OCI Monitoring Should Have Identity Provider Change Alarm Configured

Using Console

In OCI this is done with Events + Notifications, not a metric alarm in Monitoring. Here’s how to set up an alert for Identity Provider (IdP) changes using the OCI Console:

1. Verify Audit Is Enabled (usually on by default)

In the Console, open the navigation menu.
Go to Governance & Administration → Audit.
Select the tenancy (root compartment) and confirm that audit is enabled (it is enabled by default and cannot be disabled, just verify logs are present).

2. Create a Notifications Topic

Go to Developer Services → Application Integration → Notifications.
Click Topics → Create Topic.
Enter a name (e.g., idp-change-alerts) and choose the compartment.
Click Create.

Add a Subscription (email or other)

Open the topic you just created.
Click Create Subscription.
Choose Protocol (e.g., Email).
Enter your email address (or other endpoint).
Click Create.
Check your email and confirm the subscription.

3. Create an Event Rule for Identity Provider Changes

Go to Observability & Management → Events Service.
Click Rules → Create Rule.

Rule Details:

Name: IdP-Change-Events
Description: Alert when Identity Provider is created, updated, or deleted
Compartment: choose the root or relevant compartment (IAM events are tenancy-scoped; root is typical).

Condition / Event Pattern:Use a condition that matches Identity service actions on identity providers, e.g.:

Service: identity
Event Type / Action: include:
- CreateIdentityProvider
- UpdateIdentityProvider
- DeleteIdentityProvider

In the console UI:

Under Rule Conditions, choose Event Type (or Service and Event Type, depending on UI version).
Select Service = identity.
Add event types corresponding to IdP management operations (search for IdentityProvider and select create/update/delete variations).

If you see the JSON editor, you can use a pattern like:

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createidentityprovider",
    "com.oraclecloud.identitycontrolplane.updateidentityprovider",
    "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
  ]
}

(Exact event types may be listed in the dropdown; select them from there for accuracy.)

4. Attach the Notifications Action

Still in the Create Rule dialog:

Under Actions, click Add Action.
Action Type: Notifications.
Topic: select the topic you created (idp-change-alerts).
Click Create to save the rule.

5. (Optional) Test the Alert

Make a non-production change to an Identity Provider (e.g., update description) or create a test IdP.
Within a short time, you should receive an email notification (or chosen protocol) with the event details.

With this, any Identity Provider creation, update, or deletion will trigger the Events rule, send to Notifications, and deliver an alert—covering the “Identity Provider change alarm” requirement using OCI’s alerting/monitoring tooling.

Using CLI

Below are the minimal step‑by‑step OCI CLI instructions to set up an alarm (alert) for Identity Provider changes using Events + Notifications (this is how OCI surfaces these types of configuration-change alerts; Monitoring alarms are metric-based).You will:

Create a Notifications topic
Create a subscription (e.g., email)
Add a policy so Events can publish to that topic
Create an Events rule for Identity Provider changes pointing to that topic

0. Prerequisites

OCI CLI configured (oci setup config)
Tenancy OCID and compartment OCID ready
Appropriate IAM permissions to create topics, subscriptions, policies, and events rules

Use placeholders like:

<tenancy-ocid>
<compartment-ocid>
<region-identifier> (e.g., us-ashburn-1)
<email-address>
<topic-name>, <rule-name>

1. Create a Notifications topic

oci ons topic create \
  --name "<topic-name>" \
  --compartment-id "<compartment-ocid>" \
  --description "Alert on Identity Provider changes"

Capture the topic OCID from the output: ocid1.onstopic.oc1... (call it <topic-ocid>).

2. Create a subscription (email example)

oci ons subscription create \
  --topic-id "<topic-ocid>" \
  --compartment-id "<compartment-ocid>" \
  --protocol "EMAIL" \
  --endpoint "<email-address>"

Open the email you get and confirm the subscription.

3. Add IAM policy so Events can publish to the topic

Create a policy in the root compartment (tenancy level) or a compartment that matches where you created the topic.Example policy text (in root compartment):

Allow service events to use ons-topics in compartment <compartment-name>

Using CLI, first create a policy JSON file, e.g. policy.json:

{
  "name": "events-publish-to-ons-topic",
  "description": "Allow Events service to publish to Notifications topics",
  "statements": [
    "Allow service events to use ons-topics in compartment <compartment-name>"
  ],
  "versionDate": "2024-01-01"
}

Then create the policy:

oci iam policy create \
  --compartment-id "<tenancy-ocid>" \
  --name "events-publish-to-ons-topic" \
  --description "Allow Events service to publish to Notifications topics" \
  --statements '["Allow service events to use ons-topics in compartment <compartment-name>"]'

(You can skip the JSON file and use --statements as shown.)

4. Define the Events rule condition for Identity Provider changes

Identity Provider events are in the Identity service. Typical event types:

com.oraclecloud.identitycontrolplane.createidentityprovider
com.oraclecloud.identitycontrolplane.updateidentityprovider
com.oraclecloud.identitycontrolplane.deleteidentityprovider

Create a JSON file idp-change-condition.json like:

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createidentityprovider",
    "com.oraclecloud.identitycontrolplane.updateidentityprovider",
    "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
  ],
  "data": {
    "additionalDetails": {}
  }
}

Or, more general (any Identity Provider event):

{
  "eventType": [
    "com.oraclecloud.identitycontrolplane.createidentityprovider",
    "com.oraclecloud.identitycontrolplane.updateidentityprovider",
    "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
  ]
}

5. Create the Events rule that targets the Notifications topic

oci events rule create \
  --display-name "<rule-name>" \
  --compartment-id "<compartment-ocid>" \
  --is-enabled true \
  --condition "$(cat idp-change-condition.json)" \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "<topic-ocid>"
      }
    ]
  }'

This rule will fire whenever an Identity Provider is created, updated, or deleted in the specified compartment and send a message to your Notifications topic, which then sends email (or other protocol) alerts.

6. (Optional) Verify rule and test

List rules:

oci events rule list --compartment-id "<compartment-ocid>"

Trigger a test (e.g., update an Identity Provider description) and confirm an email is received.

If you specifically need this in a different region/compartment layout or want a different notification channel (Slack, PagerDuty, HTTPS, etc.), indicate which and I can adjust the exact CLI commands.

Using Python

Below is a concise, end‑to‑end way to set up an OCI Monitoring alarm (via Python) that fires whenever an Identity Provider is created, updated, or deleted, using the Audit metrics.

1. Prerequisites

You have:
- oci Python SDK installed:
  pip install oci
- An OCI config file (~/.oci/config) with a profile that can:
  - Read/write Monitoring
  - Read Audit metrics
  - Manage Notifications topics and subscriptions (if you’re sending emails, etc.)
- A Notification Topic OCID (or you can create one via SDK/Console).
Note/collect:
- compartment_id where you want the alarm.
- notification_topic_id (OCID of the Notifications topic).

2. Metric & Query For Identity Provider Changes

Audit events are exposed as metrics in namespace oci_audit. We’ll create an alarm using Monitoring Query Language (MQL):

AuditEvents[1m]{eventName = "CreateIdentityProvider" || 
                eventName = "UpdateIdentityProvider" || 
                eventName = "DeleteIdentityProvider"}.count() > 0

This means: in a 1‑minute window, if any of those events happen, trigger the alarm.

3. Python Code To Create The Alarm

import oci
from oci.monitoring.models import (
    CreateAlarmDetails,
    AlarmSummary
)

# ---- CONFIG ----
PROFILE_NAME = "DEFAULT"  # or your custom profile in ~/.oci/config
COMPARTMENT_ID = "<your_compartment_ocid>"
NOTIFICATION_TOPIC_ID = "<your_notification_topic_ocid>"  # OCI Notifications topic
ALARM_NAME = "Identity Provider Change Alarm"
ALARM_DESC = "Triggers when an Identity Provider is created, updated, or deleted."

# ---- SETUP CLIENT ----
config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
monitoring_client = oci.monitoring.MonitoringClient(config)

# ---- ALARM QUERY ----
# Namespace: oci_audit, MQL query on AuditEvents
QUERY = (
    'AuditEvents[1m]{eventName = "CreateIdentityProvider" || '
    'eventName = "UpdateIdentityProvider" || '
    'eventName = "DeleteIdentityProvider"}.count() > 0'
)

# ---- ALARM DETAILS ----
create_alarm_details = CreateAlarmDetails(
    display_name=ALARM_NAME,
    compartment_id=COMPARTMENT_ID,
    # Metric namespace is implicit in the query itself in MQL
    is_enabled=True,
    # MQL query
    query=QUERY,
    # How often the alarm is evaluated
    resolution="1m",
    # Severity you want: CRITICAL, ERROR, WARNING, INFO
    severity="CRITICAL",
    # OCI Notifications topic
    destinations=[NOTIFICATION_TOPIC_ID],
    # Optional: message text
    message_format="TEXT",
    # Optional: suppress initial trigger if metrics are missing
    is_notifications_per_metric_dimension_enabled=False,
    # Description
    description=ALARM_DESC
)

# ---- CREATE THE ALARM ----
response = monitoring_client.create_alarm(create_alarm_details)
alarm: AlarmSummary = response.data

print("Created alarm:")
print("  OCID:        ", alarm.id)
print("  Display Name:", alarm.display_name)
print("  Query:       ", alarm.query)

4. Optional: Verify / Update The Alarm

List alarms in the compartment:

alarms = monitoring_client.list_alarms(compartment_id=COMPARTMENT_ID).data
for a in alarms:
    print(a.display_name, a.id, a.query)

Update (e.g., enable/disable):

from oci.monitoring.models import UpdateAlarmDetails

update_details = UpdateAlarmDetails(is_enabled=False)
monitoring_client.update_alarm(alarm_id=alarm.id, update_alarm_details=update_details)

5. Test

Perform a test Identity Provider operation (e.g., create a dummy IdP in the console).
Wait for a minute or two.
Confirm:
- Alarm changes to “FIRING” in Monitoring → Alarms.
- Notification is delivered via your configured topic (email, PagerDuty, etc.).

That’s all you need to remediate the “OCI Monitoring Should Have Identity Provider Change Alarm Configured” requirement using Python.

Using Terraform

resource "oci_monitoring_alarm" "identity_provider_change_alarm" {
  # OCI compartment where the alarm itself lives
  compartment_id = OCI_COMPARTMENT_OCID   # e.g. var.compartment_id

  # Compartment whose metrics / audit events are evaluated
  metric_compartment_id = AUDIT_COMPARTMENT_OCID  # often same as tenancy or IAM compartment

  display_name = "Identity Provider Change Alarm"
  is_enabled   = true
  severity     = "CRITICAL"

  # Monitoring namespace that receives audit-derived metrics
  namespace = "oci_audit"

  # Adjust the within clause / threshold as required by your policy
  # This example raises if any matching IdP change event occurs in the last minute
  query = <<-EOT
    AuditEvents[1m].count() > 0
      where (eventType = "CreateIdentityProvider"
         or eventType = "UpdateIdentityProvider"
         or eventType = "DeleteIdentityProvider")
  EOT

  # Notification topic(s) to receive the alarm (ONS topic OCIDs)
  destinations = [
    ONS_TOPIC_OCID, # e.g. oci_ons_notification_topic.security.id
  ]

  # Optional: notification body / details
  body = "Identity Provider configuration has changed in the tenancy. Review immediately."

  # Optional: do not auto-resolve; keep alarm FIRING until cleared by condition change
  is_notifications_per_topic_per_metric_dimension_enabled = true

  # Optional: freeform / defined tags as per your standards
  # freeform_tags = {
  #   "Owner" = "SECURITY_TEAM"
  # }
}

Substitute:

OCI_COMPARTMENT_OCID with the OCID of the compartment where you want the alarm resource.
AUDIT_COMPARTMENT_OCID with the compartment whose audit events should be monitored (often the root/tenancy OCID).
ONS_TOPIC_OCID with the OCID of your notification topic used for security alerts.

This change is in-place for an existing oci_monitoring_alarm (it updates the query and related settings but does not force replacement).After updating Terraform, terraform plan should show:

An update in-place on the existing oci_monitoring_alarm (or create if it did not exist) with the new namespace and query and any updated destinations/body.

OCI Misconfigurations

OCI Monitoring Should Have Identity Provider Change Alarm Configured

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Verify Audit Is Enabled (usually on by default)

2. Create a Notifications Topic

Add a Subscription (email or other)

3. Create an Event Rule for Identity Provider Changes

4. Attach the Notifications Action

5. (Optional) Test the Alert

0. Prerequisites

1. Create a Notifications topic

2. Create a subscription (email example)

3. Add IAM policy so Events can publish to the topic

4. Define the Events rule condition for Identity Provider changes

5. Create the Events rule that targets the Notifications topic

6. (Optional) Verify rule and test

1. Prerequisites

2. Metric & Query For Identity Provider Changes

3. Python Code To Create The Alarm

4. Optional: Verify / Update The Alarm

5. Test

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Verify Audit Is Enabled (usually on by default)

​2. Create a Notifications Topic

​Add a Subscription (email or other)

​3. Create an Event Rule for Identity Provider Changes

​4. Attach the Notifications Action

​5. (Optional) Test the Alert

​0. Prerequisites

​1. Create a Notifications topic

​2. Create a subscription (email example)

​3. Add IAM policy so Events can publish to the topic

​4. Define the Events rule condition for Identity Provider changes

​5. Create the Events rule that targets the Notifications topic

​6. (Optional) Verify rule and test

​1. Prerequisites

​2. Metric & Query For Identity Provider Changes

​3. Python Code To Create The Alarm

​4. Optional: Verify / Update The Alarm

​5. Test

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Verify Audit Is Enabled (usually on by default)

2. Create a Notifications Topic

Add a Subscription (email or other)

3. Create an Event Rule for Identity Provider Changes

4. Attach the Notifications Action

5. (Optional) Test the Alert

0. Prerequisites

1. Create a Notifications topic

2. Create a subscription (email example)

3. Add IAM policy so Events can publish to the topic

4. Define the Events rule condition for Identity Provider changes

5. Create the Events rule that targets the Notifications topic

6. (Optional) Verify rule and test

1. Prerequisites

2. Metric & Query For Identity Provider Changes

3. Python Code To Create The Alarm

4. Optional: Verify / Update The Alarm

5. Test