Description

Ensure an Events Service rule in the root compartment watches for identity provider (IdP) group mapping changes and has an action that sends a notification to a monitored topic. The rule should match all of the related event types, so the security team is alerted as soon as these changes happen.

Rationale

IdP group mappings decide which OCI groups federated users are placed in. Mapping an identity provider group to Administrators, for example, could give many users full access at once. Alerting on mapping changes helps the team catch changes that could grant unintended access.

Impact

  • The security team is alerted when an IdP group mapping is created, changed, or deleted

  • Speeds up detection of unauthorized or accidental changes

  • Alert volume depends on how often these changes happen

Default Value

By default, no event rules or notification topics are configured.

Pre-Requisites

  • Permission to manage cloudevents-rules and ons-topics in the root compartment

  • A notification topic with at least one confirmed subscription (for example, the security team's email address)

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Observability & Management, and under Events Service select Rules. In the Compartment filter, select the root compartment (tenancy).

  3. Look for an enabled rule whose conditions match the Identity service and these event types: Idp Group Mapping – Create, Idp Group Mapping – Delete, and Idp Group Mapping – Update.

  4. Open the rule and verify that its Actions include a Notifications action pointing to a topic with an active subscription.

  5. If no such rule exists, or it has no notification action, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. If you do not have a topic, open Developer Services > Application Integration > Notifications, select Create topic, then create a subscription (for example, Email) and confirm it.

  3. Open the navigation menu, select Observability & Management, and under Events Service select Rules. In the Compartment filter, select the root compartment (tenancy).

  4. Select Create rule and enter a name, for example notify-on-idp-group-mapping-changes.

  5. Under Rule conditions, choose Event type, select Service name Identity, and select the event types: Idp Group Mapping – Create, Idp Group Mapping – Delete, and Idp Group Mapping – Update.

  6. Under Actions, choose Action type Notifications, and select the compartment and topic.

  7. Select Create rule.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Observability & Management, and under Events Service select Rules. In the Compartment filter, select the root compartment (tenancy).

  3. Select the rule and select Disable, or delete the rule.

Reference