Back to Checks
aws

RDS cluster event subscription is enabled for maintenance and failure categories

rds_cluster_critical_event_subscription
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRdsEventSubscription

RDS event subscriptions for the db-cluster source type are enabled and cover critical cluster event categories: maintenance and failure (or all cluster events).

Prowler logoProwlerprowler-provider-aws

Risk

Without notifications for cluster maintenance and failure, teams may miss engine updates, failovers, or node crashes, impacting availability and increasing MTTR. Prolonged degraded states can cause replication lag and potential data integrity issues, hindering timely containment.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_cluster_critical_event_subscription

Recommendation

Enable event subscriptions for RDS clusters that include maintenance and failure, delivered via SNS to monitored channels.

  • Enforce least privilege on topics
  • Separate topics per environment
  • Integrate with on-call/IR playbooks and test alerts
  • Add multiple recipients and escalation for defense in depth

Remediation

CLI

aws rds create-event-subscription --subscription-name <example_resource_name> --sns-topic-arn <example_resource_arn> --source-type db-cluster --event-categories maintenance failure --enabled

Terraform

resource "aws_db_event_subscription" "<example_resource_name>" {
  name            = "<example_resource_name>"
  sns_topic       = "<example_resource_arn>"           # Critical: SNS topic ARN
  source_type     = "db-cluster"                        # Critical: Scope to clusters
  event_categories = ["maintenance", "failure"]        # Critical: Required categories
  enabled         = true                                  # Critical: Must be enabled
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::RDS::EventSubscription
    Properties:
      SnsTopicArn: <example_resource_arn>       # Critical: SNS topic to receive notifications
      SourceType: db-cluster                    # Critical: Scope to DB clusters
      EventCategories:                          # Critical: Subscribe to required categories only
        - maintenance
        - failure
      Enabled: true                             # Critical: Must be enabled to pass

Other

1In the AWS Console, go to RDS > Event subscriptions > Create event subscription
2Name: enter <example_resource_name>
3Send notifications to: Choose existing Amazon SNS ARN and select <example_resource_arn>
4Source type: select Clusters
5Event categories: select only Maintenance and Failure (unselect others)
6Ensure Enabled is on
7Click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_cluster_critical_event_subscription(Check):
    def execute(self):
        findings = []
        if rds_client.provider.scan_unused_services or rds_client.db_clusters:
            for db_event in rds_client.db_event_subscriptions:
                report = Check_Report_AWS(metadata=self.metadata(), resource=db_event)
                report.status = "FAIL"
                report.status_extended = "RDS cluster event categories of maintenance and failure are not subscribed."
                report.resource_id = rds_client.audited_account
                report.resource_arn = rds_client._get_rds_arn_template(db_event.region)
                if db_event.source_type == "db-cluster" and db_event.enabled:
                    if db_event.event_list == [] or set(db_event.event_list) == {
                        "maintenance",
                        "failure",
                    }:
                        report = Check_Report_AWS(
                            metadata=self.metadata(), resource=db_event
                        )
                        report.status = "PASS"
                        report.status_extended = "RDS cluster events are subscribed."

                    elif db_event.event_list == ["maintenance"]:
                        report = Check_Report_AWS(
                            metadata=self.metadata(), resource=db_event
                        )
                        report.status = "FAIL"
                        report.status_extended = (
                            "RDS cluster event category of failure is not subscribed."
                        )

                    elif db_event.event_list == ["failure"]:
                        report = Check_Report_AWS(
                            metadata=self.metadata(), resource=db_event
                        )
                        report.status = "FAIL"
                        report.status_extended = "RDS cluster event category of maintenance is not subscribed."

                findings.append(report)

        return findings

References