All checks
Low
Existing RDS event notification subscriptions should be configured for critical cluster events
Checks that each RDS event subscription for DB clusters covers the maintenance and failure event categories, so a pending cluster maintenance action or a cluster failure reaches its SNS topic. A pass does not show that the subscription is enabled, or that it covers every cluster rather than named ones.
- service
- RDS
- severity
- Low
- scope
- evaluated in every region
How to fix it
- Overwrites existing settings: The CLI and Terraform routes replace the subscription's whole category list, so add any other categories it already uses.
In the console
RDS → Event subscriptions → the subscription → Edit → Source
- Clusters to include
- All clusters
- Event categories to include
- All event categories, or specific ones including maintenance and failure
With the AWS CLI
aws rds modify-event-subscription --subscription-name <subscription-name> --event-categories maintenance failure --region <region>With Terraform
resource "aws_db_event_subscription" "this" {
sns_topic = var.sns_topic_arn
source_type = "db-cluster"
event_categories = ["maintenance", "failure"]
}See which of your accounts this check is failing on.
Book a live scan