> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # OCI Monitoring Should Have Route Table Change Alarm Configured ### More Info: RouteTableChange events must be monitored. Unauthorized route table edits can redirect sensitive internal traffic to malicious external endpoints or expose private subnets. ### Risk Level Medium ### Address Compliance, Security ### Compliance Standards * APRA CPS 234 (Australia) * AWS Well Architected Framework * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS AWS * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * HIPAA * HITRUST CSF * ISO 27001 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST * NIST CSF * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SOC2 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation In OCI you don’t get a native “metric” for route table changes; instead you use **Events + Notifications** (and optionally Monitoring only if you build custom metrics). For a standard console-based setup, do this: *** ## 1. Prepare a Notifications Topic 1. Sign in to OCI Console. 2. From the left hamburger menu, go to **Developer Services → Application Integration → Notifications**. 3. Make sure you are in the correct **compartment** (top-left compartment selector). 4. Click **Create Topic**. * Name: e.g., `route-table-change-alerts` * Description: e.g., `Alerts for route table and route rule changes` * Compartment: choose the desired compartment. 5. Click **Create**. ### Add at least one subscription (email, Slack, etc.) 6. Open the topic you just created. 7. Click **Create Subscription**. * Protocol: e.g., **Email**. * Email: enter your email address. 8. Click **Create**. 9. Go to your email inbox and **confirm** the subscription. *** ## 2. Create an Event Rule for Route Table Changes OCI emits **Events** for VCN and route table changes; you’ll create a rule to catch them. 1. From the left menu, go to **Observability & Management → Events Service**. 2. Click **Rules** in the left pane. 3. Make sure you are in the **same region and compartment** where you want to manage VCNs/route tables. 4. Click **Create Rule**. ### Define the rule 5. Name: e.g., `DetectRouteTableChanges`. 6. Description: e.g., `Trigger notifications on route table and route rule changes`. 7. Rule Status: leave as **Enabled**. 8. Under **Rule Conditions**, choose: * **Event Type**: click **Browse**, then: * Service: **Virtual Cloud Network (VCN)**. * Under “Event Types”, select all that are relevant, for example (names may vary slightly by region/tenancy): * `CreateRouteTable` * `UpdateRouteTable` * `DeleteRouteTable` * `CreateRouteRule` * `UpdateRouteRule` * `DeleteRouteRule` * Optionally, narrow by **Compartment** if you only want alerts for specific compartments. > If the UI shows a single grouped type like “Route Table – Update” or similar, select all route-table-related event types visible. ### Choose action: send notification 9. In **Actions**, click **Add Action**. 10. Action Type: **Notifications**. 11. Topic: choose the topic you created earlier, e.g., `route-table-change-alerts`. 12. Click **Create** (or **Create Rule**). Now any create/update/delete of a route table or its rules that matches the rule conditions will generate a notification. *** ## 3. (Optional) Refine Scope with Event Filters If needed, you can restrict alerts further: 1. Edit the rule (open the rule → **Edit**). 2. Under **Rule Conditions**, you can: * Constrain to specific route tables by **compartment**. * Add an **advanced filter** (JSON) using attributes like `data.resourceName`, `data.compartmentId`, or `data.additionalDetails` if you want very fine-grained control (e.g., only a particular route table). Example (conceptual) advanced filter JSON snippet: ```json theme={null} { "eventType": [ "com.oraclecloud.virtualnetwork.updateroutetable" ], "data": { "resourceName": [ "my-critical-route-table" ] } } ``` (Use the console’s helper to ensure the exact attribute names for your tenancy; they can be inspected from a sample event.) *** ## 4. (Optional) Tie into Monitoring Alarms via Custom Metrics If your policy explicitly requires a **Monitoring → Alarms** object, you can: 1. Use **Service Connector Hub**: * Source: **Logging** (Audit or VCN logs). * Task: **Logging Analytics or custom metrics**. * Target: **Monitoring** (create a custom metric when an event indicating route table change appears). 2. Then in **Observability & Management → Monitoring → Alarms**, create an alarm on that custom metric (e.g., trigger when metric value ≥ 1 in last 5 minutes). This is more complex and typically unnecessary unless your organization mandates using Monitoring alarms specifically. *** ## 5. Validate 1. Make a small change to a non-critical route table (e.g., add a dummy route, then remove it). 2. Confirm: * The event rule shows **Recent Activity** after the change. * You receive a notification on your configured channel (email, etc.). This completes configuration of “route table change alarm” using OCI’s console-based alerting (Events + Notifications, with optional Monitoring if your policy requires it). In OCI you don’t get a native *metric* for “route table changed”, so the correct way to implement this “alarm” is: 1. Use **OCI Events** to detect `RouteTable` change events 2. Send those events to **Notifications** (ONS) 3. The notification (email/Slack/PagerDuty, etc.) is your “alarm” Below are step‑by‑step CLI instructions. *** ## 0. Prerequisites * OCI CLI configured (`oci setup config`) * You know: * **Compartment OCID** where your VCN/route tables live * Your **tenancy region** (e.g. `us-ashburn-1`) * Your target notification email address For brevity, define environment variables: ```bash theme={null} export COMPARTMENT_OCID="" export REGION="" # e.g. us-ashburn-1 oci setup reparsed-region --region $REGION ``` *** ## 1. Create a Notifications Topic ```bash theme={null} oci ons topic create \ --name "rt-change-alert-topic" \ --compartment-id "$COMPARTMENT_OCID" \ --description "Alert on OCI route table changes" \ --wait-for-state ACTIVE ``` Capture the topic OCID: ```bash theme={null} export TOPIC_OCID=$(oci ons topic list \ --compartment-id "$COMPARTMENT_OCID" \ --all \ --query "data[?\"name\"=='rt-change-alert-topic'].id | [0]" \ --raw-output) echo $TOPIC_OCID ``` *** ## 2. Create a Subscription (e.g., Email) ```bash theme={null} export ALERT_EMAIL="" oci ons subscription create \ --topic-id "$TOPIC_OCID" \ --protocol "EMAIL" \ --endpoint "$ALERT_EMAIL" \ --wait-for-state PENDING ``` Check your email and **confirm** the subscription. No notifications will be sent until it’s confirmed. *** ## 3. Create an Events Rule for Route Table Changes OCI route table events are emitted by the **Virtual Network** service with event types such as: * `com.oraclecloud.virtualnetwork.updateRouteTable` * `com.oraclecloud.virtualnetwork.createRouteTable` * `com.oraclecloud.virtualnetwork.deleteRouteTable` (Names may vary slightly by region/tenancy version; we’ll match with a prefix.) Create a rule condition JSON file, e.g. `rt-change-condition.json`: ```json theme={null} { "eventType": [ "com.oraclecloud.virtualnetwork.updateRouteTable", "com.oraclecloud.virtualnetwork.createRouteTable", "com.oraclecloud.virtualnetwork.deleteRouteTable" ] } ``` If you want to scope to only one compartment, wrap it like: ```json theme={null} { "data": { "compartmentId": "" }, "eventType": [ "com.oraclecloud.virtualnetwork.updateRouteTable", "com.oraclecloud.virtualnetwork.createRouteTable", "com.oraclecloud.virtualnetwork.deleteRouteTable" ] } ``` *** ### 3.1 Create the Events Rule ```bash theme={null} oci events rule create \ --display-name "Route Table Change Rule" \ --description "Triggers when OCI route tables are created, updated, or deleted" \ --is-enabled true \ --compartment-id "$COMPARTMENT_OCID" \ --condition "$(cat rt-change-condition.json)" \ --actions '{ "actions": [ { "actionType": "ONS", "isEnabled": true, "topicId": "'"$TOPIC_OCID"'" } ] }' ``` Verify: ```bash theme={null} oci events rule list \ --compartment-id "$COMPARTMENT_OCID" \ --all \ --query "data[?\"display-name\"=='Route Table Change Rule']" ``` *** ## 4. Test the Alarm 1. Modify a route table in the target compartment (add/remove a route) using Console or CLI. 2. Wait up to a few minutes. 3. You should receive an email from the Notifications topic with details of the change. *** ## 5. (Optional) Harden Scope If you only want alarms for a specific **VCN** or **route table**, refine the condition JSON: Example scoped to one route table: ```json theme={null} { "data": { "resourceId": "" }, "eventType": [ "com.oraclecloud.virtualnetwork.updateRouteTable", "com.oraclecloud.virtualnetwork.deleteRouteTable" ] } ``` Update the rule: ```bash theme={null} oci events rule update \ --rule-id "" \ --condition "$(cat rt-change-condition.json)" ``` *** This setup fulfills “Route Table Change Alarm” using OCI-native monitoring/alerting primitives (Events + Notifications) via OCI CLI. Below are the concrete steps and a Python example using the OCI SDK to configure an alarm for route table changes with OCI Monitoring. > Assumption:\ > Route table changes are being pushed as a custom metric (e.g., `route_table_changes`) into the Monitoring service (namespace `oci_vcn` or your own). If not, you must first create a Service Connector or other mechanism to publish these metrics. *** ## 1. Prerequisites 1. **Python SDK installed** ```bash theme={null} pip install oci ``` 2. **OCI config file** at `~/.oci/config` with a profile, e.g. `[DEFAULT]`. 3. **OCID values you need:** * `compartment_id` — Compartment where the route tables live and where metric is emitted. * `topic_id` — OCI Notifications topic OCID for sending alerts (email, Slack, etc.). * `display_name` — Name for the alarm (e.g., `RouteTableChangeAlarm`). *** ## 2. Metric Query for Route Table Changes Assuming your custom metric: * Namespace: `oci_vcn` (or your custom namespace) * Metric name: `route_table_changes` * Dimension: `routeTableId` Example query (change to your real namespace/metric): ```text theme={null} oci_vcn.route_table_changes[1m].count() > 0 ``` This triggers if at least one change is observed in the past minute. *** ## 3. Python Code to Create the Alarm ```python theme={null} import oci from oci.monitoring import MonitoringClient from oci.monitoring.models import CreateAlarmDetails # ------------------------------------------------------------------- # 1. Load OCI config # ------------------------------------------------------------------- config = oci.config.from_file("~/.oci/config", "DEFAULT") # ------------------------------------------------------------------- # 2. Init Monitoring client # ------------------------------------------------------------------- monitoring_client = MonitoringClient(config) # ------------------------------------------------------------------- # 3. Define required OCIDs and parameters # ------------------------------------------------------------------- compartment_id = "" topic_id = "" alarm_display_name = "RouteTableChangeAlarm" alarm_metric_namespace = "oci_vcn" # or your custom namespace alarm_query = f"{alarm_metric_namespace}.route_table_changes[1m].count() > 0" # ------------------------------------------------------------------- # 4. Build alarm details # ------------------------------------------------------------------- create_alarm_details = CreateAlarmDetails( display_name=alarm_display_name, compartment_id=compartment_id, # Monitoring query query=alarm_query, # SEVERITY: CRITICAL | ERROR | WARNING | INFO severity="CRITICAL", # ENABLE immediately is_enabled=True, # Notification destinations (Notification Topics) destinations=[topic_id], # Alarm will repeat notifications every 5 minutes while in alarm repeat_notification_duration=5, # minutes # "ONE_MINUTE", "FIVE_MINUTES", "TEN_MINUTES", etc. resolution="1m", # Treat missing data as "not breaching" so spurious alarms don't fire pending_duration="0m", suppression=None, metric_compartment_id=compartment_id, metric_compartment_id_in_subtree=True, is_notifications_per_metric_dimension_enabled=False, # Optional description description="Alarm when any route table change is detected via custom metric." ) # ------------------------------------------------------------------- # 5. Create the alarm # ------------------------------------------------------------------- response = monitoring_client.create_alarm(create_alarm_details) alarm = response.data print("Created Alarm OCID:", alarm.id) print("Display Name:", alarm.display_name) print("Query:", alarm.query) ``` *** ## 4. Quick Checklist 1. Ensure a mechanism sends a metric each time a route table is modified: * Metric name (e.g. `route_table_changes`) * Namespace (e.g. `oci_vcn` or `custom/rt_changes`) 2. Confirm the metric exists in **Monitoring → Metrics Explorer** using your query. 3. Run the Python script to create the alarm. 4. Test: perform a route table change and verify a notification is sent. If you share your exact metric namespace/name/dimensions, I can adjust the query and code precisely. ```hcl theme={null} # This finding cannot be remediated on oci_monitoring_alarm, because OCI Monitoring # alarms are metric-based and RouteTableChange is an Events service signal, not a metric. # You must instead use an OCI Events rule targeting an OCI Notifications topic. # Example (NON-COMPLIANT WITH USER REQUESTED RESOURCE TYPE, shown only for guidance): # - Create an Events rule to match RouteTableChange events # - Send them to an OCI Notifications topic for alerting resource "oci_events_rule" "route_table_change_rule" { compartment_id = var.COMPartment_OCID # replace with your compartment OCID display_name = "route-table-change-events" is_enabled = true # Filter for route table create/update/delete events condition = jsonencode({ "eventType" : [ "com.oraclecloud.virtualnetwork.createroutetable.begin", "com.oraclecloud.virtualnetwork.createroutetable.end", "com.oraclecloud.virtualnetwork.updateroutetable.begin", "com.oraclecloud.virtualnetwork.updateroutetable.end", "com.oraclecloud.virtualnetwork.deleteroutetable.begin", "com.oraclecloud.virtualnetwork.deleteroutetable.end" ], "data" : { "compartmentId" : [var.COMPARTMENT_OCID] # scope to your compartment } }) actions { actions { action_type = "ONS" is_enabled = true topic_id = oci_ons_notification_topic.route_table_change_topic.id } } } resource "oci_ons_notification_topic" "route_table_change_topic" { compartment_id = var.COMPARTMENT_OCID # replace with your compartment OCID name = "route-table-change-topic" description = "Alerts for OCI VCN route table changes" } # NOTE: # There is currently no oci_monitoring_alarm metric that corresponds directly to # RouteTableChange events, so an oci_monitoring_alarm cannot implement this check. # To configure this in the Console instead: # - Go to Developer Services -> Events Service -> Rules # - Create a rule matching the VCN route table event types above # - Add an action to send to a Notifications topic with your desired subscriptions. # Verification in Terraform: # `terraform plan` will show creation of: # - oci_ons_notification_topic.route_table_change_topic # - oci_events_rule.route_table_change_rule ```