Extend IAM Action Control to Protect Event Notification Distribution List in Child Accounts

SAP operates a centralized Hyperscaler Event Monitoring platform that collects IBM Cloud service health events from all member accounts into a single dashboard. 

Today, child account administrators can modify or delete Event Notification and Account Distribution List Notification resources used for event collection. If these resources are removed, event collection from the affected account is lost. 

Extend IBM Cloud Enterprise IAM Action Controls to support Event Notification and Account Distribution List Notification resources, allowing enterprise administrators to centrally protect designated notification configurations from modification or deletion in member accounts. Protected resources should be identifiable by resource ID or name and enforced across the enterprise hierarchy. Based on the existing IAM Action Control framework, this enhancement would ensure reliable, centralized event monitoring regardless of individual account administrator actions. 

------------- Details as per What/Why/Who structure ---------------

What ---

Problem : When member/child accounts are onboarded into the SAP IBM Enterprise account, the respective LOB user acts as admin of that account. With those admin rights, they are able to modify or delete the Event Notification instance that our team configures to collect events from the account. If the instance is deleted, we lose the ability to collect that account's events entirely. 

Use case : Our team operates an internal tool, Hyperscaler Event Monitoring, which aggregates service health events from all cloud providers into a single unified dashboard — including IBM Cloud account notifications such as planned maintenance, announcements, security bulletins, and incidents. LOB users consume these events centrally instead of logging into each cloud provider individually. Reliable, uninterrupted event collection from every member/child account is therefore essential.

Proposed solution : Extend the existing IAM Action Control capability in the IBM Enterprise account — already delivered based on our earlier business use case — to cover Event Notification / IBM Account Distribution List Notification resources. This would allow us to define the restriction centrally from the Enterprise account and enforce it within each member/child account, preventing the respective account admins (LOB users) from modifying or deleting the Event Notification / Account Distribution List Notification resources in their accounts. Protected resources would be identified by resource name or ID per member/child account.

Why---

Client value proposition : Guaranteed integrity and continuity of event collection across all member/child accounts, independent of individual account admin actions.

Business outcomes :No loss of service health events; reduced remediation effort and automation overhead; consistent governance of notification configuration across the enterprise hierarchy.

Alternative solutions : From an IBM Cloud offered-services perspective, there is no alternative mechanism that prevents an account admin from modifying or deleting these resources. 

SAP specific

• SAP defined priority: High (business requirement)
• Functional scope: OPERATIONAL-SIMPLIFICATION / SECURITY-HARDENING
• Regional scope: ALL ( since its global )
• Applicable for existing or new deployments: EXISTING-AND-NEW

ETA expectation: As soon as possible — the IAM Action Control framework already exists in the Enterprise account; the request is to extend it to Account Distribution List Notification / Event Notification resources.

• If not delivered: Continued risk of unrecoverable event loss whenever a member account admin modifies or deletes the notification configuration, undermining our centralized monitoring for IBM Cloud accounts.

Who---

Target market / segments :SAP Hyperscaler operations (internal), on behalf of SAP RISE customers hosted on IBM Cloud