Rds event notification enabled remediation

Using Console

Below are concise, step‑by‑step instructions to enable RDS event notifications using the AWS Management Console.

Sign in to the AWS Management Console.
Go to Amazon SNS:
- In the search bar, type SNS and open Simple Notification Service.
Create a topic (if you don’t already have one):
- In the left menu, select Topics → Create topic.
- Choose Standard topic.
- Enter a Name (e.g., rds-event-notifications).
- Leave other settings default unless you have specific requirements.
- Click Create topic.
Create a subscription to that topic:
- Open the topic you just created.
- Click Create subscription.
- Protocol: choose how you want to receive notifications (e.g., Email).
- Endpoint: enter your email address (or endpoint).
- Click Create subscription.
- Confirm the subscription if needed (e.g., click confirmation link in email).

2. Create an RDS Event Subscription

In the console, go to Amazon RDS:
- In the search bar, type RDS and open RDS.
In the left navigation pane, click Event subscriptions.
Click Create event subscription.
Configure the subscription:
- Name: e.g., rds-instance-events.
- Target (SNS topic): select the SNS topic you created (e.g., rds-event-notifications).
Choose Source type based on what you want to monitor:
- Common options: DB instance, DB cluster, DB parameter group, etc.
Select Event categories:
- You can select broad options like Availability, Backup, Configuration change, Failure, Notification, Restoration, etc.
- For compliance, it’s typical to include at least: Availability, Configuration change, and Failure.
Select the Source:
- Either:
  - All instances (or all sources of that type), or
  - Specific DB instances / clusters you want to monitor.
Ensure Enabled is checked so the subscription is active immediately.
Click Create.

3. Validate Notifications

Trigger or wait for an event (e.g., modify a DB instance configuration or restart the instance).
Confirm you receive a notification via your chosen SNS subscription (email, etc.).

This completes enabling RDS event notifications via the AWS Console.

Using CLI

Below are step‑by‑step AWS CLI commands to enable RDS Event Notifications using Amazon SNS.Assumptions:

You have AWS CLI configured with proper permissions.
You want email notifications (most common).

aws sns create-topic \
  --name rds-event-notifications

Note the TopicArn from the output (e.g. arn:aws:sns:us-east-1:123456789012:rds-event-notifications).

aws sns subscribe \
  --topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --protocol email \
  --notification-endpoint you@example.com

Then:

Check your email.
Confirm the subscription by clicking the link.

3. (Optional) Verify Subscription

aws sns list-subscriptions-by-topic \
  --topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications

Ensure SubscriptionArn is not PendingConfirmation.

4. Create an RDS Event Subscription

Choose:

--source-type = db-instance | db-cluster | db-parameter-group | etc.
--event-categories list, such as: availability, backup, creation, deletion, failover, failure, maintenance, notification, restoration.

Example for all DB instances in the region:

aws rds create-event-subscription \
  --subscription-name rds-events-subscription \
  --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --source-type db-instance \
  --event-categories availability backup creation deletion failover failure maintenance notification restoration \
  --enabled

To target only specific instances, add --source-ids:

aws rds create-event-subscription \
  --subscription-name rds-events-subscription \
  --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
  --source-type db-instance \
  --source-ids mydbinstance1 mydbinstance2 \
  --event-categories availability backup failure \
  --enabled

5. Confirm Subscription Status

aws rds describe-event-subscriptions \
  --subscription-name rds-events-subscription

Check that:

Status is active
Enabled is true

That enables RDS event notifications via SNS using the AWS CLI.

Using Python

Below is a straightforward way to enable RDS event notifications using Python (boto3).

1. Prerequisites

Install boto3:
pip install boto3
Configure AWS credentials with permission to:
- rds:CreateEventSubscription
- rds:ModifyEventSubscription
- rds:DescribeDBInstances
- sns:CreateTopic
- sns:Subscribe
- sns:SetTopicAttributes
- iam:CreateRole / iam:AttachRolePolicy (if needed)
Decide:
- Which RDS instances/clusters you want notifications for.
- Which email(s) or HTTPS endpoint will receive notifications.

import boto3

region = "us-east-1"  # change as needed
sns = boto3.client("sns", region_name=region)

topic_name = "rds-event-notifications"
response = sns.create_topic(Name=topic_name)
topic_arn = response["TopicArn"]
print("SNS topic:", topic_arn)

email_address = "you@example.com"  # change

subscribe_resp = sns.subscribe(
    TopicArn=topic_arn,
    Protocol="email",
    Endpoint=email_address,
)
print("Subscription ARN (pending confirmation):", subscribe_resp["SubscriptionArn"])

Then:

Check the email inbox and confirm the subscription from AWS.

Often not needed if default permissions are fine, but to be explicit:

import json

account_id = boto3.client("sts").get_caller_identity()["Account"]

topic_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowRDSPublish",
            "Effect": "Allow",
            "Principal": {"Service": "rds.amazonaws.com"},
            "Action": "SNS:Publish",
            "Resource": topic_arn
        }
    ]
}

sns.set_topic_attributes(
    TopicArn=topic_arn,
    AttributeName="Policy",
    AttributeValue=json.dumps(topic_policy),
)

5. Enable RDS Event Notifications via Event Subscription

You usually:

Select event categories (e.g., availability, configuration change, backup).
Select SourceType (e.g., db-instance, db-cluster, db-parameter-group).
Select specific DB identifiers, or leave empty to cover all in the region.

Example: Subscribe all DB instances in the region to common events:

rds = boto3.client("rds", region_name=region)

subscription_name = "rds-instance-events-subscription"

# Choose event categories; common ones:
event_categories = [
    "availability",
    "configuration change",
    "deletion",
    "failover",
    "failure",
    "notification",
    "maintenance",
    "recovery",
    "restoration",
    "backup",
]

# Get all DB instance identifiers (optional – you can specify a subset)
db_instances = rds.describe_db_instances()["DBInstances"]
source_ids = [db["DBInstanceIdentifier"] for db in db_instances]

try:
    # Try creating a new event subscription
    create_resp = rds.create_event_subscription(
        SubscriptionName=subscription_name,
        SnsTopicArn=topic_arn,
        SourceType="db-instance",
        EventCategories=event_categories,
        SourceIds=source_ids,  # omit this to apply to all db-instance events in account/region
        Enabled=True,
    )
    print("Created event subscription:", create_resp["EventSubscription"]["CustSubscriptionId"])

except rds.exceptions.EventSubscriptionQuotaExceededFault:
    # If already exists or quota issues, you may need to modify instead
    print("Subscription exists or quota exceeded; modifying existing subscription...")
    modify_resp = rds.modify_event_subscription(
        SubscriptionName=subscription_name,
        SnsTopicArn=topic_arn,
        SourceType="db-instance",
        EventCategories=event_categories,
        SourceIds=source_ids,
        Enabled=True,
    )
    print("Modified event subscription:", modify_resp["EventSubscription"]["CustSubscriptionId"])

6. Verify the Subscription

subs = rds.describe_event_subscriptions(
    Filters=[{"Name": "cust-subscription-id", "Values": [subscription_name]}]
)
print(subs["EventSubscriptionsList"])

Check that:

Enabled is True.
Status becomes active.
SnsTopicArn is correct.
EventCategoriesList and SourceType match your needs.

7. Test

Trigger a test scenario, for example:

Modify an RDS instance parameter or configuration.
Perform a manual snapshot or reboot. You should receive an email notification via SNS for the corresponding RDS event.

This completes enabling RDS Event Notifications via Python.

Using Terraform

# SNS topic to receive RDS events
resource "aws_sns_topic" "rds_events" {
  name = "rds-events-topic"
}

# (Optional) subscription to send notifications (e.g., to email)
resource "aws_sns_topic_subscription" "rds_events_email" {
  topic_arn = aws_sns_topic.rds_events.arn
  protocol  = "email"
  endpoint  = "YOUR_NOTIFICATION_EMAIL@example.com" # replace with your email
}

# RDS Event Subscription (enables event notifications)
resource "aws_db_event_subscription" "rds_event_subscription" {
  name      = "rds-events-subscription"
  sns_topic = aws_sns_topic.rds_events.arn

  # Adjust source type and categories as needed: "db-instance", "db-parameter-group", etc.
  source_type = "db-instance"

  # Example event categories; extend/modify to your requirements
  event_categories = [
    "availability",
    "backup",
    "configuration change",
    "creation",
    "deletion",
    "failover",
    "failure",
    "maintenance",
    "notification",
    "recovery",
    "restoration",
  ]

  # Optionally scope to specific instances; omit to cover all in the account/region
  # source_ids = [aws_db_instance.MY_DB.id]

  enabled = true

  tags = {
    Name = "rds-events-subscription"
  }
}

This does not replace your existing RDS instances; it only creates a new event subscription and SNS topic.For verification, terraform plan should show + (create) for aws_sns_topic.rds_events, optionally aws_sns_topic_subscription.rds_events_email, and aws_db_event_subscription.rds_event_subscription with enabled = true and your chosen event_categories/source_type.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Rds event notification enabled remediation

Triage and Remediation

Remediation

2. Create an RDS Event Subscription

3. Validate Notifications

3. (Optional) Verify Subscription

4. Create an RDS Event Subscription

5. Confirm Subscription Status

1. Prerequisites

5. Enable RDS Event Notifications via Event Subscription

6. Verify the Subscription

7. Test

​Triage and Remediation

​Remediation

​1. Create or Identify an SNS Topic

​2. Create an RDS Event Subscription

​3. Validate Notifications

​1. Create an SNS Topic

​2. Subscribe Your Email to the Topic

​3. (Optional) Verify Subscription

​4. Create an RDS Event Subscription

​5. Confirm Subscription Status

​1. Prerequisites

​2. Create or Reuse an SNS Topic

​3. Subscribe Email (or Other Endpoint) to SNS Topic

​4. Allow RDS to Publish to the SNS Topic (Optional Explicit Policy)

​5. Enable RDS Event Notifications via Event Subscription

​6. Verify the Subscription

​7. Test

Triage and Remediation

Remediation

1. Create or Identify an SNS Topic

2. Create an RDS Event Subscription

3. Validate Notifications

1. Create an SNS Topic

2. Subscribe Your Email to the Topic

3. (Optional) Verify Subscription

4. Create an RDS Event Subscription

5. Confirm Subscription Status

1. Prerequisites

2. Create or Reuse an SNS Topic

3. Subscribe Email (or Other Endpoint) to SNS Topic

4. Allow RDS to Publish to the SNS Topic (Optional Explicit Policy)

5. Enable RDS Event Notifications via Event Subscription

6. Verify the Subscription

7. Test