> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Monitoring Should Have Group Change Alarm Configured ### More Info: Alerts should fire on IamGroupChange. Monitoring group modifications helps prevent privilege escalation via unauthorized additions of users to highly privileged admin groups. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * PCI * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation Below are step‑by‑step console instructions to configure an alarm/alert for IAM Group changes in OCI. The correct way in OCI is to use **Events + Notifications** (this is what most benchmarks refer to when they say “group change alarm”). *** ## 1. Create a Notifications Topic 1. In the OCI Console, open the **Navigation menu**. 2. Go to **Developer Services → Application Integration → Notifications**. 3. Make sure you are in the correct **compartment**. 4. Click **Create Topic**. 5. Give it a name like `iam-group-change-alerts`, add description if needed. 6. Click **Create**. ### Add a Subscription (e.g., Email / Slack / PagerDuty) 1. Open the topic you just created. 2. Under **Subscriptions**, click **Create Subscription**. 3. Choose **Protocol** (e.g., `Email`). 4. Enter the **endpoint** (e.g., your email address). 5. Click **Create**. 6. Confirm the subscription (for email, click the link in the confirmation mail). *** ## 2. Create an Event Rule for IAM Group Changes 1. In the OCI Console, open the **Navigation menu**. 2. Go to **Observability & Management → Events Service → Rules**. 3. Ensure you’re in the right **compartment**. 4. Click **Create Rule**. ### Basic details 1. Name: e.g., `iam-group-change-rule`. 2. Description: “Alert on create/update/delete group and user-group membership changes”. 3. Rule Status: **Enabled**. ### Condition: Match IAM Group Change Events Under **Rule Conditions**, select: 1. **Event Type**: * Click **Event Type**, then select: * `com.oraclecloud.identitycontrolplane.creategroup` * `com.oraclecloud.identitycontrolplane.updategroup` * `com.oraclecloud.identitycontrolplane.deletegroup` * `com.oraclecloud.identitycontrolplane.addusertogroup` * `com.oraclecloud.identitycontrolplane.removeuserfromgroup` If you don’t see them in the picker, choose **Custom** and paste this JSON: ```json theme={null} { "eventType": [ "com.oraclecloud.identitycontrolplane.creategroup", "com.oraclecloud.identitycontrolplane.updategroup", "com.oraclecloud.identitycontrolplane.deletegroup", "com.oraclecloud.identitycontrolplane.addusertogroup", "com.oraclecloud.identitycontrolplane.removeuserfromgroup" ] } ``` *** ## 3. Set the Rule Target to Notifications (Alerting) 1. In the **Actions** / **Rule Target** section: * Choose **Notifications** as the target type. * Select the topic you created earlier, e.g., `iam-group-change-alerts`. 2. Click **Create Rule**. Now, every time an IAM Group is created, updated, deleted, or a user is added/removed from a group, the Event Service will trigger this rule and send an alert via the Notifications topic. *** If you specifically need a **Monitoring → Alarms** object (for a policy requirement), you’d typically: * Export IAM group‑change events to a **custom metric** (via Service Connector from Audit to Monitoring), then * Create a **Monitoring Alarm** on that custom metric. If you want those detailed Monitoring‑Alarm steps as well, say so and I’ll list them. Below is a practical way to satisfy “Monitoring should have group change alarm configured” using the OCI Monitoring service and OCI CLI. It creates an alarm on Audit metrics detecting IAM group changes and notifies via Notifications. Assumptions: * You have OCI CLI installed and configured. * You know your: * `--compartment-id` for IAM and Monitoring * `--tenancy-id` if needed * An email (or other endpoint) to notify. *** ## 1. Create a Notifications Topic ```bash theme={null} oci ons topic create \ --compartment-id \ --name "group-change-alerts-topic" \ --description "Alerts for IAM group changes" ``` Note the `id` from the output (this is the topic OCID): `ocid1.onstopic...` *** ## 2. Create a Subscription (e.g., Email) ```bash theme={null} oci ons subscription create \ --topic-id \ --protocol EMAIL \ --endpoint you@example.com ``` Check your email and confirm the subscription. *** ## 3. Craft the Alarm Metric Query We will use the `oci_audit` metrics to detect IAM group changes (create/update/delete, add/remove user). Example metric query: ```text theme={null} Query: oci_audit, AuditEvents[1m]{eventName IN ("CreateGroup","UpdateGroup","DeleteGroup","AddUserToGroup","RemoveUserFromGroup")}.count() ``` We will alarm when the count > 0 in a short interval. *** ## 4. Create the Alarm via OCI CLI ```bash theme={null} oci monitoring alarm create \ --compartment-id \ --display-name "IAM Group Change Alarm" \ --metric-compartment-id \ --namespace "oci_audit" \ --query-text 'oci_audit, AuditEvents[1m]{eventName IN ("CreateGroup","UpdateGroup","DeleteGroup","AddUserToGroup","RemoveUserFromGroup")}.count()' \ --severity "CRITICAL" \ --destinations '[""]' \ --is-enabled true \ --resolution "1m" \ --pending-duration "0m" \ --message-format "ONS_OPTIMIZED" \ --body "IAM group change detected (create/update/delete or user added/removed from group)." ``` Key points: * `--metric-compartment-id` is typically the root (tenancy) or IAM compartment where Audit metrics are collected (often your root compartment). * `--pending-duration "0m"` sends immediately when a group change occurs. * Adjust `resolution` and event list as needed. *** ## 5. Verify the Alarm List alarms: ```bash theme={null} oci monitoring alarm list \ --compartment-id ``` Show details: ```bash theme={null} oci monitoring alarm get \ --alarm-id ``` Then perform a test IAM group change (e.g., create/delete a group or add/remove user) and confirm you receive the notification. Below is one way to remediate this using OCI Monitoring + Python: **Goal**\ Have an alarm that fires whenever an IAM Group is created/updated/deleted (i.e., “group change”) using OCI Monitoring. *** ## 1. Overall Architecture 1. **Audit logs** already record IAM group changes. 2. **Logging** collects Audit logs into a log group. 3. **Service Connector** turns matching Audit log events (group changes) into a **custom metric**. 4. **Monitoring Alarm** (created via Python) watches that metric and alerts when it’s > 0. Python is used in step 4 (creating the alarm). Steps 1–3 are typically one‑time console/API setup; I’ll outline them briefly first. *** ## 2. Prerequisites * Python 3 and `oci` SDK installed: ```bash theme={null} pip install oci ``` * Valid OCI config at `~/.oci/config` with a profile (e.g., `DEFAULT`), including: * tenancy, user, fingerprint, key\_file, region * OCIDs: * **compartment OCID** where you want the alarm * **notification topic OCID** (from OCI Notifications) for alarm actions *** ## 3. One‑time Setup (Console / API) ### 3.1 Ensure Audit Logs → Logging 1. Go to **Audit** in OCI console (it’s enabled by default). 2. Go to **Logging → Log Groups**, create a log group in a security/ops compartment. 3. Inside that log group, **Enable an Audit log** (or confirm one exists). ### 3.2 Service Connector: Audit → Custom Metric The idea: filter Audit logs for IAM group changes, transform them into a metric such as: * **Namespace:** `security_iam` * **Metric Name:** `group_change_count` * **Dimensions:** e.g. `eventName`, `compartmentId` Using console: 1. Go to **Service Connector Hub → Create service connector**. 2. Source: **Logging** (select your Audit log). 3. Condition / Filter (examples, varies by region/console version): * Filter on `data.eventType` IN: * `com.oraclecloud.identitycontrolplane.creategroup` * `com.oraclecloud.identitycontrolplane.updategroup` * `com.oraclecloud.identitycontrolplane.deletegroup` 4. Target: **Monitoring**. 5. In the metric mapping, specify: * Namespace: `security_iam` * Metric: `group_change_count` * Value: `1` * Dimensions: e.g. `{"eventName": data.eventType}` 6. Save/enable service connector. After a group change, you should see data points for `security_iam.group_change_count` in **Monitoring → Metrics**. *** ## 4. Create the Group Change Alarm with Python This script creates an alarm that fires when any group change metric datapoint is > 0 in the last 5 minutes. ### 4.1 Metric Query Example Alarm query syntax (Monitoring “MQL” style): ```text theme={null} security_iam.group_change_count[5m].sum() > 0 ``` You can add dimensions if you wish, e.g.: ```text theme={null} security_iam.group_change_count[5m]{eventName = "*group*"}.sum() > 0 ``` *** ### 4.2 Python Code ```python theme={null} import oci from datetime import datetime # Adjust these PROFILE = "DEFAULT" # profile in ~/.oci/config COMPARTMENT_OCID = "ocid1.compartment.oc1..xxxxxxxxxxxxxxxx" TOPIC_OCID = "ocid1.onstopic.oc1..xxxxxxxxxxxxxxxx" ALARM_DISPLAY_NAME = "IAM Group Change Alarm" ALARM_BODY = "Alarm: IAM group has been created/updated/deleted in the last 5 minutes." def main(): # Load config config = oci.config.from_file("~/.oci/config", PROFILE) monitoring_client = oci.monitoring.MonitoringClient(config) alarms_client = oci.monitoring.AlarmsClient(config) # Alarm query for custom metric from Service Connector alarm_query = "security_iam.group_change_count[5m].sum() > 0" # Construct the alarm details create_alarm_details = oci.monitoring.models.CreateAlarmDetails( display_name=ALARM_DISPLAY_NAME, compartment_id=COMPARTMENT_OCID, metric_compartment_id=COMPARTMENT_OCID, # compartment where metric lives metric_compartment_id_in_subtree=True, # if metrics might be in subcompartments namespace="security_iam", query=alarm_query, severity="CRITICAL", destinations=[TOPIC_OCID], # Notifications topic is_enabled=True, repeat_notification_duration="PT15M", # re-notify every 15 minutes message_format="PRETTY_JSON", body=ALARM_BODY, pending_duration="PT0M", # fire as soon as condition met resolution="5m" # evaluate every 5 minutes ) # Create the alarm response = alarms_client.create_alarm(create_alarm_details) alarm = response.data print("Created alarm:") print(f" OCID: {alarm.id}") print(f" Name: {alarm.display_name}") print(f" Query: {alarm.query}") if __name__ == "__main__": main() ``` *** ## 5. Validate 1. Make a **test group change** (create or delete a group). 2. Wait a few minutes: * Check **Monitoring → Metrics**, select: * Namespace: `security_iam` * Metric: `group_change_count` * Confirm datapoints appear. 3. Check **Monitoring → Alarms**: * The alarm should move to **FIRING** for that interval. 4. Confirm **Notifications** (email, Slack, etc.) are received from the topic. *** If you share your existing metric namespace/name (if you already have a Service Connector or custom metric), I can adjust the exact Python query and alarm parameters to match your environment. ```hcl theme={null} # OCI Monitoring alarms cannot be configured on IAM group-change events. # OCI does not expose an IamGroupChange metric/namespace to oci_monitoring_alarm, # so this specific finding cannot be remediated on the oci_monitoring_alarm resource. # You must instead use an OCI Events rule (OCI Console: Developer Services → Events) # listening on the "IamGroupChange" event type and route it to your notification topic. ``` This specific control cannot be implemented via `oci_monitoring_alarm` in Terraform because Monitoring only supports metric-based alarms; IAM group changes are event-based. Use an OCI Events rule (Terraform `oci_events_rule`) targeting your notification channel, or configure it directly in the Console. Running `terraform plan` against `oci_monitoring_alarm` will not show any valid arguments related to `IamGroupChange`.