Event Notifications Should Be Enabled

More Info:

Your AWS RDS resources should have event notifications enabled in order to be notified when an event occurs for a given database instance, database snapshot, database security group or database parameter group

Risk Level

Low

Address

Reliability, Operational Maturity

Compliance Standards

CBP

Remediation

Using Console

To remediate the misconfiguration of Event Notifications not being enabled for an AWS RDS instance using the AWS Management Console, follow these step-by-step instructions:

Log in to the AWS Management Console: Go to https://aws.amazon.com/ and log in using your credentials.
Navigate to the RDS Console: Once logged in, navigate to the Amazon RDS console by clicking on the “Services” dropdown menu at the top of the page and selecting “RDS” under the Database category.
Select the RDS Instance: In the RDS dashboard, locate and select the RDS instance for which you want to enable Event Notifications.
Enable Event Notifications: In the RDS instance details page, scroll down to the “Event subscriptions” section and click on the “Modify” button.
Configure Event Notifications: In the Modify RDS instance page, scroll down to the “Event subscriptions” section and click on the “Add event subscription” button.
Set up Event Subscription: In the Add event subscription dialog box, configure the following settings:
- Subscription name: Enter a name for the event subscription.
- SNS topic: Select an existing SNS topic or create a new one to receive the event notifications.
- Event categories: Select the event categories for which you want to receive notifications. For example, you can choose “All” to receive notifications for all event categories.
- Severity: Select the severity level of events for which you want to receive notifications.
- Enable: Make sure the “Enable” checkbox is checked to activate the event subscription.
Save Changes: Click on the “Add subscription” button to save the event subscription settings.
Verify Configuration: Once the event subscription is added, verify that the Event Notifications are now enabled for the RDS instance by checking the Event Subscriptions section in the RDS instance details page.

By following these steps, you have successfully enabled Event Notifications for the AWS RDS instance using the AWS Management Console. This will ensure that you receive notifications for important events related to the RDS instance.

Using CLI

To remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using AWS CLI, you can follow these steps:

List Current Event Subscriptions: First, you need to list the current event subscriptions to check if there are any existing subscriptions. You can use the following AWS CLI command:
aws rds describe-event-subscriptions
Enable Event Notifications: If there are no existing event subscriptions or if the required event notification is not enabled, you can enable event notifications for RDS by creating a new event subscription. Use the following AWS CLI command to create a new event subscription:
aws rds create-event-subscription --subscription-name <subscription-name> --sns-topic-arn <sns-topic-arn> --source-type db-instance --source-ids <rds-instance-identifier> --event-categories <event-category>
- Replace <subscription-name> with a unique name for the event subscription.
- Replace <sns-topic-arn> with the ARN of the SNS topic to which you want to send the notifications.
- Replace <rds-instance-identifier> with the identifier of the RDS instance for which you want to enable event notifications.
- Replace <event-category> with the specific event categories you want to receive notifications for (e.g., “configuration change”, “failover”, “backup”, etc.).
Verify Event Subscription: After creating the event subscription, you can verify if the event notifications are successfully enabled by listing the event subscriptions again using the command in step 1.

By following these steps, you can remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using AWS CLI.

Using Python

To remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using Python, you can follow these steps:

Import the necessary libraries:

import boto3

Create an AWS RDS client:

rds_client = boto3.client('rds', region_name='YOUR_REGION')

Enable Event Notifications for the specific RDS instance:

db_instance_identifier = 'YOUR_DB_INSTANCE_IDENTIFIER'
sns_topic_arn = 'YOUR_SNS_TOPIC_ARN'

rds_client.modify_db_instance(
    DBInstanceIdentifier=db_instance_identifier,
    EnableEventSubscription=True,
    EventCategories=['availability', 'backup', 'configuration change', 'creation', 'deletion', 'failover', 'failure', 'low storage', 'maintenance', 'notification', 'recovery', 'restoration'],
    SnsTopicArn=sns_topic_arn
)

Make sure to replace 'YOUR_REGION', 'YOUR_DB_INSTANCE_IDENTIFIER', and 'YOUR_SNS_TOPIC_ARN' with your actual AWS region, RDS instance identifier, and SNS topic ARN respectively.

Verify that Event Notifications have been successfully enabled by checking the RDS instance details or the CloudWatch Events console.

By following these steps, you can remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using Python.

Triage and Remediation

Remediation

Remediation

Using Console

Below are concise, step‑by‑step instructions to enable RDS event notifications using the AWS Management Console.

Sign in to the AWS Management Console.
Go to Amazon SNS:
- In the search bar, type SNS and open Simple Notification Service.
Create a topic (if you don’t already have one):
- In the left menu, select Topics → Create topic.
- Choose Standard topic.
- Enter a Name (e.g., rds-event-notifications).
- Leave other settings default unless you have specific requirements.
- Click Create topic.
Create a subscription to that topic:
- Open the topic you just created.
- Click Create subscription.
- Protocol: choose how you want to receive notifications (e.g., Email).
- Endpoint: enter your email address (or endpoint).
- Click Create subscription.
- Confirm the subscription if needed (e.g., click confirmation link in email).

2. Create an RDS Event Subscription

In the console, go to Amazon RDS:
- In the search bar, type RDS and open RDS.
In the left navigation pane, click Event subscriptions.
Click Create event subscription.
Configure the subscription:
- Name: e.g., rds-instance-events.
- Target (SNS topic): select the SNS topic you created (e.g., rds-event-notifications).
Choose Source type based on what you want to monitor:
- Common options: DB instance, DB cluster, DB parameter group, etc.
Select Event categories:
- You can select broad options like Availability, Backup, Configuration change, Failure, Notification, Restoration, etc.
- For compliance, it’s typical to include at least: Availability, Configuration change, and Failure.
Select the Source:
- Either:
  - All instances (or all sources of that type), or
  - Specific DB instances / clusters you want to monitor.
Ensure Enabled is checked so the subscription is active immediately.
Click Create.

3. Validate Notifications

Trigger or wait for an event (e.g., modify a DB instance configuration or restart the instance).
Confirm you receive a notification via your chosen SNS subscription (email, etc.).

This completes enabling RDS event notifications via the AWS Console.

Using CLI

Below are step‑by‑step AWS CLI commands to enable RDS Event Notifications using Amazon SNS.Assumptions:

You have AWS CLI configured with proper permissions.
You want email notifications (most common).

aws sns create-topic \
  --name rds-event-notifications

Note the TopicArn from the output (e.g. arn:aws:sns:us-east-1:123456789012:rds-event-notifications).

aws sns subscribe \
  --topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --protocol email \
  --notification-endpoint you@example.com

Then:

Check your email.
Confirm the subscription by clicking the link.

3. (Optional) Verify Subscription

aws sns list-subscriptions-by-topic \
  --topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications

Ensure SubscriptionArn is not PendingConfirmation.

4. Create an RDS Event Subscription

Choose:

--source-type = db-instance | db-cluster | db-parameter-group | etc.
--event-categories list, such as: availability, backup, creation, deletion, failover, failure, maintenance, notification, restoration.

Example for all DB instances in the region:

aws rds create-event-subscription \
  --subscription-name rds-events-subscription \
  --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --source-type db-instance \
  --event-categories availability backup creation deletion failover failure maintenance notification restoration \
  --enabled

To target only specific instances, add --source-ids:

aws rds create-event-subscription \
  --subscription-name rds-events-subscription \
  --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --source-type db-instance \
  --source-ids mydbinstance1 mydbinstance2 \
  --event-categories availability backup failure \
  --enabled

5. Confirm Subscription Status

aws rds describe-event-subscriptions \
  --subscription-name rds-events-subscription

Check that:

Status is active
Enabled is true

That enables RDS event notifications via SNS using the AWS CLI.

Using Python

Below is a straightforward way to enable RDS event notifications using Python (boto3).

1. Prerequisites

Install boto3:
pip install boto3
Configure AWS credentials with permission to:
- rds:CreateEventSubscription
- rds:ModifyEventSubscription
- rds:DescribeDBInstances
- sns:CreateTopic
- sns:Subscribe
- sns:SetTopicAttributes
- iam:CreateRole / iam:AttachRolePolicy (if needed)
Decide:
- Which RDS instances/clusters you want notifications for.
- Which email(s) or HTTPS endpoint will receive notifications.

import boto3

region = "us-east-1"  # change as needed
sns = boto3.client("sns", region_name=region)

topic_name = "rds-event-notifications"
response = sns.create_topic(Name=topic_name)
topic_arn = response["TopicArn"]
print("SNS topic:", topic_arn)

email_address = "you@example.com"  # change

subscribe_resp = sns.subscribe(
    TopicArn=topic_arn,
    Protocol="email",
    Endpoint=email_address,
)
print("Subscription ARN (pending confirmation):", subscribe_resp["SubscriptionArn"])

Then:

Check the email inbox and confirm the subscription from AWS.

Often not needed if default permissions are fine, but to be explicit:

import json

account_id = boto3.client("sts").get_caller_identity()["Account"]

topic_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowRDSPublish",
            "Effect": "Allow",
            "Principal": {"Service": "rds.amazonaws.com"},
            "Action": "SNS:Publish",
            "Resource": topic_arn
        }
    ]
}

sns.set_topic_attributes(
    TopicArn=topic_arn,
    AttributeName="Policy",
    AttributeValue=json.dumps(topic_policy),
)

5. Enable RDS Event Notifications via Event Subscription

You usually:

Select event categories (e.g., availability, configuration change, backup).
Select SourceType (e.g., db-instance, db-cluster, db-parameter-group).
Select specific DB identifiers, or leave empty to cover all in the region.

Example: Subscribe all DB instances in the region to common events:

rds = boto3.client("rds", region_name=region)

subscription_name = "rds-instance-events-subscription"

# Choose event categories; common ones:
event_categories = [
    "availability",
    "configuration change",
    "deletion",
    "failover",
    "failure",
    "notification",
    "maintenance",
    "recovery",
    "restoration",
    "backup",
]

# Get all DB instance identifiers (optional – you can specify a subset)
db_instances = rds.describe_db_instances()["DBInstances"]
source_ids = [db["DBInstanceIdentifier"] for db in db_instances]

try:
    # Try creating a new event subscription
    create_resp = rds.create_event_subscription(
        SubscriptionName=subscription_name,
        SnsTopicArn=topic_arn,
        SourceType="db-instance",
        EventCategories=event_categories,
        SourceIds=source_ids,  # omit this to apply to all db-instance events in account/region
        Enabled=True,
    )
    print("Created event subscription:", create_resp["EventSubscription"]["CustSubscriptionId"])

except rds.exceptions.EventSubscriptionQuotaExceededFault:
    # If already exists or quota issues, you may need to modify instead
    print("Subscription exists or quota exceeded; modifying existing subscription...")
    modify_resp = rds.modify_event_subscription(
        SubscriptionName=subscription_name,
        SnsTopicArn=topic_arn,
        SourceType="db-instance",
        EventCategories=event_categories,
        SourceIds=source_ids,
        Enabled=True,
    )
    print("Modified event subscription:", modify_resp["EventSubscription"]["CustSubscriptionId"])

6. Verify the Subscription

subs = rds.describe_event_subscriptions(
    Filters=[{"Name": "cust-subscription-id", "Values": [subscription_name]}]
)
print(subs["EventSubscriptionsList"])

Check that:

Enabled is True.
Status becomes active.
SnsTopicArn is correct.
EventCategoriesList and SourceType match your needs.

7. Test

Trigger a test scenario, for example:

Modify an RDS instance parameter or configuration.
Perform a manual snapshot or reboot. You should receive an email notification via SNS for the corresponding RDS event.

This completes enabling RDS Event Notifications via Python.

Using Terraform

# SNS topic to receive RDS events
resource "aws_sns_topic" "rds_events" {
  name = "rds-events-topic"
}

# (Optional) subscription to send notifications (e.g., to email)
resource "aws_sns_topic_subscription" "rds_events_email" {
  topic_arn = aws_sns_topic.rds_events.arn
  protocol  = "email"
  endpoint  = "YOUR_NOTIFICATION_EMAIL@example.com" # replace with your email
}

# RDS Event Subscription (enables event notifications)
resource "aws_db_event_subscription" "rds_event_subscription" {
  name      = "rds-events-subscription"
  sns_topic = aws_sns_topic.rds_events.arn

  # Adjust source type and categories as needed: "db-instance", "db-parameter-group", etc.
  source_type = "db-instance"

  # Example event categories; extend/modify to your requirements
  event_categories = [
    "availability",
    "backup",
    "configuration change",
    "creation",
    "deletion",
    "failover",
    "failure",
    "maintenance",
    "notification",
    "recovery",
    "restoration",
  ]

  # Optionally scope to specific instances; omit to cover all in the account/region
  # source_ids = [aws_db_instance.MY_DB.id]

  enabled = true

  tags = {
    Name = "rds-events-subscription"
  }
}

This does not replace your existing RDS instances; it only creates a new event subscription and SNS topic.For verification, terraform plan should show + (create) for aws_sns_topic.rds_events, optionally aws_sns_topic_subscription.rds_events_email, and aws_db_event_subscription.rds_event_subscription with enabled = true and your chosen event_categories/source_type.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Event Notifications Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using Console

Using CLI

Using Python

Triage and Remediation

Remediation

2. Create an RDS Event Subscription

3. Validate Notifications

3. (Optional) Verify Subscription

4. Create an RDS Event Subscription

5. Confirm Subscription Status

1. Prerequisites

5. Enable RDS Event Notifications via Event Subscription

6. Verify the Subscription

7. Test

​More Info:

​Risk Level

​Address

​Compliance Standards

​Remediation

​Using Console

​Using CLI

​Using Python

​Triage and Remediation

​Remediation

​1. Create or Identify an SNS Topic

​2. Create an RDS Event Subscription

​3. Validate Notifications

​1. Create an SNS Topic

​2. Subscribe Your Email to the Topic

​3. (Optional) Verify Subscription

​4. Create an RDS Event Subscription

​5. Confirm Subscription Status

​1. Prerequisites

​2. Create or Reuse an SNS Topic

​3. Subscribe Email (or Other Endpoint) to SNS Topic

​4. Allow RDS to Publish to the SNS Topic (Optional Explicit Policy)

​5. Enable RDS Event Notifications via Event Subscription

​6. Verify the Subscription

​7. Test

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using Console

Using CLI

Using Python

Triage and Remediation

Remediation

1. Create or Identify an SNS Topic

2. Create an RDS Event Subscription

3. Validate Notifications

1. Create an SNS Topic

2. Subscribe Your Email to the Topic

3. (Optional) Verify Subscription

4. Create an RDS Event Subscription

5. Confirm Subscription Status

1. Prerequisites

2. Create or Reuse an SNS Topic

3. Subscribe Email (or Other Endpoint) to SNS Topic

4. Allow RDS to Publish to the SNS Topic (Optional Explicit Policy)

5. Enable RDS Event Notifications via Event Subscription

6. Verify the Subscription

7. Test