Skip to main content

RDS Event Notification Enabled Remediation

Triage and Remediation​

Remediation​

Using Console

Below are concise, step‑by‑step instructions to enable RDS event notifications using the AWS Management Console.

1. Create or Identify an SNS Topic​

  1. Sign in to the AWS Management Console.
  2. Go to Amazon SNS:
    • In the search bar, type SNS and open Simple Notification Service.
  3. Create a topic (if you don’t already have one):
    • In the left menu, select Topics → Create topic.
    • Choose Standard topic.
    • Enter a Name (e.g., rds-event-notifications).
    • Leave other settings default unless you have specific requirements.
    • Click Create topic.
  4. Create a subscription to that topic:
    • Open the topic you just created.
    • Click Create subscription.
    • Protocol: choose how you want to receive notifications (e.g., Email).
    • Endpoint: enter your email address (or endpoint).
    • Click Create subscription.
    • Confirm the subscription if needed (e.g., click confirmation link in email).

2. Create an RDS Event Subscription​

  1. In the console, go to Amazon RDS:
    • In the search bar, type RDS and open RDS.
  2. In the left navigation pane, click Event subscriptions.
  3. Click Create event subscription.
  4. Configure the subscription:
    • Name: e.g., rds-instance-events.
    • Target (SNS topic): select the SNS topic you created (e.g., rds-event-notifications).
  5. Choose Source type based on what you want to monitor:
    • Common options: DB instance, DB cluster, DB parameter group, etc.
  6. Select Event categories:
    • You can select broad options like Availability, Backup, Configuration change, Failure, Notification, Restoration, etc.
    • For compliance, it’s typical to include at least: Availability, Configuration change, and Failure.
  7. Select the Source:
    • Either:
      • All instances (or all sources of that type), or
      • Specific DB instances / clusters you want to monitor.
  8. Ensure Enabled is checked so the subscription is active immediately.
  9. Click Create.

3. Validate Notifications​

  1. Trigger or wait for an event (e.g., modify a DB instance configuration or restart the instance).
  2. Confirm you receive a notification via your chosen SNS subscription (email, etc.).

This completes enabling RDS event notifications via the AWS Console.

Using CLI

Below are step‑by‑step AWS CLI commands to enable RDS Event Notifications using Amazon SNS.

Assumptions:

  • You have AWS CLI configured with proper permissions.
  • You want email notifications (most common).

1. Create an SNS Topic​

aws sns create-topic \
  --name rds-event-notifications

Note the TopicArn from the output (e.g. arn:aws:sns:us-east-1:123456789012:rds-event-notifications).

2. Subscribe Your Email to the Topic​

aws sns subscribe \
  --topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --protocol email \
  --notification-endpoint you@example.com

Then:

  • Check your email.
  • Confirm the subscription by clicking the link.

3. (Optional) Verify Subscription​

aws sns list-subscriptions-by-topic \
  --topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications

Ensure SubscriptionArn is not PendingConfirmation.

4. Create an RDS Event Subscription​

Choose:

  • --source-type = db-instance | db-cluster | db-parameter-group | etc.
  • --event-categories list, such as: availability, backup, creation, deletion, failover, failure, maintenance, notification, restoration.

Example for all DB instances in the region:

aws rds create-event-subscription \
  --subscription-name rds-events-subscription \
  --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --source-type db-instance \
  --event-categories availability backup creation deletion failover failure maintenance notification restoration \
  --enabled

To target only specific instances, add --source-ids:

aws rds create-event-subscription \
  --subscription-name rds-events-subscription \
  --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --source-type db-instance \
  --source-ids mydbinstance1 mydbinstance2 \
  --event-categories availability backup failure \
  --enabled

5. Confirm Subscription Status​

aws rds describe-event-subscriptions \
  --subscription-name rds-events-subscription

Check that:

  • Status is active
  • Enabled is true

That enables RDS event notifications via SNS using the AWS CLI.

Using Python

Below is a straightforward way to enable RDS event notifications using Python (boto3).

1. Prerequisites​

  1. Install boto3:

    pip install boto3

  2. Configure AWS credentials with permission to:

    • rds:CreateEventSubscription
    • rds:ModifyEventSubscription
    • rds:DescribeDBInstances
    • sns:CreateTopic
    • sns:Subscribe
    • sns:SetTopicAttributes
    • iam:CreateRole / iam:AttachRolePolicy (if needed)

  3. Decide:

    • Which RDS instances/clusters you want notifications for.
    • Which email(s) or HTTPS endpoint will receive notifications.

2. Create or Reuse an SNS Topic​

import boto3

region = "us-east-1"  # change as needed
sns = boto3.client("sns", region_name=region)

topic_name = "rds-event-notifications"
response = sns.create_topic(Name=topic_name)
topic_arn = response["TopicArn"]
print("SNS topic:", topic_arn)

3. Subscribe Email (or Other Endpoint) to SNS Topic​

email_address = "you@example.com"  # change

subscribe_resp = sns.subscribe(
    TopicArn=topic_arn,
    Protocol="email",
    Endpoint=email_address,
)
print("Subscription ARN (pending confirmation):", subscribe_resp["SubscriptionArn"])

Then:

  • Check the email inbox and confirm the subscription from AWS.

4. Allow RDS to Publish to the SNS Topic (Optional Explicit Policy)​

Often not needed if default permissions are fine, but to be explicit:

import json

account_id = boto3.client("sts").get_caller_identity()["Account"]

topic_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowRDSPublish",
            "Effect": "Allow",
            "Principal": {"Service": "rds.amazonaws.com"},
            "Action": "SNS:Publish",
            "Resource": topic_arn
        }
    ]
}

sns.set_topic_attributes(
    TopicArn=topic_arn,
    AttributeName="Policy",
    AttributeValue=json.dumps(topic_policy),
)

5. Enable RDS Event Notifications via Event Subscription​

You usually:

  • Select event categories (e.g., availability, configuration change, backup).
  • Select SourceType (e.g., db-instance, db-cluster, db-parameter-group).
  • Select specific DB identifiers, or leave empty to cover all in the region.

Example: Subscribe all DB instances in the region to common events:

rds = boto3.client("rds", region_name=region)

subscription_name = "rds-instance-events-subscription"

# Choose event categories; common ones:
event_categories = [
    "availability",
    "configuration change",
    "deletion",
    "failover",
    "failure",
    "notification",
    "maintenance",
    "recovery",
    "restoration",
    "backup",
]

# Get all DB instance identifiers (optional – you can specify a subset)
db_instances = rds.describe_db_instances()["DBInstances"]
source_ids = [db["DBInstanceIdentifier"] for db in db_instances]

try:
    # Try creating a new event subscription
    create_resp = rds.create_event_subscription(
        SubscriptionName=subscription_name,
        SnsTopicArn=topic_arn,
        SourceType="db-instance",
        EventCategories=event_categories,
        SourceIds=source_ids,  # omit this to apply to all db-instance events in account/region
        Enabled=True,
    )
    print("Created event subscription:", create_resp["EventSubscription"]["CustSubscriptionId"])

except rds.exceptions.EventSubscriptionQuotaExceededFault:
    # If already exists or quota issues, you may need to modify instead
    print("Subscription exists or quota exceeded; modifying existing subscription...")
    modify_resp = rds.modify_event_subscription(
        SubscriptionName=subscription_name,
        SnsTopicArn=topic_arn,
        SourceType="db-instance",
        EventCategories=event_categories,
        SourceIds=source_ids,
        Enabled=True,
    )
    print("Modified event subscription:", modify_resp["EventSubscription"]["CustSubscriptionId"])

6. Verify the Subscription​

subs = rds.describe_event_subscriptions(
    Filters=[{"Name": "cust-subscription-id", "Values": [subscription_name]}]
)
print(subs["EventSubscriptionsList"])

Check that:

  • Enabled is True.
  • Status becomes active.
  • SnsTopicArn is correct.
  • EventCategoriesList and SourceType match your needs.

7. Test​

Trigger a test scenario, for example:

  • Modify an RDS instance parameter or configuration.
  • Perform a manual snapshot or reboot. You should receive an email notification via SNS for the corresponding RDS event.

This completes enabling RDS Event Notifications via Python.

Using Terraform
# SNS topic to receive RDS events
resource "aws_sns_topic" "rds_events" {
  name = "rds-events-topic"
}

# (Optional) subscription to send notifications (e.g., to email)
resource "aws_sns_topic_subscription" "rds_events_email" {
  topic_arn = aws_sns_topic.rds_events.arn
  protocol  = "email"
  endpoint  = "YOUR_NOTIFICATION_EMAIL@example.com" # replace with your email
}

# RDS Event Subscription (enables event notifications)
resource "aws_db_event_subscription" "rds_event_subscription" {
  name      = "rds-events-subscription"
  sns_topic = aws_sns_topic.rds_events.arn

  # Adjust source type and categories as needed: "db-instance", "db-parameter-group", etc.
  source_type = "db-instance"

  # Example event categories; extend/modify to your requirements
  event_categories = [
    "availability",
    "backup",
    "configuration change",
    "creation",
    "deletion",
    "failover",
    "failure",
    "maintenance",
    "notification",
    "recovery",
    "restoration",
  ]

  # Optionally scope to specific instances; omit to cover all in the account/region
  # source_ids = [aws_db_instance.MY_DB.id]

  enabled = true

  tags = {
    Name = "rds-events-subscription"
  }
}

This does not replace your existing RDS instances; it only creates a new event subscription and SNS topic.

For verification, terraform plan should show + (create) for aws_sns_topic.rds_events, optionally aws_sns_topic_subscription.rds_events_email, and aws_db_event_subscription.rds_event_subscription with enabled = true and your chosen event_categories/source_type.