All checks
Low
An RDS event notifications subscription should be configured for critical database security group events
Checks that a Region with RDS event subscriptions has an active one for DB security groups covering configuration change and failure. A Region with no subscriptions at all passes, so green can mean nothing is configured. DB security groups are an EC2-Classic resource, so in a VPC-only account this subscription stays quiet; VPC security groups are covered by other controls.
- service
- RDS
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
RDS → Event subscriptions → Create event subscription → Source type → Security groups
- Send notifications to
- New email topic, or the Amazon Resource Name (ARN) of an existing SNS topic
- Security groups to include
- All security groups
- Event categories to include
- All event categories (configuration change and failure are the only two)
With the AWS CLI
aws rds create-event-subscription --subscription-name <subscription-name> --sns-topic-arn <sns-topic-arn> --source-type db-security-group --event-categories "configuration change" failure --region <region>With Terraform
resource "aws_db_event_subscription" "this" {
sns_topic = var.sns_topic_arn
source_type = "db-security-group"
event_categories = ["configuration change", "failure"]
}See which of your accounts this check is failing on.
Book a live scan