> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI IAM Users Should Have Valid Email Addresses

### More Info:

All IAM users should have valid email addresses configured. Valid emails ensure password reset notifications, security alerts, and audit communications reach the correct person.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS AWS
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* HIPAA
* HITRUST CSF
* ISO 27001
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* Reserve Bank of India (RBI) Master Direction – Information Technology Framework
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate **“OCI IAM Users Should Have Valid Email Addresses”** using the **OCI Console**, you need to edit each affected user and add a valid email address.

        Below are the steps for both models of IAM in OCI (classic tenancy-local users and IAM Identity Domains). Use the path that matches what you see in your console.

        ***

        ## 1. If you are using **IAM Identity Domains** (most newer tenancies)

        1. Sign in to the **OCI Console**.
        2. In the left hamburger menu, go to\
           **Identity & Security → Identity Domains**.
        3. Click the **Identity Domain** where your users are (often named like `Default`).
        4. In the left menu of the domain, click **Users**.
        5. Search for the user that was flagged as non-compliant.
        6. Click the user’s name to open their details.
        7. Go to the **Contact Information** or **Profile** section (naming can vary slightly by UI version).
        8. Find the **Email** field and enter a **valid email address** (e.g., `user@example.com`).
           * Make sure it’s:
             * In a valid email format.
             * An address the user actually controls (for notifications, password resets, etc.).
        9. Click **Save** or **Update**.
        10. Repeat steps 5–9 for all users flagged by your **OCI IAM Monitoring / Cloud Guard** finding.

        ***

        ## 2. If you are using **Classic IAM (Tenancy-local users)**

        1. Sign in to the **OCI Console**.
        2. Open the left hamburger menu and go to\
           **Identity & Security → Identity → Users**.
        3. Locate the users reported in the misconfiguration (you can:
           * Filter or search by name, or
           * Use the report from Cloud Guard / IAM Monitoring to know which usernames are affected).
        4. Click the user’s **name** to open the user details.
        5. Click **Edit**.
        6. In the **Email** field, enter a **valid email address**.
        7. Click **Save Changes**.
        8. Repeat steps 3–7 for all non-compliant users.

        ***

        ## 3. Verify remediation in your monitoring

        1. After editing users, wait for the next **OCI IAM Monitoring / Cloud Guard** evaluation cycle (or manually re-run the detector if your tooling allows).
        2. Confirm that the finding **“OCI IAM Users Should Have Valid Email Addresses”** is now:
           * Marked as **Resolved**, or
           * No longer appears for the remediated users.

        If you tell me which view you see (Identity Domains vs. classic Users page), I can tailor the exact clicks for your environment.
      </Accordion>

      <Accordion title="Using CLI">
        Below are the key steps and example OCI CLI commands to remediate “OCI IAM Users Should Have Valid Email Addresses” by identifying users without valid emails and updating them.

        Assumptions:

        * You have OCI CLI installed and configured.
        * You know your tenancy OCID.
        * You (or an admin) know what each user’s correct email should be.

        ***

        ## 1. List All IAM Users and Find Those Without Email

        ```bash theme={null}
        TENANCY_OCID="<your_tenancy_ocid>"

        oci iam user list \
          --compartment-id "$TENANCY_OCID" \
          --all \
          --output table \
          --query "data[].{Name:name, OCID:id, Email:email, EmailVerified:email-verified}"
        ```

        To isolate users missing an email (email is null or empty):

        ```bash theme={null}
        oci iam user list \
          --compartment-id "$TENANCY_OCID" \
          --all \
          --query "data[?(!email || email=='')].{Name:name, OCID:id}" \
          --output table
        ```

        This shows only users that need remediation.

        ***

        ## 2. Update a Single User’s Email

        Once you know the correct email for a given user (by OCID):

        ```bash theme={null}
        USER_OCID="<user_ocid>"
        NEW_EMAIL="<user_email@example.com>"

        oci iam user update \
          --user-id "$USER_OCID" \
          --email "$NEW_EMAIL"
        ```

        Optionally mark it as verified (if you have already verified it out-of-band):

        ```bash theme={null}
        oci iam user update \
          --user-id "$USER_OCID" \
          --email "$NEW_EMAIL" \
          --email-verified true
        ```

        ***

        ## 3. Bulk Update from a CSV/JSON (Optional Automation)

        1. Export users without email to JSON:

        ```bash theme={null}
        oci iam user list \
          --compartment-id "$TENANCY_OCID" \
          --all \
          --query "data[?(!email || email=='')]" \
          --output json > users_missing_email.json
        ```

        2. Edit `users_missing_email.json` (or create a CSV mapping) to add the correct email for each user.

        3. Use a shell loop to update (example with a simple CSV: `user_email_map.csv` containing `user_ocid,email`):

        ```bash theme={null}
        while IFS=, read -r USER_OCID NEW_EMAIL
        do
          [ -z "$USER_OCID" ] && continue
          oci iam user update \
            --user-id "$USER_OCID" \
            --email "$NEW_EMAIL" \
            --email-verified true
        done < user_email_map.csv
        ```

        ***

        ## 4. Verify Remediation

        Re-list users and confirm emails are set:

        ```bash theme={null}
        oci iam user list \
          --compartment-id "$TENANCY_OCID" \
          --all \
          --query "data[?(!email || email=='')].{Name:name, OCID:id}" \
          --output table
        ```

        If no rows are returned, all users now have email addresses.

        ***

        These steps allow you to remediate the “valid email” requirement for OCI IAM users using only the OCI CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below is a practical way to enforce “OCI IAM users should have valid email addresses” using Python and OCI’s APIs.

        ### 1. Prerequisites

        1. Install OCI Python SDK:

        ```bash theme={null}
        pip install oci
        ```

        2. Configure OCI CLI-style config (for the SDK):

        ```bash theme={null}
        oci setup config
        ```

        Note the:

        * `tenancy`
        * `user`
        * `fingerprint`
        * `key_file`
        * `region`

        Use a user with permissions to:

        * `inspect users in tenancy`
        * `manage users` (if you want to auto-remediate)
        * `use metrics in tenancy` (if you want to push Monitoring metrics)

        Example IAM policy:

        ```text theme={null}
        Allow group IAM-Email-Audit-Group to inspect users in tenancy
        Allow group IAM-Email-Audit-Group to manage users in tenancy
        Allow group IAM-Email-Audit-Group to use metrics in tenancy
        ```

        ### 2. Decide Your Model

        You can:

        1. **Detect-only**:
           * Script lists all IAM users.
           * Flags those with missing/invalid email.
           * Pushes a custom metric / writes to log or report.

        2. **Detect + auto-remediate**:
           * Same as above, but calls `UpdateUser` to fix the email (e.g., from an external source or pattern).
           * Usually safer to **only detect** and let an admin fix the email.

        Below is a **detect-only** script, then an optional remediation snippet.

        ***

        ## 3. Python: Detect invalid IAM user emails

        **Logic:**

        * List all users in the tenancy.
        * Validate `email` field:
          * Non-empty
          * Basic regex pattern for email
        * Print invalid users.
        * (Optional) Publish a count to OCI Monitoring as a custom metric.

        ```python theme={null}
        import oci
        import re
        from datetime import datetime

        # ---------- CONFIG ----------
        CONFIG_FILE = "~/.oci/config"
        CONFIG_PROFILE = "DEFAULT"
        COMPARTMENT_OCID = "<tenancy-ocid>"  # tenancy as compartment for IAM
        NAMESPACE = "custom_iam"
        METRIC_NAME = "invalid_iam_user_email_count"
        RESOURCE_GROUP = "iam_email_validation"

        # Basic email regex (can be customized)
        EMAIL_REGEX = re.compile(r"^[^@\s]+@[^@\s]+\.[^@\s]+$")

        # ---------- HELPER FUNCTIONS ----------
        def is_valid_email(email: str) -> bool:
            if not email:
                return False
            return EMAIL_REGEX.match(email) is not None

        def main():
            # Load config
            config = oci.config.from_file(CONFIG_FILE, CONFIG_PROFILE)

            # IAM client
            identity_client = oci.identity.IdentityClient(config)

            # Monitoring client (optional)
            monitoring_client = oci.monitoring.MonitoringClient(config)

            invalid_users = []

            # List all users in the tenancy
            users = oci.pagination.list_call_get_all_results(
                identity_client.list_users,
                compartment_id=COMPARTMENT_OCID
            ).data

            for user in users:
                # user.email may be None or empty
                email = getattr(user, "email", None)
                if not is_valid_email(email):
                    invalid_users.append({
                        "id": user.id,
                        "name": user.name,
                        "email": email
                    })

            # Print report
            print("=== IAM users with invalid/missing emails ===")
            for u in invalid_users:
                print(f"User: {u['name']} ({u['id']}) | email: {u['email']}")

            print(f"Total invalid users: {len(invalid_users)}")

            # ---------- OPTIONAL: push metric to OCI Monitoring ----------
            try:
                if len(invalid_users) >= 0:
                    metric_data = oci.monitoring.models.PostMetricDataDetails(
                        metric_data=[
                            oci.monitoring.models.MetricDataDetails(
                                namespace=NAMESPACE,
                                compartment_id=COMPARTMENT_OCID,
                                name=METRIC_NAME,
                                dimensions={
                                    "resourceGroup": RESOURCE_GROUP
                                },
                                datapoints=[
                                    oci.monitoring.models.Datapoint(
                                        timestamp=datetime.utcnow(),
                                        value=float(len(invalid_users))
                                    )
                                ]
                            )
                        ]
                    )
                    response = monitoring_client.post_metric_data(metric_data)
                    print("Metric posted status:", response.data.failed_metrics_count, "failed")
            except Exception as e:
                print("Failed to post metric:", e)


        if __name__ == "__main__":
            main()
        ```

        **How to use for monitoring:**

        * Run this script periodically via:
          * OCI Functions + OCI Events Scheduler
          * A cron job on a bastion/automation host
        * In **OCI Monitoring**, create an alarm on the custom metric:
          * Query example:
            ```text theme={null}
            custom_iam.invalid_iam_user_email_count[1m].max() > 0
            ```
          * Action: send notification to Email/Slack via OCI Notifications.

        ***

        ## 4. Optional: Auto-remediate by updating user email

        If you already know the “correct” email (e.g., via mapping), you can call `UpdateUser`.

        Example snippet to update one user:

        ```python theme={null}
        def update_user_email(identity_client, user_id, new_email):
            update_details = oci.identity.models.UpdateUserDetails(
                email=new_email
            )
            response = identity_client.update_user(
                user_id=user_id,
                update_user_details=update_details
            )
            return response.data
        ```

        You would call this inside your loop once you decide the proper new email, for example:

        ```python theme={null}
        for user in users:
            email = getattr(user, "email", None)
            if not is_valid_email(email):
                # Example remediation: derive email from username
                # WARNING: Only use if your org’s naming pattern is guaranteed
                new_email = f"{user.name}@example.com"
                print(f"Fixing {user.name}: {email} -> {new_email}")
                update_user_email(identity_client, user.id, new_email)
        ```

        Usually, you should:

        * Start with detect-only.
        * Review invalid users.
        * Then either fix them manually in Console or implement a controlled auto-fix with clear mappings.

        ***

        If you tell me how you want to run this (OCI Function, cron, etc.), I can adapt the script to that environment and add the exact deployment steps.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "oci_identity_user" "OCI_IAM_MONITORING_USER" {
          # Existing required arguments
          compartment_id = "OCID_OF_TENANCY_OR_IAM_COMPARTMENT"
          name           = "OCI_IAM_MONITORING"
          description    = "IAM user for monitoring"

          # Remediation: ensure the user has a valid email address configured
          email = "VALID_MONITORING_USER_EMAIL@example.com"

          # Optional tags (if you already use them)
          # freeform_tags = {
          #   "KEY" = "VALUE"
          # }
          # defined_tags = {
          #   "NAMESPACE.KEY" = "VALUE"
          # }
        }
        ```

        This change is an in‑place update of the user’s `email` field and does not force resource replacement.

        After applying the fix, `terraform plan` should show an update to `oci_identity_user.OCI_IAM_MONITORING_USER` with `email` changing from its previous value (or null) to `VALID_MONITORING_USER_EMAIL@example.com`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>