> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# RDS Cluster Parameter Groups Pending Reboot

### More Info:

Checks the status of Amazon RDS clusters to identify any parameter groups that have parameters set to pending-reboot. It iterates through the clusters and their parameter groups, collecting those that require a reboot for changes to take effect.

### Risk Level

Low

### Address

Monitoring

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* Cloudanix Best Practice
* DPDPA
* Digital Operational Resilience Act (EU)
* Essential 8
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        1. Login to AWS Management Console.
        2. Navigate to the RDS dashboard.
        3. In the navigation pane, click on 'Parameter groups'.
        4. You will see a list of parameter groups. The one with the pending reboot status will have a 'yes' in the 'pending reboot' column.
        5. Note down the name of the parameter group that needs a reboot.
        6. Now, go back to the RDS dashboard and click on 'Databases' in the navigation pane.
        7. You will see a list of your DB instances. Click on the DB instance that is using the parameter group you noted down.
        8. Click on 'Actions' and then click 'Reboot'.
        9. You will get a prompt asking you to confirm the reboot. Click 'Reboot' to confirm.
        10. The status of your DB instance will change to 'rebooting'. Wait for a few minutes until the status changes back to 'available'.
        11. Now, go back to the 'Parameter groups' page and check the 'pending reboot' column for your parameter group. It should now be 'no'.
        12. The misconfiguration has been remediated.

        Remember, rebooting a DB instance results in a momentary outage, during which the DB instance status is set to rebooting. The time a DB instance is unavailable due to a reboot varies, depending on the database engine's process to shut down, the size of your database, and whether there are any database transactions to roll back.
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the RDS Cluster Parameter Groups Pending Reboot, you need to restart your RDS instances for the changes to take effect. Here are the steps to do it using AWS CLI:

        1. **Identify the RDS Instances that need rebooting**: The first step is to identify which RDS instances are in the pending reboot state. This can be done by looking at the RDS dashboard in the AWS Management Console or by running the following AWS CLI command:

           ```
           aws rds describe-db-instances --query "DBInstances[?DBParameterGroups[?PendingRebootDBParameterChanges!=`null`]].DBInstanceIdentifier"
           ```

        2. **Reboot the RDS Instances**: Once you have identified the RDS instances that need rebooting, you can reboot them using the following AWS CLI command:

           ```
           aws rds reboot-db-instance --db-instance-identifier your-db-instance-identifier
           ```

           Replace 'your-db-instance-identifier' with the actual identifier of your RDS instance.

        3. **Verify the Changes**: After the RDS instances have been rebooted, you can verify that the parameter group changes have taken effect by running the following AWS CLI command:

           ```
           aws rds describe-db-instances --query "DBInstances[?DBParameterGroups[?PendingRebootDBParameterChanges==`null`]].DBInstanceIdentifier"
           ```

           This command will return the identifiers of all RDS instances that do not have any pending parameter group changes.

        4. **Repeat the Process**: If you have multiple RDS instances that need rebooting, you will need to repeat steps 2 and 3 for each one.

        Remember, rebooting an RDS instance can cause a brief outage for your database, so you should plan to do this during a maintenance window or a time when the impact on your users will be minimal.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "RDS Cluster Parameter Groups Pending Reboot" issue in AWS, you can use the AWS SDK for Python, known as Boto3. Here's a step-by-step guide:

        1. First, you need to install the AWS SDK for Python (Boto3). Open your terminal and type the following command:
           ```
           pip install boto3
           ```

        2. Import the necessary libraries in your Python script:
           ```python theme={null}
           import boto3
           from botocore.exceptions import NoCredentialsError
           ```

        3. Create a session using your AWS credentials. Replace 'your\_access\_key', 'your\_secret\_key', and 'your\_region' with your actual AWS credentials.
           ```python theme={null}
           session = boto3.Session(
               aws_access_key_id='your_access_key',
               aws_secret_access_key='your_secret_key',
               region_name='your_region'
           )
           ```

        4. Create a client for RDS:
           ```python theme={null}
           rds = session.client('rds')
           ```

        5. Now, get a list of all DB instances:
           ```python theme={null}
           try:
               response = rds.describe_db_instances()
           except NoCredentialsError:
               print("No AWS credentials found")
           ```

        6. Iterate over the DB instances and reboot the ones with pending parameter changes:
           ```python theme={null}
           for instance in response['DBInstances']:
               if instance['PendingModifiedValues']:
                   try:
                       rds.reboot_db_instance(DBInstanceIdentifier=instance['DBInstanceIdentifier'])
                       print(f"Reboot initiated for {instance['DBInstanceIdentifier']}")
                   except Exception as e:
                       print(f"Error rebooting {instance['DBInstanceIdentifier']}: {e}")
           ```

        Please remember that rebooting a DB instance results in a momentary outage, during which the DB instance status is set to rebooting.

        Also, ensure that you have the necessary permissions to perform these actions, and always follow the principle of least privilege. You should only grant the permissions necessary to perform a task.
      </Accordion>

      <Accordion title="Using Terraform">
        Terraform cannot reboot an RDS cluster or apply “pending-reboot” parameter changes; reboots are runtime operations not exposed as Terraform arguments or resources.

        Use the AWS CLI (or console) alongside Terraform-managed infrastructure:

        ```bash theme={null}
        aws rds reboot-db-cluster \
          --db-cluster-identifier YOUR_DB_CLUSTER_IDENTIFIER \
          --region YOUR_AWS_REGION
        ```

        Substitute:

        * `YOUR_DB_CLUSTER_IDENTIFIER` with the RDS cluster identifier (e.g., `prod-app-cluster`)
        * `YOUR_AWS_REGION` with the region (e.g., `us-east-1`)

        Rebooting will cause a database outage/failover; do it in a maintenance window.

        There is nothing for `terraform plan` to show here, because no Terraform configuration change is involved.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://boto3.amazonaws.com/v1/documentation/api/1.24.61/reference/services/rds.html#RDS.Client.describe\_db\_parameters](https://boto3.amazonaws.com/v1/documentation/api/1.24.61/reference/services/rds.html#RDS.Client.describe_db_parameters)