All checks
Low
An RDS event notifications subscription should be configured for critical database parameter group events
Checks that a Region with RDS event subscriptions has an active one for DB parameter groups covering configuration change, so an edit that can change logging or TLS enforcement on every database using a group is announced. A Region with no subscriptions at all passes, so green can mean nothing is configured; one scoped to named groups passes too.
- service
- RDS
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
RDS → Event subscriptions → Create event subscription → Source type → Parameter groups
- Send notifications to
- New email topic, or the Amazon Resource Name (ARN) of an existing SNS topic
- Parameter groups to include
- All parameter groups
- Event categories to include
- All event categories (configuration change is the only one)
With the AWS CLI
aws rds create-event-subscription --subscription-name <subscription-name> --sns-topic-arn <sns-topic-arn> --source-type db-parameter-group --event-categories "configuration change" --region <region>With Terraform
resource "aws_db_event_subscription" "this" {
sns_topic = var.sns_topic_arn
source_type = "db-parameter-group"
event_categories = ["configuration change"]
}See which of your accounts this check is failing on.
Book a live scan