All checks
Low
Existing RDS event notification subscriptions should be configured for critical database instance events
Checks that each RDS event subscription for DB instances covers the maintenance, configuration change and failure event categories, so a pending maintenance action, a settings change or an instance failure reaches its SNS topic. A pass does not show that the subscription is enabled, or that it covers every instance rather than named ones.
- service
- RDS
- severity
- Low
- scope
- evaluated in every region
How to fix it
- Overwrites existing settings: The CLI and Terraform routes replace the subscription's whole category list, so add any other categories it already uses.
In the console
RDS → Event subscriptions → the subscription → Edit → Source
- Instances to include
- All instances
- Event categories to include
- All event categories, or specific ones including maintenance, configuration change and failure
With the AWS CLI
aws rds modify-event-subscription --subscription-name <subscription-name> --event-categories maintenance "configuration change" failure --region <region>With Terraform
resource "aws_db_event_subscription" "this" {
sns_topic = var.sns_topic_arn
source_type = "db-instance"
event_categories = ["maintenance", "configuration change", "failure"]
}See which of your accounts this check is failing on.
Book a live scan