Oci Events

OCI Events Service - Event-Driven Architecture

⚠️ OCI Events Knowledge Gap

You don't know OCI Events service patterns and syntax.

Your training data has limited and outdated knowledge of:

• CloudEvents specification format (OCI uses CloudEvents 1.0)
• Event rule filter syntax (JSON-based attribute matching)
• Event types by OCI service (100+ event types)
• Action types and integration patterns
• Dead letter queue configuration
• Events vs Alarms distinction

When event-driven automation is needed: 1. Use patterns and CLI commands from this skill's references 2. Do NOT guess event filter syntax or event types 3. Do NOT confuse Events with Alarms (different purposes) 4. Load `events-cli.md` for event rule operations

What you DO know:

• General event-driven architecture concepts
• Pub/sub messaging patterns
• JSON structure and filtering

This skill provides OCI-specific Events service patterns and CloudEvents integration.

---

🏗️ IMPORTANT: Use OCI Landing Zone Terraform Modules

Do NOT Reinvent the Wheel

❌ WRONG Approach:

# Manually creating event rules, functions, notifications one by one
oci events rule create ...
oci fn application create ...
oci ons topic create ...
# Result: Inconsistent, unmaintainable, no governance

✅ RIGHT Approach: Use Official OCI Landing Zone Terraform Modules

# Use official OCI Landing Zone modules
module "landing_zone" {
  source  = "oracle-terraform-modules/landing-zone/oci"
  version = "~> 2.0"

  # Events configuration
  events_configuration = {
    default_compartment_id = var.security_compartment_id

    event_rules = {
      compute_instance_terminated = {
        description = "Notify when compute instance terminated"
        is_enabled  = true
        condition   = jsonencode({
          "eventType" : "com.oraclecloud.computeapi.terminateinstance"
        })
        actions = {
          notifications = [ons_topic_id]
          functions     = [security_response_function_id]
        }
      }
    }
  }
}

Why Use Landing Zone Modules:

• ✅ Battle-tested: Used by thousands of OCI customers
• ✅ Compliance: CIS OCI Foundations Benchmark aligned
• ✅ Maintained: Oracle updates for API changes
• ✅ Comprehensive: Events + IAM + Logging + Monitoring integrated
• ✅ Reusable: Consistent patterns across environments

Official Resources:

• OCI Landing Zone Terraform Modules
• OCI Resource Manager Stacks
• CIS OCI Foundation Benchmark

When to Use Manual CLI (this skill's references):

• Learning and prototyping
• Troubleshooting existing event rules
• One-off automation tasks
• Understanding event patterns before implementing in Terraform

---

You are an OCI Events service expert. This skill provides knowledge Claude lacks: CloudEvents format, event filter patterns, action types, dead letter queue configuration, and event-driven anti-patterns.

NEVER Do This

❌ NEVER use Events for metric threshold monitoring (use Alarms instead)

BAD - Events for CPU threshold:
Event Rule: "CPU utilization > 80%"
Problem: Events don't monitor metrics!

CORRECT tool: Alarms
oci monitoring alarm create \
  --metric-name CpuUtilization \
  --threshold 80

Why critical: Events are for state changes (instance created, bucket deleted), NOT continuous metrics. Using Events for thresholds wastes time—the rule will never fire.

Events vs Alarms:

❌ NEVER forget to configure Dead Letter Queue (lost events)

# BAD - no DLQ, failed events disappear
oci events rule create \
  --display-name "Invoke-Function" \
  --condition '{"eventType": "com.oraclecloud.objectstorage.createobject"}' \
  --actions '{
    "actions": [{
      "actionType": "FAAS",
      "isEnabled": true,
      "functionId": "ocid1.fnfunc.oc1..xxx"
    }]
  }'
# If function fails, event is LOST

# GOOD - DLQ configured
oci events rule create \
  --display-name "Invoke-Function-with-DLQ" \
  --condition '{"eventType": "com.oraclecloud.objectstorage.createobject"}' \
  --actions '{
    "actions": [{
      "actionType": "FAAS",
      "isEnabled": true,
      "functionId": "ocid1.fnfunc.oc1..xxx",
      "description": "Process uploaded file"
    }]
  }' \
  --compartment-id $COMPARTMENT_ID

# Separately configure DLQ (requires Streaming)
# Events that fail delivery go to stream for retry/analysis

Cost impact: Lost events = lost business transactions. E-commerce: 1 lost order event = $50-500 revenue loss. Healthcare: 1 lost patient record event = compliance violation.

❌ NEVER use overly broad event filters (noise + cost)

// BAD - matches ALL compute events
{
  "eventType": "com.oraclecloud.computeapi.*"
}
// Fires for: launch, terminate, reboot, resize, metadata change
// Result: 1000s of events/day, function invocations cost $$$

// GOOD - specific event types
{
  "eventType": [
    "com.oraclecloud.computeapi.terminateinstance",
    "com.oraclecloud.computeapi.launchinstance"
  ]
}
// Fires only for critical lifecycle events

Cost impact: 10,000 unnecessary function invocations/day × $0.0000002/GB-second × 256MB × 5s = $2.56/day = $77/month wasted.

❌ NEVER send sensitive data in event notification (security risk)

// BAD - event includes passwords, keys
Event payload forwarded to notification:
{
  "data": {
    "resourceName": "db-prod-1",
    "adminPassword": "SecurePass123!",  // EXPOSED!
    "apiKey": "sk_live_xxxxx"           // EXPOSED!
  }
}

// GOOD - reference-only events
{
  "data": {
    "resourceId": "ocid1.database.oc1..xxx",
    "resourceName": "db-prod-1"
    // Function retrieves secrets from Vault using resourceId
  }
}

Security impact: Notification emails/webhooks log event payload. Secrets in logs = credential exposure = breach.

❌ NEVER use Events for real-time streaming (use Streaming service)

BAD use case: Process 10,000 transactions/second via Events
Events service limits: 50 requests/second per rule
Result: Throttling, dropped events

CORRECT: OCI Streaming
- Throughput: 1 MB/second per partition
- Retention: 7 days (vs Events = deliver-once)
- Consumer groups: Multiple consumers per stream

Why critical: Events deliver to actions once (best-effort). Streaming is for high-throughput, durable messaging.

❌ NEVER assume Events are delivered in order

Event Timeline:
1. Object created at 10:00:00
2. Object updated at 10:00:01
3. Object deleted at 10:00:02

Events may arrive:
- Delete event at 10:00:03
- Create event at 10:00:04  // Out of order!
- Update event at 10:00:05

Function logic must handle out-of-order events

Solution: Include timestamp in event, check resource state before acting, or use idempotent operations.

❌ NEVER use more than 5 actions per rule (performance)

# BAD - 10 actions on one rule
Event Rule → 10 different functions
Latency: 10 serial invocations = 50+ seconds

# GOOD - fan-out pattern
Event Rule → 1 function → Publishes to Streaming → 10 consumers
Latency: Parallel processing = 5 seconds

Limit: 5 actions per rule (hard limit). Design for fan-out if >5 destinations needed.

❌ NEVER forget IAM policy for event actions

# BAD - event rule created, but no permission to invoke function
oci events rule create ... --actions function-id
# Events fire but silently fail (403 Forbidden)

# GOOD - grant Events service permission to invoke function
oci iam policy create \
  --compartment-id $COMPARTMENT_ID \
  --name "Events-Invoke-Functions-Policy" \
  --statements '[
    "Allow service cloudEvents to use functions-family in compartment <compartment-name>"
  ]'

Debugging hell: Event rule shows "active", function never triggers, no error message. Root cause: Missing IAM policy.

Progressive Loading References

Event Architecture Patterns and Filter Syntax

WHEN TO LOAD `events-patterns.md`:

• Designing event-driven architecture (Object Storage → Function, Instance Lifecycle → Notification)
• Writing complex event filter syntax (compartment, tags, resource attributes)
• Looking up common event types by OCI service
• Understanding fan-out patterns and event chaining
• Choosing between action types (ONS vs FAAS vs OSS)

Do NOT load for:

• Quick anti-pattern reference (NEVER list above covers it)
• Events vs Alarms decision (covered above)
• Quick CLI examples (use events-cli.md instead)

---

OCI CLI for Events

WHEN TO LOAD `events-cli.md`:

• Creating event rules with filters
• Configuring actions (Functions, Notifications, Streaming)
• Troubleshooting event delivery failures
• Listing available event types
• Testing event rule patterns

Example: Create event rule for object upload

oci events rule create \
  --display-name "Process-CSV-Uploads" \
  --condition '{
    "eventType": "com.oraclecloud.objectstorage.createobject",
    "data": {"resourceName": "*.csv"}
  }' \
  --actions '{
    "actions": [{
      "actionType": "FAAS",
      "isEnabled": true,
      "functionId": "ocid1.fnfunc.oc1..xxx"
    }]
  }' \
  --compartment-id $COMPARTMENT_ID

Do NOT load for:

• Function implementation details (covered in oci-functions skill)
• Notification topic setup (covered in monitoring-operations skill)
• Streaming configuration (covered in streaming skill when available)

---

OCI Events Reference (Official Oracle Documentation)

WHEN TO LOAD `oci-events-reference.md`:

• Need comprehensive list of all OCI service event types
• Understanding CloudEvents 1.0 specification in OCI
• Implementing complex event patterns and filtering
• Need official Oracle guidance on Events service architecture
• Troubleshooting event delivery and action failures

Do NOT load for:

• Quick event rule creation (CLI examples above)
• Common event patterns (architecture patterns in this skill)
• Events vs Alarms decision (decision tree above)

---

When to Use This Skill

• Implementing event-driven automation and workflows
• Setting up serverless architectures (Events + Functions)
• Troubleshooting "event rule not firing" issues
• Integrating OCI services via events
• Designing reactive architectures (vs polling)
• Compliance and audit trail automation
• Incident response and security automation

OCI CLI for Events Service Operations

Complete OCI CLI commands for event-driven automation and event rule management.

Prerequisites

# Verify OCI CLI and authentication
oci --version
oci iam region list --output table

# Get compartment ID
export COMPARTMENT_ID=$(oci iam compartment list \
  --name "YourCompartment" \
  --query 'data[0].id' \
  --raw-output)

echo "Compartment: $COMPARTMENT_ID"

List Available Event Types

# List all event types across OCI services
oci events event-type list --all --output table

# Filter by service (e.g., compute)
oci events event-type list \
  --all \
  | jq '.data[] | select(.name | contains("compute"))'

# Common event types by service
oci events event-type list --all \
  | jq -r '.data[] | .name' \
  | grep -E "^com.oraclecloud.(compute|database|objectstorage|iam)"

# Get specific event type details
oci events event-type get \
  --event-type "com.oraclecloud.computeapi.launchinstance"

Create Event Rules

Basic Event Rule (Single Event Type)

# Rule: Notify when compute instance is terminated
oci events rule create \
  --display-name "Compute-Instance-Terminated" \
  --description "Alert when any compute instance is terminated" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": "com.oraclecloud.computeapi.terminateinstance"
  }' \
  --actions '{
    "actions": [{
      "actionType": "ONS",
      "isEnabled": true,
      "topicId": "ocid1.onstopic.oc1..xxx",
      "description": "Send notification to SRE team"
    }]
  }'

Event Rule with Compartment Filter

# Rule: Alert only for production compartment events
oci events rule create \
  --display-name "Prod-Database-Stopped" \
  --description "Alert when production database is stopped" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": "com.oraclecloud.databaseservice.stopautonomousdatabase",
    "data": {
      "compartmentName": "Prod"
    }
  }' \
  --actions '{
    "actions": [{
      "actionType": "ONS",
      "isEnabled": true,
      "topicId": "ocid1.onstopic.oc1..xxx",
      "description": "CRITICAL: Prod database stopped"
    }]
  }'

Event Rule with Resource Name Pattern

# Rule: Process CSV files uploaded to Object Storage
oci events rule create \
  --display-name "Process-CSV-Uploads" \
  --description "Trigger function for CSV file uploads" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": "com.oraclecloud.objectstorage.createobject",
    "data": {
      "resourceName": "*.csv"
    }
  }' \
  --actions '{
    "actions": [{
      "actionType": "FAAS",
      "isEnabled": true,
      "functionId": "ocid1.fnfunc.oc1..xxx",
      "description": "Parse and load CSV data"
    }]
  }'

Event Rule with Multiple Event Types

# Rule: Monitor compute instance lifecycle (create + delete)
oci events rule create \
  --display-name "Compute-Lifecycle-Audit" \
  --description "Log all compute instance creates and deletes" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": [
      "com.oraclecloud.computeapi.launchinstance",
      "com.oraclecloud.computeapi.terminateinstance"
    ]
  }' \
  --actions '{
    "actions": [{
      "actionType": "OSS",
      "isEnabled": true,
      "streamId": "ocid1.stream.oc1..xxx",
      "description": "Stream to audit log"
    }]
  }'

Event Rule with Tag Filters

# Rule: Alert for changes to tagged resources
oci events rule create \
  --display-name "Critical-Resource-Changes" \
  --description "Alert for changes to critical infrastructure" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": "com.oraclecloud.computeapi.*",
    "data": {
      "freeformTags": {
        "Criticality": "High"
      }
    }
  }' \
  --actions '{
    "actions": [{
      "actionType": "ONS",
      "isEnabled": true,
      "topicId": "ocid1.onstopic.oc1..xxx",
      "description": "Critical resource event"
    }]
  }'

Event Rule with Multiple Actions (Fan-Out)

# Rule: Multiple actions for same event
oci events rule create \
  --display-name "IAM-Policy-Changed-Multi-Action" \
  --description "Multiple responses to IAM policy changes" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": "com.oraclecloud.identityControlPlane.UpdatePolicy"
  }' \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "ocid1.onstopic.oc1..xxx",
        "description": "Email security team"
      },
      {
        "actionType": "FAAS",
        "isEnabled": true,
        "functionId": "ocid1.fnfunc.oc1..xxx",
        "description": "Log to SIEM"
      },
      {
        "actionType": "OSS",
        "isEnabled": true,
        "streamId": "ocid1.stream.oc1..xxx",
        "description": "Stream for audit compliance"
      }
    ]
  }'

# LIMIT: Maximum 5 actions per rule

Manage Event Rules

List Event Rules

# List all event rules in compartment
oci events rule list \
  --compartment-id $COMPARTMENT_ID \
  --lifecycle-state ACTIVE \
  --output table

# Get specific rule details
RULE_ID="ocid1.eventsrule.oc1..xxx"
oci events rule get --rule-id $RULE_ID

# List rules with specific display name
oci events rule list \
  --compartment-id $COMPARTMENT_ID \
  --display-name "Compute-Instance-Terminated" \
  --output json

Update Event Rule

# Enable/disable rule
oci events rule update \
  --rule-id $RULE_ID \
  --is-enabled false

# Update rule condition
oci events rule update \
  --rule-id $RULE_ID \
  --condition '{
    "eventType": [
      "com.oraclecloud.computeapi.launchinstance",
      "com.oraclecloud.computeapi.terminateinstance",
      "com.oraclecloud.computeapi.changeinstanceshape"
    ]
  }'

# Add new action to existing rule
oci events rule update \
  --rule-id $RULE_ID \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "ocid1.onstopic.oc1..xxx"
      },
      {
        "actionType": "FAAS",
        "isEnabled": true,
        "functionId": "ocid1.fnfunc.oc1..xxx"
      }
    ]
  }'

Delete Event Rule

# Delete specific rule
oci events rule delete \
  --rule-id $RULE_ID \
  --force

# Verify deletion
oci events rule list \
  --compartment-id $COMPARTMENT_ID \
  --lifecycle-state DELETED \
  --output table

IAM Policies for Events

Grant Events Permission to Invoke Functions

# Policy: Allow Events service to invoke all functions in compartment
oci iam policy create \
  --compartment-id $COMPARTMENT_ID \
  --name "Events-Invoke-Functions-Policy" \
  --description "Allow Events service to trigger Functions" \
  --statements '[
    "Allow service cloudEvents to use functions-family in compartment <compartment-name>"
  ]'

# Policy: Allow Events to invoke specific function
oci iam policy create \
  --compartment-id $COMPARTMENT_ID \
  --name "Events-Invoke-Specific-Function-Policy" \
  --description "Allow Events to invoke CSV processor function" \
  --statements '[
    "Allow service cloudEvents to use fn-function in compartment <compartment-name> where target.function.id = \"ocid1.fnfunc.oc1..xxx\""
  ]'

Grant Events Permission to Publish to ONS

# Policy: Allow Events to publish to Notification topics
oci iam policy create \
  --compartment-id $COMPARTMENT_ID \
  --name "Events-Publish-ONS-Policy" \
  --description "Allow Events to send notifications" \
  --statements '[
    "Allow service cloudEvents to use ons-topics in compartment <compartment-name>"
  ]'

Grant Events Permission to Write to Streaming

# Policy: Allow Events to publish to Streaming
oci iam policy create \
  --compartment-id $COMPARTMENT_ID \
  --name "Events-Publish-Streaming-Policy" \
  --description "Allow Events to write to Streaming" \
  --statements '[
    "Allow service cloudEvents to use stream-push in compartment <compartment-name>"
  ]'

Testing and Debugging

Test Event Rule Condition

# Get sample event payload for event type
oci events event-type get \
  --event-type "com.oraclecloud.computeapi.launchinstance" \
  | jq '.data."schema"'

# Manually trigger event (for testing)
# Note: OCI Events doesn't support manual event injection
# Test by performing the actual action (e.g., launch instance)

# Check rule execution history (via monitoring)
oci monitoring metric-data summarize-metrics-data \
  --namespace oci_events \
  --compartment-id $COMPARTMENT_ID \
  --query-text 'RulesEvaluated[1m].count()' \
  --start-time "2026-01-28T00:00:00Z" \
  --end-time "2026-01-28T23:59:59Z"

Check Event Rule Metrics

# Get rule evaluation count
oci monitoring metric-data summarize-metrics-data \
  --namespace oci_events \
  --compartment-id $COMPARTMENT_ID \
  --query-text 'RulesEvaluated[5m]{ruleId="'$RULE_ID'"}.count()' \
  --start-time "2026-01-28T10:00:00Z" \
  --end-time "2026-01-28T11:00:00Z"

# Get action execution count
oci monitoring metric-data summarize-metrics-data \
  --namespace oci_events \
  --compartment-id $COMPARTMENT_ID \
  --query-text 'ActionsExecuted[5m]{ruleId="'$RULE_ID'"}.count()' \
  --start-time "2026-01-28T10:00:00Z" \
  --end-time "2026-01-28T11:00:00Z"

# Get failed action count
oci monitoring metric-data summarize-metrics-data \
  --namespace oci_events \
  --compartment-id $COMPARTMENT_ID \
  --query-text 'ActionsFailed[5m]{ruleId="'$RULE_ID'"}.count()' \
  --start-time "2026-01-28T10:00:00Z" \
  --end-time "2026-01-28T11:00:00Z"

Common Event Patterns

Pattern 1: Object Storage Upload → Function Processing

# Create notification topic
ONS_TOPIC=$(oci ons topic create \
  --compartment-id $COMPARTMENT_ID \
  --name "CSV-Processing-Topic" \
  --wait-for-state ACTIVE \
  --query 'data.id' --raw-output)

# Create function (assume already deployed)
FUNCTION_ID="ocid1.fnfunc.oc1..xxx"

# Create event rule
oci events rule create \
  --display-name "Object-Upload-Processing" \
  --description "Process files uploaded to Object Storage" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": "com.oraclecloud.objectstorage.createobject",
    "data": {
      "additionalDetails": {
        "bucketName": "data-ingestion"
      }
    }
  }' \
  --actions '{
    "actions": [{
      "actionType": "FAAS",
      "isEnabled": true,
      "functionId": "'$FUNCTION_ID'",
      "description": "Process uploaded file"
    }]
  }'

Pattern 2: IAM Changes → Security Audit

# Create streaming for audit trail
STREAM_ID=$(oci streaming admin stream create \
  --compartment-id $COMPARTMENT_ID \
  --name "IAM-Audit-Stream" \
  --partitions 1 \
  --wait-for-state ACTIVE \
  --query 'data.id' --raw-output)

# Create event rule for IAM changes
oci events rule create \
  --display-name "IAM-Changes-Audit" \
  --description "Audit all IAM policy and user changes" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": [
      "com.oraclecloud.identityControlPlane.CreateUser",
      "com.oraclecloud.identityControlPlane.UpdateUser",
      "com.oraclecloud.identityControlPlane.DeleteUser",
      "com.oraclecloud.identityControlPlane.CreatePolicy",
      "com.oraclecloud.identityControlPlane.UpdatePolicy",
      "com.oraclecloud.identityControlPlane.DeletePolicy"
    ]
  }' \
  --actions '{
    "actions": [
      {
        "actionType": "ONS",
        "isEnabled": true,
        "topicId": "'$ONS_TOPIC'",
        "description": "Alert security team"
      },
      {
        "actionType": "OSS",
        "isEnabled": true,
        "streamId": "'$STREAM_ID'",
        "description": "Stream to SIEM"
      }
    ]
  }'

Pattern 3: Database Lifecycle → Compliance Check

# Create event rule for database operations
oci events rule create \
  --display-name "Database-Lifecycle-Compliance" \
  --description "Compliance checks for database operations" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": [
      "com.oraclecloud.databaseservice.createautonomousdatabase",
      "com.oraclecloud.databaseservice.deleteautonomousdatabase",
      "com.oraclecloud.databaseservice.updateautonomousdatabase"
    ],
    "data": {
      "compartmentName": "Prod"
    }
  }' \
  --actions '{
    "actions": [{
      "actionType": "FAAS",
      "isEnabled": true,
      "functionId": "'$FUNCTION_ID'",
      "description": "Check encryption, backup policy, tags"
    }]
  }'

Pattern 4: Compute Instance State → Cost Optimization

# Create event rule to detect long-running dev instances
oci events rule create \
  --display-name "Dev-Instance-Running-Alert" \
  --description "Alert when dev instances run beyond business hours" \
  --is-enabled true \
  --compartment-id $COMPARTMENT_ID \
  --condition '{
    "eventType": "com.oraclecloud.computeapi.launchinstance",
    "data": {
      "freeformTags": {
        "Environment": "Dev"
      }
    }
  }' \
  --actions '{
    "actions": [{
      "actionType": "FAAS",
      "isEnabled": true,
      "functionId": "'$FUNCTION_ID'",
      "description": "Schedule auto-shutdown at 6pm"
    }]
  }'

Troubleshooting

Event Rule Not Firing

# 1. Check if rule is enabled
oci events rule get --rule-id $RULE_ID \
  | jq '.data."is-enabled"'

# 2. Check if event type is correct
oci events event-type list --all \
  | jq -r '.data[] | .name' \
  | grep -i "compute"

# 3. Check IAM policies
oci iam policy list \
  --compartment-id $COMPARTMENT_ID \
  | jq '.data[] | select(.name | contains("Events"))'

# 4. Check rule metrics (did rule evaluate?)
oci monitoring metric-data summarize-metrics-data \
  --namespace oci_events \
  --compartment-id $COMPARTMENT_ID \
  --query-text 'RulesEvaluated[5m]{ruleId="'$RULE_ID'"}.count()' \
  --start-time "2026-01-28T10:00:00Z" \
  --end-time "2026-01-28T11:00:00Z"

Action Failing (Function Not Invoked)

# 1. Check action failures metric
oci monitoring metric-data summarize-metrics-data \
  --namespace oci_events \
  --compartment-id $COMPARTMENT_ID \
  --query-text 'ActionsFailed[5m]{ruleId="'$RULE_ID'"}.count()' \
  --start-time "2026-01-28T10:00:00Z" \
  --end-time "2026-01-28T11:00:00Z"

# 2. Check IAM policy for Functions
oci iam policy list \
  --compartment-id $COMPARTMENT_ID \
  | jq '.data[] | select(.statements[] | contains("cloudEvents"))'

# 3. Check function logs
oci logging log list \
  --log-group-id "ocid1.loggroup.oc1..xxx" \
  --output table

# 4. Verify function exists and is active
oci fn function get --function-id $FUNCTION_ID

Event Filter Not Matching

# Get event type schema to understand available fields
oci events event-type get \
  --event-type "com.oraclecloud.objectstorage.createobject" \
  | jq '.data.schema'

# Common filter fields:
# - compartmentName: Name of compartment
# - compartmentId: OCID of compartment
# - resourceName: Resource name (supports wildcards *)
# - freeformTags: User-defined tags
# - definedTags: Defined tag namespaces

# Test filter specificity
# Too broad: All compute events
{"eventType": "com.oraclecloud.computeapi.*"}

# More specific: Only instance launches in prod
{
  "eventType": "com.oraclecloud.computeapi.launchinstance",
  "data": {"compartmentName": "Prod"}
}

Best Practices

Use Specific Event Types (Not Wildcards)

# ❌ BAD - matches all 50+ compute event types
oci events rule create \
  --condition '{"eventType": "com.oraclecloud.computeapi.*"}' \
  ...

# ✅ GOOD - matches only critical lifecycle events
oci events rule create \
  --condition '{
    "eventType": [
      "com.oraclecloud.computeapi.launchinstance",
      "com.oraclecloud.computeapi.terminateinstance"
    ]
  }' \
  ...

Always Set IAM Policies First

# 1. Create IAM policy
oci iam policy create \
  --compartment-id $COMPARTMENT_ID \
  --name "Events-Functions-Policy" \
  --statements '["Allow service cloudEvents to use functions-family in compartment MyCompartment"]'

# 2. Wait for policy to propagate (30 seconds)
sleep 30

# 3. Create event rule
oci events rule create \
  --condition '...' \
  --actions '...'

Monitor Event Rule Health

# Create alarm for failed actions
oci monitoring alarm create \
  --compartment-id $COMPARTMENT_ID \
  --display-name "Events-Actions-Failed-Alarm" \
  --namespace "oci_events" \
  --query-text 'ActionsFailed[1m].sum() > 0' \
  --severity "CRITICAL" \
  --destinations '["'$ONS_TOPIC'"]' \
  --is-enabled true

Use Descriptive Names

# ✅ GOOD - clear purpose
--display-name "Prod-Database-Stopped-Alert"
--description "Critical: Production database stopped - requires immediate investigation"

# ❌ BAD - unclear
--display-name "Rule-1"
--description "Database rule"

When to Use OCI Events CLI

Use these commands when you need to:

• Create event-driven automation workflows
• Set up event rules with custom filters
• Troubleshoot event delivery issues
• Test event patterns and actions
• Quick prototypes before Terraform implementation

Don't use for:

• Production deployments (use OCI Landing Zone Terraform modules)
• Complex multi-rule architectures (use Terraform)
• When IaC governance is required (use Terraform)

OCI Events Service - Patterns Reference

Event-Driven Architecture Patterns

Pattern 1: Object Storage Upload → Function Processing

┌─────────────────┐
│ Object Storage  │
│  - User uploads │
│    file.csv     │
└────────┬────────┘
         │ Event: createObject
         ▼
┌─────────────────┐
│   Events Rule   │
│  Filter: .csv   │
└────────┬────────┘
         │ Invoke
         ▼
┌─────────────────┐
│   Function      │
│  - Parse CSV    │
│  - Store in DB  │
│  - Send email   │
└─────────────────┘

Event Filter:
{
  "eventType": "com.oraclecloud.objectstorage.createobject",
  "data": {
    "additionalDetails": {
      "eTag": "*"
    },
    "resourceName": "*.csv"
  }
}

Use case: Data ingestion pipeline, document processing

Pattern 2: Compute Instance Lifecycle → Compliance Check

┌──────────────────┐
│ Compute Instance │
│  - Terminated    │
│  - Created       │
└────────┬─────────┘
         │ Event: terminateInstance
         ▼
┌──────────────────┐
│   Events Rule    │
│  Filter: Prod    │
└────────┬─────────┘
         │ Notify
         ▼
┌──────────────────┐     ┌──────────────────┐
│   Notification   │────▶│   PagerDuty     │
│   Topic          │     │   (On-call)      │
└──────────────────┘     └──────────────────┘

Event Filter:
{
  "eventType": "com.oraclecloud.computeapi.terminateinstance",
  "data": {
    "compartmentName": "Prod"
  }
}

Use case: Security monitoring, audit trail, incident response

Pattern 3: Fan-Out (1 Event → Multiple Actions)

┌─────────────────┐
│  Database       │
│  - Stopped      │
└────────┬────────┘
         │ Event: stopAutonomousDatabase
         ▼
┌─────────────────────────────────────┐
│   Events Rule                       │
│  Actions:                           │
│   1. Notification → Email SRE      │
│   2. Function → Log to Splunk      │
│   3. Streaming → Analytics         │
└─────────────────────────────────────┘

Use case: Multi-channel alerting, compliance logging, analytics
Max actions: 5 per rule

Pattern 4: Event Chaining (Event → Function → Event)

┌──────────────┐
│ IAM Policy   │
│  - Changed   │
└──────┬───────┘
       │ Event 1
       ▼
┌──────────────┐
│ Function 1   │
│ - Audit log  │
│ - Create     │
│   ticket     │
└──────┬───────┘
       │ Custom Event
       ▼
┌──────────────┐
│ Function 2   │
│ - Compliance │
│   check      │
└──────────────┘

Implementation: Functions can emit custom events using Events API
Use case: Complex workflows, approval chains

Event Filter Syntax Decision Tree

"How should I filter events?"
│
├─ Filter by event type only (all occurrences)?
│   └─ Simple filter
│       {
│         "eventType": "com.oraclecloud.computeapi.launchinstance"
│       }
│
├─ Filter by compartment or tag?
│   └─ Compartment filter
│       {
│         "eventType": "com.oraclecloud.computeapi.launchinstance",
│         "data": {
│           "compartmentName": "Prod"
│         }
│       }
│
├─ Filter by resource attribute (name pattern)?
│   └─ Attribute filter
│       {
│         "eventType": "com.oraclecloud.objectstorage.createobject",
│         "data": {
│           "resourceName": "*.pdf"
│         }
│       }
│
├─ Filter by multiple event types?
│   └─ Array of event types
│       {
│         "eventType": [
│           "com.oraclecloud.computeapi.launchinstance",
│           "com.oraclecloud.computeapi.terminateinstance"
│         ]
│       }
│
└─ Complex logic (AND/OR conditions)?
    └─ Use Cloud Events JSONPath
        {
          "eventType": "com.oraclecloud.computeapi.*",
          "data": {
            "freeformTags": {
              "Environment": "Prod"
            },
            "definedTags": {
              "Operations.CostCenter": "Engineering"
            }
          }
        }

Common Event Types by Service

Compute (com.oraclecloud.computeapi.*):
├─ launchinstance              # Instance created
├─ terminateinstance           # Instance deleted
├─ instanceaction              # Reboot, stop, start
├─ changeinstanceshape         # Shape changed (resize)
└─ attachvnic                  # Network interface attached

Database (com.oraclecloud.databaseservice.*):
├─ createautonomousdatabase    # ADB created
├─ stopautonomousdatabase      # ADB stopped
├─ startautonomousdatabase     # ADB started
├─ deleteautonomousdatabase    # ADB deleted
└─ updateautonomousdatabase    # ADB scaled/modified

Object Storage (com.oraclecloud.objectstorage.*):
├─ createobject                # File uploaded
├─ deleteobject                # File deleted
├─ updateobject                # File modified
└─ createbucket                # Bucket created

IAM (com.oraclecloud.identityControlPlane.*):
├─ CreateUser                  # User added
├─ UpdateUser                  # User modified
├─ CreatePolicy                # Policy created
├─ UpdatePolicy                # Policy changed
└─ DeleteUser                  # User removed

VCN (com.oraclecloud.virtualnetwork.*):
├─ CreateVcn                   # VCN created
├─ DeleteVcn                   # VCN deleted
├─ CreateSubnet                # Subnet created
├─ CreateSecurityList          # Security list created
└─ CreateNetworkSecurityGroup  # NSG created

Complete list: 100+ event types across all OCI services
Use: oci events event-type list --all

Action Types and Use Cases

Choosing Action Type:

• 1-10 events/minute → ONS (notifications)
• 10-1000 events/minute → FAAS (processing)
• >1000 events/minute → OSS (streaming buffer)