Back to Checks
aws

RDS instance has enhanced monitoring enabled

rds_instance_enhanced_monitoring_enabled
Service: rdsSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRdsDbInstance

RDS DB instances are evaluated for Enhanced Monitoring being enabled, which publishes real-time OS-level metrics (CPU, memory, disk, network) to CloudWatch Logs for each instance.

Prowler logoProwlerprowler-provider-aws

Risk

Without Enhanced Monitoring, you lack real-time OS telemetry, delaying detection of resource saturation and abnormal activity.

This raises MTTR and risks availability impacts (timeouts, failovers), reduces integrity assurance during incidents, and weakens forensic visibility.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_enhanced_monitoring_enabled

Recommendation

Enable Enhanced Monitoring on RDS, using a >0s collection interval aligned to workload and cost. Assign a least-privilege role for log delivery, and apply defense in depth by centralizing logs, setting alerts on key OS metrics, and defining retention to support incident response and trend analysis.

Remediation

CLI

aws rds modify-db-instance --db-instance-identifier <example_resource_id> --monitoring-interval 60 --monitoring-role-arn <monitoring_role_arn>

Terraform

# Enable Enhanced Monitoring on an existing RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  # ...existing required configuration...
  monitoring_role_arn = "<monitoring_role_arn>"  # CRITICAL: Role for publishing OS metrics
  monitoring_interval = 60                        # CRITICAL: >0 enables Enhanced Monitoring (seconds)
}

NativeIaC

# CloudFormation: enable Enhanced Monitoring on an existing RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      MonitoringRoleArn: <monitoring_role_arn>   # CRITICAL: IAM role RDS uses to publish OS metrics to CloudWatch Logs
      MonitoringInterval: 60                     # CRITICAL: >0 enables Enhanced Monitoring (seconds)

Other

1In the AWS Console, go to RDS > Databases and select the DB instance
2Click Modify
3In Monitoring, check Enable Enhanced Monitoring and set Granularity to any non-zero value (e.g., 60 seconds)
4Set Monitoring role to Default (creates rds-monitoring-role) or select an existing role
5Click Continue, then Modify DB instance to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_enhanced_monitoring_enabled(Check):
    def execute(self):
        findings = []
        for db_instance in rds_client.db_instances.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=db_instance)
            if db_instance.enhanced_monitoring_arn:
                report.status = "PASS"
                report.status_extended = (
                    f"RDS Instance {db_instance.id} has enhanced monitoring enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = f"RDS Instance {db_instance.id} does not have enhanced monitoring enabled."

            findings.append(report)

        return findings

References