready:
           * `COMPARTMENT_OCID` – where to create the rule & topic (often root compartment).
           * A working email (or webhook) to subscribe to the topic.

        ***

        ## 3. Event Types for IdP Group Mapping

        OCI IAM emits events via the **Events service**. For IdP group mappings, typical event types (subject to region/tenancy support) are:

        * `com.oraclecloud.identitycontrolplane.createidpgroupprovider`
        * `com.oraclecloud.identitycontrolplane.updateidpgroupprovider`
        * `com.oraclecloud.identitycontrolplane.deleteidpgroupprovider`
        * `com.oraclecloud.identitycontrolplane.createidentityprovidergroupmapping`
        * `com.oraclecloud.identitycontrolplane.updateidentityprovidergroupmapping`
        * `com.oraclecloud.identitycontrolplane.deleteidentityprovidergroupmapping`

        You can filter on the **eventType** field.

        ***

        ## 4. Python Script: Create Topic, Subscription, and Event Rule

        ```python theme={null}
        import oci
        import json
        import time

        # -----------------------------
        # CONFIGURATION
        # -----------------------------
        CONFIG_FILE = "~/.oci/config"
        CONFIG_PROFILE = "DEFAULT"

        # Compartment OCID where Events Rule & Topic will live (often root)
        COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxxxxxxxxxxxxxxxxxxxxxxxx"

        # A human-readable name/prefix for resources
        RESOURCE_PREFIX = "idp-group-mapping-monitor"

        # Notification settings
        SUBSCRIPTION_PROTOCOL = "EMAIL"   # or "HTTPS", "SLACK", "PAGERDUTY" etc.
        SUBSCRIPTION_ENDPOINT = "your-email@example.com"  # change to your receiver

        # -----------------------------
        # LOAD CONFIG AND INITIALIZE CLIENTS
        # -----------------------------
        config = oci.config.from_file(CONFIG_FILE, CONFIG_PROFILE)

        notifications_client = oci.ons.NotificationDataPlaneClient(config)
        notifications_cp_client = oci.ons.NotificationControlPlaneClient(config)
        events_client = oci.events.EventsClient(config)

        # -----------------------------
        # 1) CREATE NOTIFICATIONS TOPIC
        # -----------------------------
        topic_name = f"{RESOURCE_PREFIX}-topic"
        topic_details = oci.ons.models.CreateTopicDetails(
            name=topic_name,
            compartment_id=COMPARTMENT_OCID,
            description="Alerts for IAM IdP group mapping changes"
        )

        print(f"Creating Notifications topic '{topic_name}'...")
        topic_response = notifications_cp_client.create_topic(topic_details)
        topic_ocid = topic_response.data.topic_id
        print(f"Topic OCID: {topic_ocid}")

        # -----------------------------
        # 2) CREATE SUBSCRIPTION
        # -----------------------------
        subscription_details = oci.ons.models.CreateSubscriptionDetails(
            topic_id=topic_ocid,
            protocol=SUBSCRIPTION_PROTOCOL.lower(),  # "email" / "https" / "slack" etc.
            endpoint=SUBSCRIPTION_ENDPOINT
        )

        print(f"Creating subscription ({SUBSCRIPTION_PROTOCOL}) to '{SUBSCRIPTION_ENDPOINT}'...")
        sub_response = notifications_cp_client.create_subscription(subscription_details)
        subscription_id = sub_response.data.id
        print(f"Subscription OCID: {subscription_id}")
        print("NOTE: For EMAIL, you must confirm the subscription via the email sent to you.")

        # Optional: wait a few seconds for subscription to be usable
        time.sleep(5)

        # -----------------------------
        # 3) CREATE EVENTS RULE
        # -----------------------------
        rule_display_name = f"{RESOURCE_PREFIX}-rule"

        # Event pattern (filter) for IdP group mapping changes
        # Adjust eventType list to what your tenancy supports.
        event_pattern = {
            "eventType": [
                "com.oraclecloud.identitycontrolplane.createidentityprovidergroupmapping",
                "com.oraclecloud.identitycontrolplane.updateidentityprovidergroupmapping",
                "com.oraclecloud.identitycontrolplane.deleteidentityprovidergroupmapping"
            ]
            # You can further filter with "data.resourceName", "data.compartmentId", etc., if desired.
        }

        rule_details = oci.events.models.CreateRuleDetails(
            display_name=rule_display_name,
            description="Rule to trigger on OCI IAM IdP group mapping changes",
            is_enabled=True,
            compartment_id=COMPARTMENT_OCID,
            condition=json.dumps(event_pattern),
            actions=oci.events.models.ActionList(
                actions=[
                    oci.events.models.NotificationAction(
                        action_type="ONS",             # Notifications
                        is_enabled=True,
                        topic_id=topic_ocid
                    )
                ]
            )
        )

        print(f"Creating Events rule '{rule_display_name}'...")
        rule_response = events_client.create_rule(rule_details)
        rule_ocid = rule_response.data.id
        print(f"Rule OCID: {rule_ocid}")

        print("\nSetup complete.")
        print("Any future IdP group mapping changes should now publish an event to the topic,")
        print("and you will receive alerts via the configured subscription (after confirmation).")
        ```

        ***

        ## 5. How this remediates the misconfiguration

        * Before: No monitoring rule for **IdP Group Mapping changes**.
        * After:
          * An **Events Rule** specifically matching IdP group mapping event types is enabled.
          * Rule action sends events to a **Notifications Topic**.
          * You receive an **alert** (email/webhook/etc.) whenever IdP Group Mappings are created/updated/deleted.

        If you want to integrate with **Monitoring alarms** (metrics), you’d typically have a downstream process (e.g., Function) that converts these events into custom metrics, then create a standard Monitoring Alarm on those metrics; but for pure “alert on change,” the Events + Notifications pattern above is normally sufficient.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_events_rule" "idp_group_mapping_changes" {
          # Monitors IdP-to-Group mapping changes and triggers an action (e.g., Notifications)
          compartment_id = COMPARTMENT_OCID   # replace with the OCID of the compartment where you want the rule
          display_name   = "idp-group-mapping-changes"
          description    = "Alert on create/update/delete of IdP-to-Group mappings"
          is_enabled     = true

          # Match Identity events for IdP group mapping changes
          condition = <<EOF
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createIdpGroupMapping",
            "com.oraclecloud.identitycontrolplane.updateIdpGroupMapping",
            "com.oraclecloud.identitycontrolplane.deleteIdpGroupMapping"
          ]
        }
        EOF

          actions {
            actions {
              action_type = "ONS"
              is_enabled  = true
              description = "Send notification for IdP group mapping change"
              topic_id    = NOTIFICATIONS_TOPIC_OCID  # replace with the OCID of an OCI Notifications topic
            }
          }

          freeform_tags = {
            "SECURITY_USE" = "IDP_GROUP_MAPPING_MONITORING"
          }
        }
        ```

        Replace:

        * `COMPARTMENT_OCID` with the target compartment OCID for the Events rule.
        * `NOTIFICATIONS_TOPIC_OCID` with the OCID of the Notifications topic to receive alerts.

        This change does not force replacement of other resources; it either creates a new `oci_events_rule` or updates the existing one in place.

        Verification: `terraform plan` should show an `oci_events_rule.idp_group_mapping_changes` resource with `is_enabled = true` and a `condition` that includes the three `*IdpGroupMapping` event types, plus the configured `actions` block.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>