> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI Monitoring Should Have Identity Provider Change Alarm Configured

### More Info:

Identity Provider (IdP) modifications must be strictly monitored. Attackers may attempt to add rogue identity providers to create backdoor access into the OCI tenancy.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* AWS Well Architected Framework
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        In OCI this is done with **Events + Notifications**, not a metric alarm in Monitoring. Here’s how to set up an alert for Identity Provider (IdP) changes using the OCI Console:

        ***

        ### 1. Verify Audit Is Enabled (usually on by default)

        1. In the Console, open the navigation menu.
        2. Go to **Governance & Administration → Audit**.
        3. Select the **tenancy (root compartment)** and confirm that audit is enabled (it is enabled by default and cannot be disabled, just verify logs are present).

        ***

        ### 2. Create a Notifications Topic

        1. Go to **Developer Services → Application Integration → Notifications**.
        2. Click **Topics → Create Topic**.
        3. Enter a **name** (e.g., `idp-change-alerts`) and choose the **compartment**.
        4. Click **Create**.

        #### Add a Subscription (email or other)

        1. Open the topic you just created.
        2. Click **Create Subscription**.
        3. Choose **Protocol** (e.g., `Email`).
        4. Enter your **email address** (or other endpoint).
        5. Click **Create**.
        6. Check your email and **confirm the subscription**.

        ***

        ### 3. Create an Event Rule for Identity Provider Changes

        1. Go to **Observability & Management → Events Service**.
        2. Click **Rules → Create Rule**.

        **Rule Details:**

        * Name: `IdP-Change-Events`
        * Description: `Alert when Identity Provider is created, updated, or deleted`
        * Compartment: choose the **root or relevant compartment** (IAM events are tenancy-scoped; root is typical).

        **Condition / Event Pattern:**

        Use a condition that matches Identity service actions on identity providers, e.g.:

        * **Service**: `identity`
        * **Event Type / Action**: include:
          * `CreateIdentityProvider`
          * `UpdateIdentityProvider`
          * `DeleteIdentityProvider`

        In the console UI:

        1. Under **Rule Conditions**, choose **Event Type** (or **Service and Event Type**, depending on UI version).
        2. Select **Service** = `identity`.
        3. Add **event types** corresponding to IdP management operations (search for `IdentityProvider` and select create/update/delete variations).

        If you see the JSON editor, you can use a pattern like:

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createidentityprovider",
            "com.oraclecloud.identitycontrolplane.updateidentityprovider",
            "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
          ]
        }
        ```

        (Exact event types may be listed in the dropdown; select them from there for accuracy.)

        ***

        ### 4. Attach the Notifications Action

        Still in the **Create Rule** dialog:

        1. Under **Actions**, click **Add Action**.
        2. **Action Type**: `Notifications`.
        3. **Topic**: select the topic you created (`idp-change-alerts`).
        4. Click **Create** to save the rule.

        ***

        ### 5. (Optional) Test the Alert

        1. Make a **non-production** change to an Identity Provider (e.g., update description) or create a test IdP.
        2. Within a short time, you should receive an **email notification** (or chosen protocol) with the event details.

        ***

        With this, any **Identity Provider creation, update, or deletion** will trigger the Events rule, send to Notifications, and deliver an alert—covering the “Identity Provider change alarm” requirement using OCI’s alerting/monitoring tooling.
      </Accordion>

      <Accordion title="Using CLI">
        Below are the minimal step‑by‑step OCI CLI instructions to set up an alarm (alert) for Identity Provider changes using Events + Notifications (this is how OCI surfaces these types of configuration-change alerts; Monitoring alarms are metric-based).

        You will:

        1. Create a Notifications topic
        2. Create a subscription (e.g., email)
        3. Add a policy so Events can publish to that topic
        4. Create an Events rule for Identity Provider changes pointing to that topic

        ***

        ### 0. Prerequisites

        * OCI CLI configured (`oci setup config`)
        * Tenancy OCID and compartment OCID ready
        * Appropriate IAM permissions to create topics, subscriptions, policies, and events rules

        Use placeholders like:

        * `<tenancy-ocid>`
        * `<compartment-ocid>`
        * `<region-identifier>` (e.g., `us-ashburn-1`)
        * `<email-address>`
        * `<topic-name>`, `<rule-name>`

        ***

        ### 1. Create a Notifications topic

        ```bash theme={null}
        oci ons topic create \
          --name "<topic-name>" \
          --compartment-id "<compartment-ocid>" \
          --description "Alert on Identity Provider changes"
        ```

        Capture the topic OCID from the output: `ocid1.onstopic.oc1...` (call it `<topic-ocid>`).

        ***

        ### 2. Create a subscription (email example)

        ```bash theme={null}
        oci ons subscription create \
          --topic-id "<topic-ocid>" \
          --compartment-id "<compartment-ocid>" \
          --protocol "EMAIL" \
          --endpoint "<email-address>"
        ```

        Open the email you get and confirm the subscription.

        ***

        ### 3. Add IAM policy so Events can publish to the topic

        Create a policy in the *root compartment* (tenancy level) or a compartment that matches where you created the topic.

        Example policy text (in root compartment):

        ```text theme={null}
        Allow service events to use ons-topics in compartment <compartment-name>
        ```

        Using CLI, first create a policy JSON file, e.g. `policy.json`:

        ```json theme={null}
        {
          "name": "events-publish-to-ons-topic",
          "description": "Allow Events service to publish to Notifications topics",
          "statements": [
            "Allow service events to use ons-topics in compartment <compartment-name>"
          ],
          "versionDate": "2024-01-01"
        }
        ```

        Then create the policy:

        ```bash theme={null}
        oci iam policy create \
          --compartment-id "<tenancy-ocid>" \
          --name "events-publish-to-ons-topic" \
          --description "Allow Events service to publish to Notifications topics" \
          --statements '["Allow service events to use ons-topics in compartment <compartment-name>"]'
        ```

        (You can skip the JSON file and use `--statements` as shown.)

        ***

        ### 4. Define the Events rule condition for Identity Provider changes

        Identity Provider events are in the Identity service. Typical event types:

        * `com.oraclecloud.identitycontrolplane.createidentityprovider`
        * `com.oraclecloud.identitycontrolplane.updateidentityprovider`
        * `com.oraclecloud.identitycontrolplane.deleteidentityprovider`

        Create a JSON file `idp-change-condition.json` like:

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createidentityprovider",
            "com.oraclecloud.identitycontrolplane.updateidentityprovider",
            "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
          ],
          "data": {
            "additionalDetails": {}
          }
        }
        ```

        Or, more general (any Identity Provider event):

        ```json theme={null}
        {
          "eventType": [
            "com.oraclecloud.identitycontrolplane.createidentityprovider",
            "com.oraclecloud.identitycontrolplane.updateidentityprovider",
            "com.oraclecloud.identitycontrolplane.deleteidentityprovider"
          ]
        }
        ```

        ***

        ### 5. Create the Events rule that targets the Notifications topic

        ```bash theme={null}
        oci events rule create \
          --display-name "<rule-name>" \
          --compartment-id "<compartment-ocid>" \
          --is-enabled true \
          --condition "$(cat idp-change-condition.json)" \
          --actions '{
            "actions": [
              {
                "actionType": "ONS",
                "isEnabled": true,
                "topicId": "<topic-ocid>"
              }
            ]
          }'
        ```

        This rule will fire whenever an Identity Provider is created, updated, or deleted in the specified compartment and send a message to your Notifications topic, which then sends email (or other protocol) alerts.

        ***

        ### 6. (Optional) Verify rule and test

        * List rules:

        ```bash theme={null}
        oci events rule list --compartment-id "<compartment-ocid>"
        ```

        * Trigger a test (e.g., update an Identity Provider description) and confirm an email is received.

        ***

        If you specifically need this in a different region/compartment layout or want a different notification channel (Slack, PagerDuty, HTTPS, etc.), indicate which and I can adjust the exact CLI commands.
      </Accordion>

      <Accordion title="Using Python">
        Below is a concise, end‑to‑end way to set up an OCI Monitoring alarm (via Python) that fires whenever an Identity Provider is created, updated, or deleted, using the Audit metrics.

        ***

        ### 1. Prerequisites

        1. You have:
           * `oci` Python SDK installed:
             ```bash theme={null}
             pip install oci
             ```
           * An OCI config file (`~/.oci/config`) with a profile that can:
             * Read/write Monitoring
             * Read Audit metrics
             * Manage Notifications topics and subscriptions (if you’re sending emails, etc.)
           * A Notification Topic OCID (or you can create one via SDK/Console).

        2. Note/collect:
           * `compartment_id` where you want the alarm.
           * `notification_topic_id` (OCID of the Notifications topic).

        ***

        ### 2. Metric & Query For Identity Provider Changes

        Audit events are exposed as metrics in namespace `oci_audit`. We’ll create an alarm using Monitoring Query Language (MQL):

        ```text theme={null}
        AuditEvents[1m]{eventName = "CreateIdentityProvider" || 
                        eventName = "UpdateIdentityProvider" || 
                        eventName = "DeleteIdentityProvider"}.count() > 0
        ```

        * This means: in a 1‑minute window, if any of those events happen, trigger the alarm.

        ***

        ### 3. Python Code To Create The Alarm

        ```python theme={null}
        import oci
        from oci.monitoring.models import (
            CreateAlarmDetails,
            AlarmSummary
        )

        # ---- CONFIG ----
        PROFILE_NAME = "DEFAULT"  # or your custom profile in ~/.oci/config
        COMPARTMENT_ID = "<your_compartment_ocid>"
        NOTIFICATION_TOPIC_ID = "<your_notification_topic_ocid>"  # OCI Notifications topic
        ALARM_NAME = "Identity Provider Change Alarm"
        ALARM_DESC = "Triggers when an Identity Provider is created, updated, or deleted."

        # ---- SETUP CLIENT ----
        config = oci.config.from_file("~/.oci/config", PROFILE_NAME)
        monitoring_client = oci.monitoring.MonitoringClient(config)

        # ---- ALARM QUERY ----
        # Namespace: oci_audit, MQL query on AuditEvents
        QUERY = (
            'AuditEvents[1m]{eventName = "CreateIdentityProvider" || '
            'eventName = "UpdateIdentityProvider" || '
            'eventName = "DeleteIdentityProvider"}.count() > 0'
        )

        # ---- ALARM DETAILS ----
        create_alarm_details = CreateAlarmDetails(
            display_name=ALARM_NAME,
            compartment_id=COMPARTMENT_ID,
            # Metric namespace is implicit in the query itself in MQL
            is_enabled=True,
            # MQL query
            query=QUERY,
            # How often the alarm is evaluated
            resolution="1m",
            # Severity you want: CRITICAL, ERROR, WARNING, INFO
            severity="CRITICAL",
            # OCI Notifications topic
            destinations=[NOTIFICATION_TOPIC_ID],
            # Optional: message text
            message_format="TEXT",
            # Optional: suppress initial trigger if metrics are missing
            is_notifications_per_metric_dimension_enabled=False,
            # Description
            description=ALARM_DESC
        )

        # ---- CREATE THE ALARM ----
        response = monitoring_client.create_alarm(create_alarm_details)
        alarm: AlarmSummary = response.data

        print("Created alarm:")
        print("  OCID:        ", alarm.id)
        print("  Display Name:", alarm.display_name)
        print("  Query:       ", alarm.query)
        ```

        ***

        ### 4. Optional: Verify / Update The Alarm

        List alarms in the compartment:

        ```python theme={null}
        alarms = monitoring_client.list_alarms(compartment_id=COMPARTMENT_ID).data
        for a in alarms:
            print(a.display_name, a.id, a.query)
        ```

        Update (e.g., enable/disable):

        ```python theme={null}
        from oci.monitoring.models import UpdateAlarmDetails

        update_details = UpdateAlarmDetails(is_enabled=False)
        monitoring_client.update_alarm(alarm_id=alarm.id, update_alarm_details=update_details)
        ```

        ***

        ### 5. Test

        1. Perform a test Identity Provider operation (e.g., create a dummy IdP in the console).
        2. Wait for a minute or two.
        3. Confirm:
           * Alarm changes to “FIRING” in Monitoring → Alarms.
           * Notification is delivered via your configured topic (email, PagerDuty, etc.).

        That’s all you need to remediate the “OCI Monitoring Should Have Identity Provider Change Alarm Configured” requirement using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_monitoring_alarm" "identity_provider_change_alarm" {
          # OCI compartment where the alarm itself lives
          compartment_id = OCI_COMPARTMENT_OCID   # e.g. var.compartment_id

          # Compartment whose metrics / audit events are evaluated
          metric_compartment_id = AUDIT_COMPARTMENT_OCID  # often same as tenancy or IAM compartment

          display_name = "Identity Provider Change Alarm"
          is_enabled   = true
          severity     = "CRITICAL"

          # Monitoring namespace that receives audit-derived metrics
          namespace = "oci_audit"

          # Adjust the within clause / threshold as required by your policy
          # This example raises if any matching IdP change event occurs in the last minute
          query = <<-EOT
            AuditEvents[1m].count() > 0
              where (eventType = "CreateIdentityProvider"
                 or eventType = "UpdateIdentityProvider"
                 or eventType = "DeleteIdentityProvider")
          EOT

          # Notification topic(s) to receive the alarm (ONS topic OCIDs)
          destinations = [
            ONS_TOPIC_OCID, # e.g. oci_ons_notification_topic.security.id
          ]

          # Optional: notification body / details
          body = "Identity Provider configuration has changed in the tenancy. Review immediately."

          # Optional: do not auto-resolve; keep alarm FIRING until cleared by condition change
          is_notifications_per_topic_per_metric_dimension_enabled = true

          # Optional: freeform / defined tags as per your standards
          # freeform_tags = {
          #   "Owner" = "SECURITY_TEAM"
          # }
        }
        ```

        Substitute:

        * `OCI_COMPARTMENT_OCID` with the OCID of the compartment where you want the alarm resource.
        * `AUDIT_COMPARTMENT_OCID` with the compartment whose audit events should be monitored (often the root/tenancy OCID).
        * `ONS_TOPIC_OCID` with the OCID of your notification topic used for security alerts.

        This change is in-place for an existing `oci_monitoring_alarm` (it updates the query and related settings but does not force replacement).

        After updating Terraform, `terraform plan` should show:

        * An `update in-place` on the existing `oci_monitoring_alarm` (or `create` if it did not exist) with the new `namespace` and `query` and any updated destinations/body.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>