Back to Checks
aws

RDS DB parameter group event subscription is enabled and subscribes to configuration change events or all categories

rds_instance_event_subscription_parameter_groups
Service: rdsSeverity: low
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRdsEventSubscription

RDS event subscriptions for DB parameter groups notify on configuration change events (or all categories) when the subscription is enabled

Prowler logoProwlerprowler-provider-aws

Risk

Missing alerts on parameter changes erodes visibility. Attackers or mistakes can lower TLS requirements, disable auditing, or relax auth, enabling data exposure (confidentiality), unauthorized writes (integrity), or outages from unsafe settings (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_event_subscription_parameter_groups

Recommendation

Create and maintain an SNS-backed event subscription for DB parameter groups that includes configuration change (or all) and keep it enabled.

  • Apply least privilege to SNS topics
  • Route to on-call/SIEM and test alerts
  • Enforce change control and monitoring across all Regions

Remediation

CLI

aws rds create-event-subscription --subscription-name <example_resource_name> --sns-topic-arn <sns-topic-arn> --source-type db-parameter-group --event-categories "configuration change" --enabled

Terraform

resource "aws_db_event_subscription" "<example_resource_name>" {
  name             = "<example_resource_name>"
  sns_topic        = "<sns-topic-arn>"
  source_type      = "db-parameter-group"          # Critical: target DB parameter groups
  event_categories = ["configuration change"]       # Critical: include configuration change events
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::RDS::EventSubscription
    Properties:
      SnsTopicArn: <sns-topic-arn>
      SourceType: db-parameter-group  # Critical: targets DB parameter group events
      EventCategories:
        - configuration change        # Critical: subscribes to configuration change events
      Enabled: true                   # Critical: subscription must be enabled

Other

1In the AWS Console, go to Amazon RDS > Event subscriptions
2Click Create event subscription
3Send notifications to: select an existing SNS topic
4Source type: Parameter groups
5Event categories: select Configuration change (or choose All event categories)
6Ensure Enabled is On
7Click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_event_subscription_parameter_groups(Check):
    """Ensure RDS parameter group event categories of configuration change are subscribed.

    This check is useful to ensure we receive notification of events that may affect the security, availability, and reliability of the RDS database instances associated with these parameter groups.
    """

    def execute(self):
        """Execute the RDS Parameter Group events are subscribed check.

        Iterates through the RDS DB event subscriptions and checks if the event source is DB parameter group and the event list is empty (so it's suscribe to all categories) or contains only configuration change.

        Returns:
            List[Check_Report_AWS]: A list of reports for each RDS DB event subscription.
        """
        findings = []
        if rds_client.provider.scan_unused_services or rds_client.db_instances:
            for db_event in rds_client.db_event_subscriptions:
                report = Check_Report_AWS(metadata=self.metadata(), resource={})
                report.status = "FAIL"
                report.status_extended = "RDS parameter group event categories of configuration change is not subscribed."
                report.resource_id = rds_client.audited_account
                report.resource_arn = rds_client._get_rds_arn_template(db_event.region)
                report.region = db_event.region
                if db_event.source_type == "db-parameter-group":
                    report = Check_Report_AWS(
                        metadata=self.metadata(), resource=db_event
                    )
                    if db_event.enabled and (
                        db_event.event_list == []
                        or db_event.event_list
                        == [
                            "configuration change",
                        ]
                    ):
                        report.status = "PASS"
                        report.status_extended = (
                            "RDS parameter group events are subscribed."
                        )
                    else:
                        report.status = "FAIL"
                        report.status_extended = "RDS parameter group event category of configuration change is not subscribed."
                findings.append(report)
        return findings

References