OCI Monitoring Should Have Gateway Change Alarm Configured

Using Console

Here’s how to configure an alert in OCI so you’re notified when gateways are changed, using only the OCI Console. This uses Events + Notifications, which is the correct way to monitor configuration changes (Monitoring service is metric-based).

1. Create a Notification Topic

In the OCI Console, open the menu (☰) and go to:
Developer Services → Application Integration → Notifications
Make sure you’re in the correct compartment.
Click Create Topic.
Enter:
- Name: e.g., gateway-change-alerts-topic
- Description: e.g., Alerts for OCI gateway create/update/delete changes
Click Create.

2. Add a Subscription (e.g., Email or PagerDuty/Webhook)

On the topic you just created, click its name to open it.
Under Subscriptions, click Create Subscription.
Choose Protocol:
- For email: choose Email and enter your address.
- For webhook/Slack/PagerDuty: choose HTTPS and enter the endpoint.
Click Create.
For email, check your inbox and confirm the subscription.

3. Create an Events Rule for Gateway Changes

Open the menu (☰) and go to:
Observability & Management → Events Service
Pick the compartment where the gateways reside (or a higher-level compartment if you want broader coverage).
Click Create Rule.
Enter:
- Rule Name: e.g., gateway-change-events-rule
- Description: e.g., Triggers on create/update/delete of gateways
- State: leave as Enabled.
Under Rule Conditions, choose:
- Condition Type: Event Type
In Service Name, select Virtual Cloud Network (VCN) (or “Networking” depending on console wording).
In Event Type, select all gateway-related change events you care about, for example:
- CreateInternetGateway
- UpdateInternetGateway
- DeleteInternetGateway
- CreateNatGateway
- UpdateNatGateway
- DeleteNatGateway
- CreateDynamicRoutingGateway
- UpdateDynamicRoutingGateway
- DeleteDynamicRoutingGateway
- CreateServiceGateway
- UpdateServiceGateway
- DeleteServiceGateway (Names may appear as com.oraclecloud.virtualnetwork.createinternetgateway etc.; select the create/update/delete events for each gateway type.)
(Optional) Add Condition (Attributes) if you want to restrict to certain compartments, VCNs, or tags:
- Example: set data.additionalDetails.compartmentId to a specific Compartment OCID.
Under Actions, click + Add Action:
- Action Type: Notifications
- Topic: select the topic you created (gateway-change-alerts-topic).
Click Create Rule.

4. (Optional) Test the Alert

Make a controlled gateway change in the target compartment, for example:
- Edit an Internet Gateway (change display name) or
- Create a temporary NAT Gateway and then delete it.
Verify:
- The Events rule shows recent matches.
- You receive an email/webhook alert from the Notifications topic.

If you need the rule narrowed down (e.g., only for Internet Gateways or only in production compartments), tell me which gateway types and compartments you use, and I can give you an exact event filter JSON.

Using CLI

In OCI, “gateway change alerts” are best implemented with Events + Notifications, not a Monitoring metric alarm, because changes are configuration events, not metrics. You can still treat this as part of your alerting/monitoring posture.Below are step‑by‑step OCI CLI commands to create an email alert whenever a gateway (e.g., Internet Gateway) is created/updated/deleted.

1. Set required variables

Replace the values with your own and export them (or just inline them into the commands).

export COMPARTMENT_ID="<ocid.of.your.compartment>"
export REGION="<your-region-identifier>"        # e.g. us-phoenix-1
export EMAIL_ADDRESS="<your-email@example.com>"
export TOPIC_NAME="gateway-change-topic"
export SUBSCRIPTION_PROTOCOL="EMAIL"
export EVENTS_RULE_DISPLAY_NAME="gateway-change-rule"

Make sure your CLI is configured for the correct tenancy/profile and region:

oci setup config
oci iam region-subscription list
oci --region $REGION iam compartment list

2. Create a Notifications topic

oci ons topic create \
  --name "$TOPIC_NAME" \
  --compartment-id "$COMPARTMENT_ID" \
  --region "$REGION" \
  --wait-for-state ACTIVE

Capture the topic OCID:

export TOPIC_ID=$(oci ons topic list \
  --compartment-id "$COMPARTMENT_ID" \
  --region "$REGION" \
  --name "$TOPIC_NAME" \
  --query "data[0].\"topic-id\"" \
  --raw-output)

3. Create an email subscription

oci ons subscription create \
  --topic-id "$TOPIC_ID" \
  --protocol "$SUBSCRIPTION_PROTOCOL" \
  --endpoint "$EMAIL_ADDRESS" \
  --region "$REGION" \
  --wait-for-state PENDING

Then confirm the subscription from the email you receive; otherwise alerts won’t be delivered.

4. Create an Events rule for gateway changes

Below is an example rule for Internet Gateway changes via the VCN service (you can expand to NAT/DRG/etc. as needed).Create an event pattern JSON file gateway-change-pattern.json:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.updateinternetgateway",
    "com.oraclecloud.virtualnetwork.createinternetgateway",
    "com.oraclecloud.virtualnetwork.deleteinternetgateway"
  ],
  "data": {
    "compartmentId": [
      "<ocid.of.your.compartment>"
    ]
  }
}

Or if you want this to apply to any compartment in the tenancy, omit the compartmentId filter.Now create the Events rule:

oci events rule create \
  --compartment-id "$COMPARTMENT_ID" \
  --display-name "$EVENTS_RULE_DISPLAY_NAME" \
  --is-enabled true \
  --condition "$(cat gateway-change-pattern.json)" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "'"$TOPIC_ID"'"
      }
    ]
  }' \
  --region "$REGION"

This rule sends a notification to the topic whenever an Internet Gateway is created, updated, or deleted.

5. (Optional) Extend to other gateway types

Add additional eventType values in gateway-change-pattern.json as needed, for example:

NAT Gateway:
- com.oraclecloud.virtualnetwork.createnatgateway
- com.oraclecloud.virtualnetwork.updatenatgateway
- com.oraclecloud.virtualnetwork.deletenatgateway
Dynamic Routing Gateway (DRG):
- com.oraclecloud.virtualnetwork.createdrg
- com.oraclecloud.virtualnetwork.updatedrg
- com.oraclecloud.virtualnetwork.deletedrg

Example expanded pattern:

{
  "eventType": [
    "com.oraclecloud.virtualnetwork.createinternetgateway",
    "com.oraclecloud.virtualnetwork.updateinternetgateway",
    "com.oraclecloud.virtualnetwork.deleteinternetgateway",
    "com.oraclecloud.virtualnetwork.createnatgateway",
    "com.oraclecloud.virtualnetwork.updatenatgateway",
    "com.oraclecloud.virtualnetwork.deletenatgateway",
    "com.oraclecloud.virtualnetwork.createdrg",
    "com.oraclecloud.virtualnetwork.updatedrg",
    "com.oraclecloud.virtualnetwork.deletedrg"
  ]
}

Update the rule if you change the file:

export RULE_ID=$(oci events rule list \
  --compartment-id "$COMPARTMENT_ID" \
  --display-name "$EVENTS_RULE_DISPLAY_NAME" \
  --query "data[0].id" \
  --raw-output)

oci events rule update \
  --rule-id "$RULE_ID" \
  --condition "$(cat gateway-change-pattern.json)" \
  --is-enabled true

This setup satisfies “gateway change alarm configured” using OCI’s native alerting pipeline (Audit → Events → Notifications) via the OCI CLI. If you specifically need a Monitoring alarm on a custom metric instead, you’d first send these events to a custom metric (via Service Connector Hub) and then create an oci monitoring alarm create on that metric.

Using Python

You remediate this by creating an automated alert whenever a gateway (Internet/NAT/DRG/etc.) is changed, using OCI Events + Notifications via the Python SDK.Below is a minimal step‑by‑step plus example Python code that you can adapt.

1. Prerequisites

Install OCI SDK:

pip install oci

Configure your OCI credentials (user API key) in ~/.oci/config:

[DEFAULT]
user=ocid1.user.oc1..xxxx
fingerprint=xx:xx:xx:xx
key_file=/path/to/oci_api_key.pem
tenancy=ocid1.tenancy.oc1..xxxx
region=eu-frankfurt-1

Have:

compartment_ocid where gateways are located
An email address for alerts

2. High-level steps

Create a Notifications topic.
Create a subscription to that topic (e.g., email).
Create an Events rule that:
- Listens to Audit events for VCN gateways in your compartment.
- Targets the Notifications topic.
Test by updating/deleting a gateway and confirm email is sent.

3. Python example (end‑to‑end)

Important:
You must fill in the correct event types for gateway changes. Get them from:

Audit log of a sample gateway change in the OCI Console, or
Events Console → “Create Rule” wizard → “Virtual Cloud Network (VCN)” → “Show JSON”.

Replace GATEWAY_EVENT_TYPES with the list you get.

import oci

# -------------------------
# CONFIG
# -------------------------
CONFIG_PROFILE = "DEFAULT"  # section in ~/.oci/config

TENANCY_OCID = "ocid1.tenancy.oc1..xxxx"
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxx"
REGION = "eu-frankfurt-1"

ALERT_EMAIL = "you@example.com"

TOPIC_NAME = "gateway-change-alerts"
RULE_DISPLAY_NAME = "Gateway Change Alert Rule"

# Fill these from OCI Console / Audit logs
# Example placeholders – REPLACE with actual event types:
GATEWAY_EVENT_TYPES = [
    # These names are examples; confirm from OCI before using.
    "com.oraclecloud.virtualnetwork.updateinternetgateway",
    "com.oraclecloud.virtualnetwork.deleteinternetgateway",
    "com.oraclecloud.virtualnetwork.createnatgateway",
    "com.oraclecloud.virtualnetwork.updatenatgateway",
    "com.oraclecloud.virtualnetwork.deletenatgateway",
    "com.oraclecloud.virtualnetwork.updatedynamicroutinggateway",
    "com.oraclecloud.virtualnetwork.deletedynamicroutinggateway",
]

def main():
    config = oci.config.from_file(profile_name=CONFIG_PROFILE)
    config["region"] = REGION

    ons_client = oci.ons.NotificationControlPlaneClient(config)
    events_client = oci.events.EventsClient(config)

    # -------------------------------------------------
    # 1. Create Notifications topic
    # -------------------------------------------------
    print("Creating Notifications topic...")
    create_topic_details = oci.ons.models.CreateTopicDetails(
        name=TOPIC_NAME,
        compartment_id=COMPARTMENT_OCID,
        description="Alerts when VCN gateways are created/updated/deleted."
    )
    topic = ons_client.create_topic(create_topic_details).data
    topic_id = topic.topic_id
    print(f"Topic OCID: {topic_id}")

    # -------------------------------------------------
    # 2. Create email subscription
    # -------------------------------------------------
    print("Creating email subscription...")
    create_sub_details = oci.ons.models.CreateSubscriptionDetails(
        topic_id=topic_id,
        protocol="EMAIL",
        endpoint=ALERT_EMAIL
    )
    subscription = ons_client.create_subscription(create_sub_details).data
    print(f"Subscription OCID: {subscription.id}")
    print("You must CONFIRM this subscription from the email you receive.")

    # -------------------------------------------------
    # 3. Create Events rule for gateway changes
    # -------------------------------------------------
    # Condition is JSON as a string. It filters by:
    # - compartmentId = the compartment you care about
    # - eventType in list of gateway-related events
    condition = {
        "eventType": GATEWAY_EVENT_TYPES,
        "data": {
            "compartmentId": [COMPARTMENT_OCID]
        }
    }

    import json
    condition_str = json.dumps(condition)

    print("Creating Events rule...")
    create_rule_details = oci.events.models.CreateRuleDetails(
        display_name=RULE_DISPLAY_NAME,
        compartment_id=COMPARTMENT_OCID,
        is_enabled=True,
        condition=condition_str,
        actions=oci.events.models.ActionList(
            actions=[
                oci.events.models.NotificationAction(
                    description="Send notification on gateway change",
                    is_enabled=True,
                    topic_id=topic_id
                )
            ]
        )
    )

    rule = events_client.create_rule(create_rule_details).data
    print(f"Rule OCID: {rule.id}")
    print("Gateway change alert rule created.")

if __name__ == "__main__":
    main()

4. How this satisfies “gateway change alarm” requirement

Any Audit event that matches one of GATEWAY_EVENT_TYPES in the target compartment will:
- Trigger the Events rule.
- Send a message to the Notifications topic.
- Deliver an email (or other channel) to your configured endpoint.

To adapt:

Change COMPARTMENT_OCID if you want tenancy‑wide monitoring.
Add/remove event types to cover Internet Gateways, NAT Gateways, DRGs, Local Peering Gateways, etc.
Replace email with Slack/HTTPS, etc., by adjusting the subscription protocol.

Using Terraform

# OCI Monitoring alarms cannot be configured to detect configuration changes
# (such as create/update/delete of Internet Gateways or DRGs). They only work
# on metrics in the Monitoring service. Gateway provisioning changes are
# surfaced via the Events and Audit services, not as Monitoring metrics.

# To detect unauthorized gateway provisioning you must use:
# - oci_events_rule to match Audit events for Internet Gateway and DRG changes
# - oci_ons_notification_topic + oci_events_rule_actions or similar for alerting

# This cannot be remediated on oci_monitoring_alarm; there is no argument or
# metric in the Monitoring service that corresponds to "gateway changed".

# Example (for reference only – NOT an oci_monitoring_alarm):
# resource "oci_events_rule" "gateway_change_rule" { ... }

This finding cannot be fixed on oci_monitoring_alarm because OCI Monitoring does not expose gateway-change events as metrics. Use the Events service (in the Console: Developer Services → Events → Create rule, filtering on Audit events for Internet Gateway and Dynamic Routing Gateway create/update/delete) and attach a Notifications topic for alerting.

OCI Misconfigurations

OCI Monitoring Should Have Gateway Change Alarm Configured

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create a Notification Topic

2. Add a Subscription (e.g., Email or PagerDuty/Webhook)

3. Create an Events Rule for Gateway Changes

4. (Optional) Test the Alert

1. Set required variables

2. Create a Notifications topic

3. Create an email subscription

4. Create an Events rule for gateway changes

5. (Optional) Extend to other gateway types

1. Prerequisites

2. High-level steps

3. Python example (end‑to‑end)

4. How this satisfies “gateway change alarm” requirement

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Create a Notification Topic

​2. Add a Subscription (e.g., Email or PagerDuty/Webhook)

​3. Create an Events Rule for Gateway Changes

​4. (Optional) Test the Alert

​1. Set required variables

​2. Create a Notifications topic

​3. Create an email subscription

​4. Create an Events rule for gateway changes

​5. (Optional) Extend to other gateway types

​1. Prerequisites

​2. High-level steps

​3. Python example (end‑to‑end)

​4. How this satisfies “gateway change alarm” requirement

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create a Notification Topic

2. Add a Subscription (e.g., Email or PagerDuty/Webhook)

3. Create an Events Rule for Gateway Changes

4. (Optional) Test the Alert

1. Set required variables

2. Create a Notifications topic

3. Create an email subscription

4. Create an Events rule for gateway changes

5. (Optional) Extend to other gateway types

1. Prerequisites

2. High-level steps

3. Python example (end‑to‑end)

4. How this satisfies “gateway change alarm” requirement