> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Monitoring Should Have Gateway Change Alarm Configured ### More Info: Monitor changes to Internet and Dynamic Routing Gateways. Unauthorized gateway provisioning can create illicit bridges between secure private networks and the internet. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Here’s how to configure an alert in OCI so you’re notified when gateways are changed, using only the OCI Console. This uses **Events + Notifications**, which is the correct way to monitor configuration changes (Monitoring service is metric-based). *** ## 1. Create a Notification Topic 1. In the OCI Console, open the menu (☰) and go to:\ **Developer Services → Application Integration → Notifications** 2. Make sure you’re in the **correct compartment**. 3. Click **Create Topic**. 4. Enter: * **Name**: e.g., `gateway-change-alerts-topic` * **Description**: e.g., `Alerts for OCI gateway create/update/delete changes` 5. Click **Create**. *** ## 2. Add a Subscription (e.g., Email or PagerDuty/Webhook) 1. On the topic you just created, click its **name** to open it. 2. Under **Subscriptions**, click **Create Subscription**. 3. Choose **Protocol**: * For email: choose **Email** and enter your address. * For webhook/Slack/PagerDuty: choose **HTTPS** and enter the endpoint. 4. Click **Create**. 5. For **email**, check your inbox and **confirm** the subscription. *** ## 3. Create an Events Rule for Gateway Changes 1. Open the menu (☰) and go to:\ **Observability & Management → Events Service** 2. Pick the **compartment** where the gateways reside (or a higher-level compartment if you want broader coverage). 3. Click **Create Rule**. 4. Enter: * **Rule Name**: e.g., `gateway-change-events-rule` * **Description**: e.g., `Triggers on create/update/delete of gateways` * **State**: leave as **Enabled**. 5. Under **Rule Conditions**, choose: * **Condition Type**: `Event Type` 6. In **Service Name**, select **Virtual Cloud Network (VCN)** (or “Networking” depending on console wording). 7. In **Event Type**, select all gateway-related change events you care about, for example: * `CreateInternetGateway` * `UpdateInternetGateway` * `DeleteInternetGateway` * `CreateNatGateway` * `UpdateNatGateway` * `DeleteNatGateway` * `CreateDynamicRoutingGateway` * `UpdateDynamicRoutingGateway` * `DeleteDynamicRoutingGateway` * `CreateServiceGateway` * `UpdateServiceGateway` * `DeleteServiceGateway` (Names may appear as `com.oraclecloud.virtualnetwork.createinternetgateway` etc.; select the create/update/delete events for each gateway type.) 8. (Optional) Add **Condition (Attributes)** if you want to restrict to certain compartments, VCNs, or tags: * Example: set `data.additionalDetails.compartmentId` to a specific Compartment OCID. 9. Under **Actions**, click **+ Add Action**: * **Action Type**: `Notifications` * **Topic**: select the topic you created (`gateway-change-alerts-topic`). 10. Click **Create Rule**. *** ## 4. (Optional) Test the Alert 1. Make a controlled gateway change in the target compartment, for example: * Edit an Internet Gateway (change display name) or * Create a temporary NAT Gateway and then delete it. 2. Verify: * The **Events rule** shows recent matches. * You receive an **email/webhook** alert from the Notifications topic. *** If you need the rule narrowed down (e.g., only for Internet Gateways or only in production compartments), tell me which gateway types and compartments you use, and I can give you an exact event filter JSON. In OCI, “gateway change alerts” are best implemented with **Events + Notifications**, not a Monitoring metric alarm, because changes are configuration events, not metrics. You can still treat this as part of your alerting/monitoring posture. Below are step‑by‑step OCI CLI commands to create an email alert whenever a gateway (e.g., Internet Gateway) is created/updated/deleted. *** ## 1. Set required variables Replace the values with your own and export them (or just inline them into the commands). ```bash theme={null} export COMPARTMENT_ID="" export REGION="" # e.g. us-phoenix-1 export EMAIL_ADDRESS="" export TOPIC_NAME="gateway-change-topic" export SUBSCRIPTION_PROTOCOL="EMAIL" export EVENTS_RULE_DISPLAY_NAME="gateway-change-rule" ``` Make sure your CLI is configured for the correct tenancy/profile and region: ```bash theme={null} oci setup config oci iam region-subscription list oci --region $REGION iam compartment list ``` *** ## 2. Create a Notifications topic ```bash theme={null} oci ons topic create \ --name "$TOPIC_NAME" \ --compartment-id "$COMPARTMENT_ID" \ --region "$REGION" \ --wait-for-state ACTIVE ``` Capture the topic OCID: ```bash theme={null} export TOPIC_ID=$(oci ons topic list \ --compartment-id "$COMPARTMENT_ID" \ --region "$REGION" \ --name "$TOPIC_NAME" \ --query "data[0].\"topic-id\"" \ --raw-output) ``` *** ## 3. Create an email subscription ```bash theme={null} oci ons subscription create \ --topic-id "$TOPIC_ID" \ --protocol "$SUBSCRIPTION_PROTOCOL" \ --endpoint "$EMAIL_ADDRESS" \ --region "$REGION" \ --wait-for-state PENDING ``` Then **confirm the subscription** from the email you receive; otherwise alerts won’t be delivered. *** ## 4. Create an Events rule for gateway changes Below is an example rule for **Internet Gateway** changes via the `VCN` service (you can expand to NAT/DRG/etc. as needed). Create an event pattern JSON file `gateway-change-pattern.json`: ```json theme={null} { "eventType": [ "com.oraclecloud.virtualnetwork.updateinternetgateway", "com.oraclecloud.virtualnetwork.createinternetgateway", "com.oraclecloud.virtualnetwork.deleteinternetgateway" ], "data": { "compartmentId": [ "" ] } } ``` Or if you want this to apply to any compartment in the tenancy, omit the `compartmentId` filter. Now create the Events rule: ```bash theme={null} oci events rule create \ --compartment-id "$COMPARTMENT_ID" \ --display-name "$EVENTS_RULE_DISPLAY_NAME" \ --is-enabled true \ --condition "$(cat gateway-change-pattern.json)" \ --actions '{ "actions": [ { "actionType": "ONS", "isEnabled": true, "topicId": "'"$TOPIC_ID"'" } ] }' \ --region "$REGION" ``` This rule sends a notification to the topic whenever an Internet Gateway is created, updated, or deleted. *** ## 5. (Optional) Extend to other gateway types Add additional `eventType` values in `gateway-change-pattern.json` as needed, for example: * NAT Gateway: * `com.oraclecloud.virtualnetwork.createnatgateway` * `com.oraclecloud.virtualnetwork.updatenatgateway` * `com.oraclecloud.virtualnetwork.deletenatgateway` * Dynamic Routing Gateway (DRG): * `com.oraclecloud.virtualnetwork.createdrg` * `com.oraclecloud.virtualnetwork.updatedrg` * `com.oraclecloud.virtualnetwork.deletedrg` Example expanded pattern: ```json theme={null} { "eventType": [ "com.oraclecloud.virtualnetwork.createinternetgateway", "com.oraclecloud.virtualnetwork.updateinternetgateway", "com.oraclecloud.virtualnetwork.deleteinternetgateway", "com.oraclecloud.virtualnetwork.createnatgateway", "com.oraclecloud.virtualnetwork.updatenatgateway", "com.oraclecloud.virtualnetwork.deletenatgateway", "com.oraclecloud.virtualnetwork.createdrg", "com.oraclecloud.virtualnetwork.updatedrg", "com.oraclecloud.virtualnetwork.deletedrg" ] } ``` Update the rule if you change the file: ```bash theme={null} export RULE_ID=$(oci events rule list \ --compartment-id "$COMPARTMENT_ID" \ --display-name "$EVENTS_RULE_DISPLAY_NAME" \ --query "data[0].id" \ --raw-output) oci events rule update \ --rule-id "$RULE_ID" \ --condition "$(cat gateway-change-pattern.json)" \ --is-enabled true ``` *** This setup satisfies “gateway change alarm configured” using OCI’s native alerting pipeline (Audit → Events → Notifications) via the OCI CLI. If you specifically need a **Monitoring** alarm on a custom metric instead, you’d first send these events to a custom metric (via Service Connector Hub) and then create an `oci monitoring alarm create` on that metric. You remediate this by creating an automated alert whenever a gateway (Internet/NAT/DRG/etc.) is changed, using OCI Events + Notifications via the Python SDK. Below is a minimal step‑by‑step plus example Python code that you can adapt. *** ## 1. Prerequisites 1. Install OCI SDK: ```bash theme={null} pip install oci ``` 2. Configure your OCI credentials (user API key) in `~/.oci/config`: ```ini theme={null} [DEFAULT] user=ocid1.user.oc1..xxxx fingerprint=xx:xx:xx:xx key_file=/path/to/oci_api_key.pem tenancy=ocid1.tenancy.oc1..xxxx region=eu-frankfurt-1 ``` 3. Have: * `compartment_ocid` where gateways are located * An email address for alerts *** ## 2. High-level steps 1. Create a Notifications topic. 2. Create a subscription to that topic (e.g., email). 3. Create an Events rule that: * Listens to Audit events for VCN gateways in your compartment. * Targets the Notifications topic. 4. Test by updating/deleting a gateway and confirm email is sent. *** ## 3. Python example (end‑to‑end) **Important:**\ You must fill in the correct event types for gateway changes. Get them from: * Audit log of a sample gateway change in the OCI Console, or * Events Console → “Create Rule” wizard → “Virtual Cloud Network (VCN)” → “Show JSON”. Replace `GATEWAY_EVENT_TYPES` with the list you get. ```python theme={null} import oci # ------------------------- # CONFIG # ------------------------- CONFIG_PROFILE = "DEFAULT" # section in ~/.oci/config TENANCY_OCID = "ocid1.tenancy.oc1..xxxx" COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxx" REGION = "eu-frankfurt-1" ALERT_EMAIL = "you@example.com" TOPIC_NAME = "gateway-change-alerts" RULE_DISPLAY_NAME = "Gateway Change Alert Rule" # Fill these from OCI Console / Audit logs # Example placeholders – REPLACE with actual event types: GATEWAY_EVENT_TYPES = [ # These names are examples; confirm from OCI before using. "com.oraclecloud.virtualnetwork.updateinternetgateway", "com.oraclecloud.virtualnetwork.deleteinternetgateway", "com.oraclecloud.virtualnetwork.createnatgateway", "com.oraclecloud.virtualnetwork.updatenatgateway", "com.oraclecloud.virtualnetwork.deletenatgateway", "com.oraclecloud.virtualnetwork.updatedynamicroutinggateway", "com.oraclecloud.virtualnetwork.deletedynamicroutinggateway", ] def main(): config = oci.config.from_file(profile_name=CONFIG_PROFILE) config["region"] = REGION ons_client = oci.ons.NotificationControlPlaneClient(config) events_client = oci.events.EventsClient(config) # ------------------------------------------------- # 1. Create Notifications topic # ------------------------------------------------- print("Creating Notifications topic...") create_topic_details = oci.ons.models.CreateTopicDetails( name=TOPIC_NAME, compartment_id=COMPARTMENT_OCID, description="Alerts when VCN gateways are created/updated/deleted." ) topic = ons_client.create_topic(create_topic_details).data topic_id = topic.topic_id print(f"Topic OCID: {topic_id}") # ------------------------------------------------- # 2. Create email subscription # ------------------------------------------------- print("Creating email subscription...") create_sub_details = oci.ons.models.CreateSubscriptionDetails( topic_id=topic_id, protocol="EMAIL", endpoint=ALERT_EMAIL ) subscription = ons_client.create_subscription(create_sub_details).data print(f"Subscription OCID: {subscription.id}") print("You must CONFIRM this subscription from the email you receive.") # ------------------------------------------------- # 3. Create Events rule for gateway changes # ------------------------------------------------- # Condition is JSON as a string. It filters by: # - compartmentId = the compartment you care about # - eventType in list of gateway-related events condition = { "eventType": GATEWAY_EVENT_TYPES, "data": { "compartmentId": [COMPARTMENT_OCID] } } import json condition_str = json.dumps(condition) print("Creating Events rule...") create_rule_details = oci.events.models.CreateRuleDetails( display_name=RULE_DISPLAY_NAME, compartment_id=COMPARTMENT_OCID, is_enabled=True, condition=condition_str, actions=oci.events.models.ActionList( actions=[ oci.events.models.NotificationAction( description="Send notification on gateway change", is_enabled=True, topic_id=topic_id ) ] ) ) rule = events_client.create_rule(create_rule_details).data print(f"Rule OCID: {rule.id}") print("Gateway change alert rule created.") if __name__ == "__main__": main() ``` *** ## 4. How this satisfies “gateway change alarm” requirement * Any Audit event that matches one of `GATEWAY_EVENT_TYPES` in the target compartment will: * Trigger the Events rule. * Send a message to the Notifications topic. * Deliver an email (or other channel) to your configured endpoint. To adapt: * Change `COMPARTMENT_OCID` if you want tenancy‑wide monitoring. * Add/remove event types to cover Internet Gateways, NAT Gateways, DRGs, Local Peering Gateways, etc. * Replace email with Slack/HTTPS, etc., by adjusting the subscription protocol. ```hcl theme={null} # OCI Monitoring alarms cannot be configured to detect configuration changes # (such as create/update/delete of Internet Gateways or DRGs). They only work # on metrics in the Monitoring service. Gateway provisioning changes are # surfaced via the Events and Audit services, not as Monitoring metrics. # To detect unauthorized gateway provisioning you must use: # - oci_events_rule to match Audit events for Internet Gateway and DRG changes # - oci_ons_notification_topic + oci_events_rule_actions or similar for alerting # This cannot be remediated on oci_monitoring_alarm; there is no argument or # metric in the Monitoring service that corresponds to "gateway changed". # Example (for reference only – NOT an oci_monitoring_alarm): # resource "oci_events_rule" "gateway_change_rule" { ... } ``` This finding cannot be fixed on `oci_monitoring_alarm` because OCI Monitoring does not expose gateway-change events as metrics. Use the Events service (in the Console: Developer Services → Events → Create rule, filtering on Audit events for Internet Gateway and Dynamic Routing Gateway create/update/delete) and attach a Notifications topic for alerting.