OCI Monitoring Should Have Group Change Alarm Configured

Using Console

Below are step‑by‑step console instructions to configure an alarm/alert for IAM Group changes in OCI. The correct way in OCI is to use Events + Notifications (this is what most benchmarks refer to when they say “group change alarm”).

1. Create a Notifications Topic

In the OCI Console, open the Navigation menu.
Go to Developer Services → Application Integration → Notifications.
Make sure you are in the correct compartment.
Click Create Topic.
Give it a name like iam-group-change-alerts, add description if needed.
Click Create.

Add a Subscription (e.g., Email / Slack / PagerDuty)

Open the topic you just created.
Under Subscriptions, click Create Subscription.
Choose Protocol (e.g., Email).
Enter the endpoint (e.g., your email address).
Click Create.
Confirm the subscription (for email, click the link in the confirmation mail).

2. Create an Event Rule for IAM Group Changes

In the OCI Console, open the Navigation menu.
Go to Observability & Management → Events Service → Rules.
Ensure you’re in the right compartment.
Click Create Rule.

Basic details

Name: e.g., iam-group-change-rule.
Description: “Alert on create/update/delete group and user-group membership changes”.
Rule Status: Enabled.

Condition: Match IAM Group Change Events

Under Rule Conditions, select:

Event Type:
- Click Event Type, then select:
  - com.oraclecloud.identitycontrolplane.creategroup
  - com.oraclecloud.identitycontrolplane.updategroup
  - com.oraclecloud.identitycontrolplane.deletegroup
  - com.oraclecloud.identitycontrolplane.addusertogroup
  - com.oraclecloud.identitycontrolplane.removeuserfromgroup
If you don’t see them in the picker, choose Custom and paste this JSON:
{ "eventType": [ "com.oraclecloud.identitycontrolplane.creategroup", "com.oraclecloud.identitycontrolplane.updategroup", "com.oraclecloud.identitycontrolplane.deletegroup", "com.oraclecloud.identitycontrolplane.addusertogroup", "com.oraclecloud.identitycontrolplane.removeuserfromgroup" ] }

3. Set the Rule Target to Notifications (Alerting)

In the Actions / Rule Target section:
- Choose Notifications as the target type.
- Select the topic you created earlier, e.g., iam-group-change-alerts.
Click Create Rule.

Now, every time an IAM Group is created, updated, deleted, or a user is added/removed from a group, the Event Service will trigger this rule and send an alert via the Notifications topic.

If you specifically need a Monitoring → Alarms object (for a policy requirement), you’d typically:

Export IAM group‑change events to a custom metric (via Service Connector from Audit to Monitoring), then
Create a Monitoring Alarm on that custom metric.

If you want those detailed Monitoring‑Alarm steps as well, say so and I’ll list them.

Using CLI

Below is a practical way to satisfy “Monitoring should have group change alarm configured” using the OCI Monitoring service and OCI CLI. It creates an alarm on Audit metrics detecting IAM group changes and notifies via Notifications.Assumptions:

You have OCI CLI installed and configured.
You know your:
- --compartment-id for IAM and Monitoring
- --tenancy-id if needed
- An email (or other endpoint) to notify.

1. Create a Notifications Topic

oci ons topic create \
  --compartment-id <COMPARTMENT_OCID> \
  --name "group-change-alerts-topic" \
  --description "Alerts for IAM group changes"

Note the id from the output (this is the topic OCID): ocid1.onstopic...

2. Create a Subscription (e.g., Email)

oci ons subscription create \
  --topic-id <TOPIC_OCID> \
  --protocol EMAIL \
  --endpoint you@example.com

Check your email and confirm the subscription.

3. Craft the Alarm Metric Query

We will use the oci_audit metrics to detect IAM group changes (create/update/delete, add/remove user). Example metric query:

Query:
  oci_audit, AuditEvents[1m]{eventName IN ("CreateGroup","UpdateGroup","DeleteGroup","AddUserToGroup","RemoveUserFromGroup")}.count()

We will alarm when the count > 0 in a short interval.

4. Create the Alarm via OCI CLI

oci monitoring alarm create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name "IAM Group Change Alarm" \
  --metric-compartment-id <COMPARTMENT_OCID> \
  --namespace "oci_audit" \
  --query-text 'oci_audit, AuditEvents[1m]{eventName IN ("CreateGroup","UpdateGroup","DeleteGroup","AddUserToGroup","RemoveUserFromGroup")}.count()' \
  --severity "CRITICAL" \
  --destinations '["<TOPIC_OCID>"]' \
  --is-enabled true \
  --resolution "1m" \
  --pending-duration "0m" \
  --message-format "ONS_OPTIMIZED" \
  --body "IAM group change detected (create/update/delete or user added/removed from group)."

Key points:

--metric-compartment-id is typically the root (tenancy) or IAM compartment where Audit metrics are collected (often your root compartment).
--pending-duration "0m" sends immediately when a group change occurs.
Adjust resolution and event list as needed.

5. Verify the Alarm

List alarms:

oci monitoring alarm list \
  --compartment-id <COMPARTMENT_OCID>

Show details:

oci monitoring alarm get \
  --alarm-id <ALARM_OCID>

Then perform a test IAM group change (e.g., create/delete a group or add/remove user) and confirm you receive the notification.

Using Python

Below is one way to remediate this using OCI Monitoring + Python:Goal
Have an alarm that fires whenever an IAM Group is created/updated/deleted (i.e., “group change”) using OCI Monitoring.

1. Overall Architecture

Audit logs already record IAM group changes.
Logging collects Audit logs into a log group.
Service Connector turns matching Audit log events (group changes) into a custom metric.
Monitoring Alarm (created via Python) watches that metric and alerts when it’s > 0.

Python is used in step 4 (creating the alarm). Steps 1–3 are typically one‑time console/API setup; I’ll outline them briefly first.

2. Prerequisites

Python 3 and oci SDK installed:

pip install oci

Valid OCI config at ~/.oci/config with a profile (e.g., DEFAULT), including:
- tenancy, user, fingerprint, key_file, region
OCIDs:
- compartment OCID where you want the alarm
- notification topic OCID (from OCI Notifications) for alarm actions

3. One‑time Setup (Console / API)

3.1 Ensure Audit Logs → Logging

Go to Audit in OCI console (it’s enabled by default).
Go to Logging → Log Groups, create a log group in a security/ops compartment.
Inside that log group, Enable an Audit log (or confirm one exists).

3.2 Service Connector: Audit → Custom Metric

The idea: filter Audit logs for IAM group changes, transform them into a metric such as:

Namespace: security_iam
Metric Name: group_change_count
Dimensions: e.g. eventName, compartmentId

Using console:

Go to Service Connector Hub → Create service connector.
Source: Logging (select your Audit log).
Condition / Filter (examples, varies by region/console version):
- Filter on data.eventType IN:
  - com.oraclecloud.identitycontrolplane.creategroup
  - com.oraclecloud.identitycontrolplane.updategroup
  - com.oraclecloud.identitycontrolplane.deletegroup
Target: Monitoring.
In the metric mapping, specify:
- Namespace: security_iam
- Metric: group_change_count
- Value: 1
- Dimensions: e.g. {"eventName": data.eventType}
Save/enable service connector.

After a group change, you should see data points for security_iam.group_change_count in Monitoring → Metrics.

4. Create the Group Change Alarm with Python

This script creates an alarm that fires when any group change metric datapoint is > 0 in the last 5 minutes.

4.1 Metric Query Example

Alarm query syntax (Monitoring “MQL” style):

security_iam.group_change_count[5m].sum() > 0

You can add dimensions if you wish, e.g.:

security_iam.group_change_count[5m]{eventName = "*group*"}.sum() > 0

4.2 Python Code

import oci
from datetime import datetime

# Adjust these
PROFILE = "DEFAULT"  # profile in ~/.oci/config
COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxxxxxxxxxxxxx"
TOPIC_OCID = "ocid1.onstopic.oc1..xxxxxxxxxxxxxxxx"
ALARM_DISPLAY_NAME = "IAM Group Change Alarm"
ALARM_BODY = "Alarm: IAM group has been created/updated/deleted in the last 5 minutes."

def main():
    # Load config
    config = oci.config.from_file("~/.oci/config", PROFILE)

    monitoring_client = oci.monitoring.MonitoringClient(config)
    alarms_client = oci.monitoring.AlarmsClient(config)

    # Alarm query for custom metric from Service Connector
    alarm_query = "security_iam.group_change_count[5m].sum() > 0"

    # Construct the alarm details
    create_alarm_details = oci.monitoring.models.CreateAlarmDetails(
        display_name=ALARM_DISPLAY_NAME,
        compartment_id=COMPARTMENT_OCID,
        metric_compartment_id=COMPARTMENT_OCID,  # compartment where metric lives
        metric_compartment_id_in_subtree=True,   # if metrics might be in subcompartments
        namespace="security_iam",
        query=alarm_query,
        severity="CRITICAL",
        destinations=[TOPIC_OCID],              # Notifications topic
        is_enabled=True,
        repeat_notification_duration="PT15M",    # re-notify every 15 minutes
        message_format="PRETTY_JSON",
        body=ALARM_BODY,
        pending_duration="PT0M",                # fire as soon as condition met
        resolution="5m"                          # evaluate every 5 minutes
    )

    # Create the alarm
    response = alarms_client.create_alarm(create_alarm_details)
    alarm = response.data

    print("Created alarm:")
    print(f"  OCID: {alarm.id}")
    print(f"  Name: {alarm.display_name}")
    print(f"  Query: {alarm.query}")

if __name__ == "__main__":
    main()

5. Validate

Make a test group change (create or delete a group).
Wait a few minutes:
- Check Monitoring → Metrics, select:
  - Namespace: security_iam
  - Metric: group_change_count
- Confirm datapoints appear.
Check Monitoring → Alarms:
- The alarm should move to FIRING for that interval.
Confirm Notifications (email, Slack, etc.) are received from the topic.

If you share your existing metric namespace/name (if you already have a Service Connector or custom metric), I can adjust the exact Python query and alarm parameters to match your environment.

Using Terraform

# OCI Monitoring alarms cannot be configured on IAM group-change events.
# OCI does not expose an IamGroupChange metric/namespace to oci_monitoring_alarm,
# so this specific finding cannot be remediated on the oci_monitoring_alarm resource.

# You must instead use an OCI Events rule (OCI Console: Developer Services → Events)
# listening on the "IamGroupChange" event type and route it to your notification topic.

This specific control cannot be implemented via oci_monitoring_alarm in Terraform because Monitoring only supports metric-based alarms; IAM group changes are event-based. Use an OCI Events rule (Terraform oci_events_rule) targeting your notification channel, or configure it directly in the Console. Running terraform plan against oci_monitoring_alarm will not show any valid arguments related to IamGroupChange.

OCI Misconfigurations

OCI Monitoring Should Have Group Change Alarm Configured

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create a Notifications Topic

Add a Subscription (e.g., Email / Slack / PagerDuty)

2. Create an Event Rule for IAM Group Changes

Basic details

Condition: Match IAM Group Change Events

3. Set the Rule Target to Notifications (Alerting)

1. Create a Notifications Topic

2. Create a Subscription (e.g., Email)

3. Craft the Alarm Metric Query

4. Create the Alarm via OCI CLI

5. Verify the Alarm

1. Overall Architecture

2. Prerequisites

3. One‑time Setup (Console / API)

3.1 Ensure Audit Logs → Logging

3.2 Service Connector: Audit → Custom Metric

4. Create the Group Change Alarm with Python

4.1 Metric Query Example

4.2 Python Code

5. Validate

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Create a Notifications Topic

​Add a Subscription (e.g., Email / Slack / PagerDuty)

​2. Create an Event Rule for IAM Group Changes

​Basic details

​Condition: Match IAM Group Change Events

​3. Set the Rule Target to Notifications (Alerting)

​1. Create a Notifications Topic

​2. Create a Subscription (e.g., Email)

​3. Craft the Alarm Metric Query

​4. Create the Alarm via OCI CLI

​5. Verify the Alarm

​1. Overall Architecture

​2. Prerequisites

​3. One‑time Setup (Console / API)

​3.1 Ensure Audit Logs → Logging

​3.2 Service Connector: Audit → Custom Metric

​4. Create the Group Change Alarm with Python

​4.1 Metric Query Example

​4.2 Python Code

​5. Validate

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Create a Notifications Topic

Add a Subscription (e.g., Email / Slack / PagerDuty)

2. Create an Event Rule for IAM Group Changes

Basic details

Condition: Match IAM Group Change Events

3. Set the Rule Target to Notifications (Alerting)

1. Create a Notifications Topic

2. Create a Subscription (e.g., Email)

3. Craft the Alarm Metric Query

4. Create the Alarm via OCI CLI

5. Verify the Alarm

1. Overall Architecture

2. Prerequisites

3. One‑time Setup (Console / API)

3.1 Ensure Audit Logs → Logging

3.2 Service Connector: Audit → Custom Metric

4. Create the Group Change Alarm with Python

4.1 Metric Query Example

4.2 Python Code

5. Validate