Back to Checks
aws

Directory Service directory has SNS notifications enabled

directoryservice_directory_monitor_notifications
Service: directoryserviceSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:Other

AWS Directory Service directories are associated with Amazon SNS topics to send status change notifications (e.g., Active Impaired).

The evaluation looks for directories that have SNS event topics configured for monitoring alerts.

Prowler logoProwlerprowler-provider-aws

Risk

Missing directory notifications reduces visibility into health changes, causing delayed response to Impaired states. This threatens availability of authentication, Kerberos/LDAP lookups, and domain joins; increases MTTR; and can enable silent replication or trust failures that impact integrity across dependent workloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks directoryservice_directory_monitor_notifications

Recommendation

Configure AWS Directory Service to publish directory status changes to an SNS topic, and subscribe your operations channels for timely alerts.

Apply least privilege on topic permissions, integrate alerts with incident response, and use defense in depth by pairing notifications with logs and dashboards.

Remediation

CLI

aws ds register-event-topic --directory-id <DIRECTORY_ID> --topic-name <SNS_TOPIC_NAME>

Other

1Open AWS Console > Directory Service > Directories and select your directory
2Go to the Maintenance or Monitoring/Notifications section
3Click Actions > Create notification (or Set up notifications)
4Select an existing SNS topic (or create one) and Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.directoryservice.directoryservice_client import (
    directoryservice_client,
)


class directoryservice_directory_monitor_notifications(Check):
    def execute(self):
        findings = []
        for directory in directoryservice_client.directories.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=directory)
            if directory.event_topics:
                report.status = "PASS"
                report.status_extended = (
                    f"Directory Service {directory.id} have SNS messaging enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Directory Service {directory.id} have SNS messaging disabled."
                )

            findings.append(report)

        return findings

References