1. Login to AWS Console: Go to the AWS Management Console (https://console.aws.amazon.com/) and log in with your credentials.
2. Navigate to RDS Service: From the AWS Management Console, navigate to the Amazon RDS service by clicking on the “Services” dropdown menu at the top left corner, then selecting “RDS” under the Database category.
3. Select the RDS Instance: In the Amazon RDS dashboard, locate the RDS instance for which you want to enable Security Groups Events Subscriptions and click on its name to open its details.
4. Enable Event Subscriptions: In the RDS instance details page, navigate to the “Event Subscriptions” section in the left-hand menu and click on it.
5. Create Event Subscription: Click on the “Create Event Subscription” button to create a new event subscription for the RDS instance.
6. Configure Event Subscription: In the “Create Event Subscription” wizard, provide the necessary details such as the name of the event subscription, the source type (RDS), the source identifier (select the RDS instance), and the event categories.
7. Enable Security Groups Events: Under the “Event Categories” section, make sure to select the “Configuration change” event category, as Security Groups Events fall under this category.
8. Specify SNS Topic (Optional): If you want to receive notifications for these events, you can specify an existing SNS topic or create a new one to subscribe to.
9. Review and Create: Review the details of the event subscription, ensure that Security Groups Events are included, and click on the “Create” button to save the changes.
10. Verify Subscription: Once the event subscription is created, verify that Security Groups Events are now enabled for the RDS instance by checking the event subscription details.

​

1. Enable Event Subscriptions for RDS DB instances: Run the following AWS CLI command to enable event subscriptions for the RDS DB instance:
   aws rds create-event-subscription --subscription-name my-rds-event-subscription --sns-topic-arn arn:aws:sns:us-east-1:123456789012:my-sns-topic --source-type db-instance --source-ids my-rds-db-instance --event-categories availability,backup,configuration-change,creation,deletion,failover,failure,low-storage,read-replica,recovery,restoration,success
   
   • Replace my-rds-event-subscription with your desired subscription name.
   • Replace arn:aws:sns:us-east-1:123456789012:my-sns-topic with the ARN of the SNS topic you want to use for notifications.
   • Replace my-rds-db-instance with the identifier of your RDS DB instance.
2. Verify the Event Subscription: You can verify the event subscription by running the following command:
   aws rds describe-event-subscriptions
   
   Ensure that the event subscription you created is listed and active.

1. Install the AWS SDK for Python (Boto3) if you haven’t already. You can install it using pip:

pip install boto3

2. Use the following Python script to enable Security Groups Events Subscriptions for the RDS instance:

import boto3

def enable_security_group_events_subscription(rds_instance_identifier):
    client = boto3.client('rds')
    
    response = client.modify_event_subscription(
        SubscriptionName='security_group_events_subscription',
        Enabled=True,
        EventCategories=[
            'configuration change',
        ],
        SourceType='db-instance',
        SourceIds=[
            rds_instance_identifier,
        ]
    )
    
    print("Security Groups Events Subscriptions enabled successfully")

# Replace 'rds_instance_identifier' with the actual identifier of your RDS instance
enable_security_group_events_subscription('rds_instance_identifier')

3. Replace 'rds_instance_identifier' in the script with the actual identifier of your RDS instance. You can find the RDS instance identifier in the AWS Management Console under the RDS service.
4. Run the Python script. This will enable Security Groups Events Subscriptions for the specified RDS instance.

# Existing legacy RDS DB Security Group
resource "aws_db_security_group" "DB_SECURITY_GROUP" {
  name        = "DB_SECURITY_GROUP_NAME" # replace with the DB security group name ({{asset_label}})
  description = "DB security group for legacy EC2-Classic"

  # ...ingress rules...
}

# SNS topic that will receive RDS security group event notifications
# If you already have a topic, reference it via data "aws_sns_topic" instead.
resource "aws_sns_topic" "rds_security_events" {
  name = "rds-security-events-topic"
}

# (Optional but usually required) subscription so someone actually receives the notifications.
# Replace EMAIL_ADDRESS with the real destination; confirmation by the recipient is still required.
resource "aws_sns_topic_subscription" "rds_security_events_email" {
  topic_arn = aws_sns_topic.rds_security_events.arn
  protocol  = "email"
  endpoint  = "EMAIL_ADDRESS" # e.g. "user@example.com"
}

# RDS event subscription for DB Security Group "security-group" events
resource "aws_db_event_subscription" "db_security_group_events" {
  name      = "${aws_db_security_group.DB_SECURITY_GROUP.name}-security-events-subscription"
  sns_topic = aws_sns_topic.rds_security_events.arn

  source_type = "db-security-group"
  source_ids  = [aws_db_security_group.DB_SECURITY_GROUP.name]

  event_categories = ["security-group"]
  enabled          = true
}

• + creation of aws_sns_topic.rds_security_events (if new),
• + creation of aws_sns_topic_subscription.rds_security_events_email (if included),
• + creation of aws_db_event_subscription.db_security_group_events, and no changes to existing RDS DB security groups other than being referenced by the subscription.