Back to Checks
aws

RDS event subscription for DB security groups is enabled for configuration change and failure events

rds_instance_event_subscription_security_groups
Service: rdsSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsRdsEventSubscription

RDS event subscriptions are evaluated for database security group events. The check expects an enabled subscription with source type db-security-group that includes the configuration change and failure event categories.

Prowler logoProwlerprowler-provider-aws

Risk

Missing alerts on security group changes or failures reduces visibility and slows response. Undetected rule changes can expose databases, while unnoticed failures prolong outages, impacting confidentiality and availability through unauthorized access or service disruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks rds_instance_event_subscription_security_groups

Recommendation

Create or update an RDS event subscription for source type db-security-group including configuration change and failure. Route alerts to monitored channels, restrict topic access (least privilege), integrate with incident response, and enforce change control and separation of duties for security group updates.

Remediation

CLI

aws rds create-event-subscription --subscription-name <SUBSCRIPTION_NAME> --sns-topic-arn <SNS_TOPIC_ARN> --source-type db-security-group --event-categories "configuration change" "failure"

Terraform

resource "aws_db_event_subscription" "<example_resource_name>" {
  name            = "<example_resource_name>"
  sns_topic       = "<SNS_TOPIC_ARN>"
  source_type     = "db-security-group"        # Critical: DB security group events
  event_categories = ["configuration change", "failure"]  # Critical: required categories
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::RDS::EventSubscription
    Properties:
      SnsTopicArn: <SNS_TOPIC_ARN>
      SourceType: db-security-group  # Critical: subscribe to DB security group events
      EventCategories:               # Critical: required categories
        - configuration change
        - failure

Other

1Open the AWS Console > RDS > Event subscriptions
2Click Create event subscription
3Set Name to <SUBSCRIPTION_NAME> and select an existing SNS topic
4Set Source type to Security group
5Under Event categories, select Configuration change and Failure
6Leave Targets as All security groups (no specific IDs)
7Ensure Enabled is On and click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.rds.rds_client import rds_client


class rds_instance_event_subscription_security_groups(Check):
    def execute(self):
        findings = []
        if rds_client.provider.scan_unused_services or rds_client.db_instances:
            for db_event in rds_client.db_event_subscriptions:
                report = Check_Report_AWS(metadata=self.metadata(), resource=db_event)
                report.status = "FAIL"
                report.status_extended = "RDS security group event categories of configuration change and failure are not subscribed."
                report.resource_id = rds_client.audited_account
                report.resource_arn = rds_client._get_rds_arn_template(db_event.region)
                report.resource_tags = []
                if db_event.source_type == "db-security-group" and db_event.enabled:
                    report = Check_Report_AWS(
                        metadata=self.metadata(), resource=db_event
                    )
                    if db_event.event_list == [] or set(db_event.event_list) == {
                        "failure",
                        "configuration change",
                    }:
                        report.status = "PASS"
                        report.status_extended = (
                            "RDS security group events are subscribed."
                        )

                    elif db_event.event_list == ["configuration change"]:
                        report.status = "FAIL"
                        report.status_extended = "RDS security group event category of failure is not subscribed."

                    elif db_event.event_list == ["failure"]:
                        report.status = "FAIL"
                        report.status_extended = "RDS security group event category of configuration change is not subscribed."

                findings.append(report)

        return findings

References