Back to Checks
aws

RDS instance event subscription is enabled for maintenance, configuration change, and failure categories

rds_instance_critical_event_subscription
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRdsEventSubscription

RDS event subscriptions for DB instances are assessed for coverage of the critical categories maintenance, configuration change, and failure.

The evaluation looks for enabled db-instance subscriptions and confirms these categories are included or that all events are selected.

Prowler logoProwlerprowler-provider-aws

Risk

Without these notifications, critical DB events go unseen, undermining availability and integrity. Missed outages, unexpected restarts, or silent parameter changes can delay response, prolong downtime, corrupt data flows, and leave misconfigurations unaddressed.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_critical_event_subscription

Recommendation

Establish and sustain RDS event subscriptions for db-instance that include maintenance, configuration change, and failure.

  • Deliver to monitored channels (ticketing/chat/paging)
  • Enforce least privilege on topics
  • Test alert delivery and runbooks
  • Periodically review coverage across Regions

Remediation

CLI

aws rds create-event-subscription --subscription-name <example_resource_name> --sns-topic-arn <sns-topic-arn> --source-type db-instance --event-categories "maintenance" "configuration change" "failure"

Terraform

# Terraform: RDS DB instance event subscription
resource "aws_db_event_subscription" "<example_resource_name>" {
  name            = "<example_resource_name>"
  sns_topic       = "<sns-topic-arn>"
  source_type     = "db-instance"                           # critical: DB instance events
  event_categories = ["maintenance", "configuration change", "failure"]  # critical: required categories
}

NativeIaC

# CloudFormation: RDS DB instance event subscription
Resources:
  <example_resource_name>:
    Type: AWS::RDS::EventSubscription
    Properties:
      SnsTopicArn: <sns-topic-arn>           # critical: SNS topic to receive notifications
      SourceType: db-instance                # critical: subscribe to DB instance events
      EventCategories:                       # critical: required categories for PASS
        - maintenance
        - configuration change
        - failure

Other

1Open the AWS Console and go to RDS
2In the left menu, select Event subscriptions > Create event subscription
3Send notifications to: select an existing SNS topic (<sns-topic-arn>)
4Source type: choose Instances
5Event categories: select Maintenance, Configuration change, and Failure
6Create the subscription

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_critical_event_subscription(Check):
    def execute(self):
        findings = []
        if rds_client.provider.scan_unused_services or rds_client.db_instances:
            for db_event in rds_client.db_event_subscriptions:
                report = Check_Report_AWS(metadata=self.metadata(), resource=db_event)
                report.status = "FAIL"
                report.status_extended = "RDS instance event categories of maintenance, configuration change, and failure are not subscribed."
                report.resource_id = rds_client.audited_account
                report.resource_arn = rds_client._get_rds_arn_template(db_event.region)
                report.region = db_event.region
                report.resource_tags = db_event.tags
                if db_event.source_type == "db-instance" and db_event.enabled:
                    report = Check_Report_AWS(
                        metadata=self.metadata(), resource=db_event
                    )
                    if db_event.event_list == [] or set(db_event.event_list) == {
                        "maintenance",
                        "configuration change",
                        "failure",
                    }:
                        report.status = "PASS"
                        report.status_extended = "RDS instance events are subscribed."
                    elif set(db_event.event_list) == {"maintenance"}:
                        report.status = "FAIL"
                        report.status_extended = "RDS instance event categories of configuration change and failure are not subscribed."
                    elif set(db_event.event_list) == {"configuration change"}:
                        report.status = "FAIL"
                        report.status_extended = "RDS instance event categories of maintenance and failure are not subscribed."
                    elif set(db_event.event_list) == {"failure"}:
                        report.status = "FAIL"
                        report.status_extended = "RDS instance event categories of maintenance and configuration change are not subscribed."
                    elif set(db_event.event_list) == {
                        "maintenance",
                        "configuration change",
                    }:
                        report.status = "FAIL"
                        report.status_extended = (
                            "RDS instance event category of failure is not subscribed."
                        )
                    elif set(db_event.event_list) == {
                        "maintenance",
                        "failure",
                    }:
                        report.status = "FAIL"
                        report.status_extended = "RDS instance event category of configuration change is not subscribed."
                    elif set(db_event.event_list) == {
                        "configuration change",
                        "failure",
                    }:
                        report.status = "FAIL"
                        report.status_extended = "RDS instance event category of maintenance is not subscribed."
                    else:
                        report.status = "FAIL"
                        report.status_extended = "RDS instance event categories of maintenance, configuration change, and failure are not subscribed."
                findings.append(report)

        return findings

References