> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Rds event notification enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are concise, step‑by‑step instructions to enable RDS event notifications using the AWS Management Console.

        ***

        ### 1. Create or Identify an SNS Topic

        1. Sign in to the **AWS Management Console**.
        2. Go to **Amazon SNS**:
           * In the search bar, type `SNS` and open **Simple Notification Service**.
        3. Create a topic (if you don’t already have one):
           * In the left menu, select **Topics** → **Create topic**.
           * Choose **Standard** topic.
           * Enter a **Name** (e.g., `rds-event-notifications`).
           * Leave other settings default unless you have specific requirements.
           * Click **Create topic**.
        4. Create a subscription to that topic:
           * Open the topic you just created.
           * Click **Create subscription**.
           * **Protocol**: choose how you want to receive notifications (e.g., `Email`).
           * **Endpoint**: enter your email address (or endpoint).
           * Click **Create subscription**.
           * Confirm the subscription if needed (e.g., click confirmation link in email).

        ***

        ### 2. Create an RDS Event Subscription

        1. In the console, go to **Amazon RDS**:
           * In the search bar, type `RDS` and open **RDS**.
        2. In the left navigation pane, click **Event subscriptions**.
        3. Click **Create event subscription**.
        4. Configure the subscription:
           * **Name**: e.g., `rds-instance-events`.
           * **Target** (SNS topic): select the SNS topic you created (e.g., `rds-event-notifications`).
        5. Choose **Source type** based on what you want to monitor:
           * Common options: `DB instance`, `DB cluster`, `DB parameter group`, etc.
        6. Select **Event categories**:
           * You can select broad options like **Availability**, **Backup**, **Configuration change**, **Failure**, **Notification**, **Restoration**, etc.
           * For compliance, it’s typical to include at least: `Availability`, `Configuration change`, and `Failure`.
        7. Select the **Source**:
           * Either:
             * **All instances** (or all sources of that type), or
             * Specific DB instances / clusters you want to monitor.
        8. Ensure **Enabled** is checked so the subscription is active immediately.
        9. Click **Create**.

        ***

        ### 3. Validate Notifications

        1. Trigger or wait for an event (e.g., modify a DB instance configuration or restart the instance).
        2. Confirm you receive a notification via your chosen SNS subscription (email, etc.).

        This completes enabling RDS event notifications via the AWS Console.
      </Accordion>

      <Accordion title="Using CLI">
        Below are step‑by‑step AWS CLI commands to enable RDS Event Notifications using Amazon SNS.

        Assumptions:

        * You have AWS CLI configured with proper permissions.
        * You want email notifications (most common).

        ***

        ### 1. Create an SNS Topic

        ```bash theme={null}
        aws sns create-topic \
          --name rds-event-notifications
        ```

        Note the `TopicArn` from the output (e.g. `arn:aws:sns:us-east-1:123456789012:rds-event-notifications`).

        ***

        ### 2. Subscribe Your Email to the Topic

        ```bash theme={null}
        aws sns subscribe \
          --topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
          --protocol email \
          --notification-endpoint you@example.com
        ```

        Then:

        * Check your email.
        * Confirm the subscription by clicking the link.

        ***

        ### 3. (Optional) Verify Subscription

        ```bash theme={null}
        aws sns list-subscriptions-by-topic \
          --topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications
        ```

        Ensure `SubscriptionArn` is not `PendingConfirmation`.

        ***

        ### 4. Create an RDS Event Subscription

        Choose:

        * `--source-type` = `db-instance` | `db-cluster` | `db-parameter-group` | etc.
        * `--event-categories` list, such as: `availability`, `backup`, `creation`, `deletion`, `failover`, `failure`, `maintenance`, `notification`, `restoration`.

        Example for all DB instances in the region:

        ```bash theme={null}
        aws rds create-event-subscription \
          --subscription-name rds-events-subscription \
          --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
          --source-type db-instance \
          --event-categories availability backup creation deletion failover failure maintenance notification restoration \
          --enabled
        ```

        To target only specific instances, add `--source-ids`:

        ```bash theme={null}
        aws rds create-event-subscription \
          --subscription-name rds-events-subscription \
          --sns-topic-arn arn:aws:sns:us-east-1:123456789012:rds-event-notifications \
          --source-type db-instance \
          --source-ids mydbinstance1 mydbinstance2 \
          --event-categories availability backup failure \
          --enabled
        ```

        ***

        ### 5. Confirm Subscription Status

        ```bash theme={null}
        aws rds describe-event-subscriptions \
          --subscription-name rds-events-subscription
        ```

        Check that:

        * `Status` is `active`
        * `Enabled` is `true`

        That enables RDS event notifications via SNS using the AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        Below is a straightforward way to enable RDS event notifications using Python (boto3).

        ## 1. Prerequisites

        1. Install boto3:
           ```bash theme={null}
           pip install boto3
           ```

        2. Configure AWS credentials with permission to:
           * `rds:CreateEventSubscription`
           * `rds:ModifyEventSubscription`
           * `rds:DescribeDBInstances`
           * `sns:CreateTopic`
           * `sns:Subscribe`
           * `sns:SetTopicAttributes`
           * `iam:CreateRole` / `iam:AttachRolePolicy` (if needed)

        3. Decide:
           * Which RDS instances/clusters you want notifications for.
           * Which email(s) or HTTPS endpoint will receive notifications.

        ***

        ## 2. Create or Reuse an SNS Topic

        ```python theme={null}
        import boto3

        region = "us-east-1"  # change as needed
        sns = boto3.client("sns", region_name=region)

        topic_name = "rds-event-notifications"
        response = sns.create_topic(Name=topic_name)
        topic_arn = response["TopicArn"]
        print("SNS topic:", topic_arn)
        ```

        ***

        ## 3. Subscribe Email (or Other Endpoint) to SNS Topic

        ```python theme={null}
        email_address = "you@example.com"  # change

        subscribe_resp = sns.subscribe(
            TopicArn=topic_arn,
            Protocol="email",
            Endpoint=email_address,
        )
        print("Subscription ARN (pending confirmation):", subscribe_resp["SubscriptionArn"])
        ```

        Then:

        * Check the email inbox and confirm the subscription from AWS.

        ***

        ## 4. Allow RDS to Publish to the SNS Topic (Optional Explicit Policy)

        Often not needed if default permissions are fine, but to be explicit:

        ```python theme={null}
        import json

        account_id = boto3.client("sts").get_caller_identity()["Account"]

        topic_policy = {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "AllowRDSPublish",
                    "Effect": "Allow",
                    "Principal": {"Service": "rds.amazonaws.com"},
                    "Action": "SNS:Publish",
                    "Resource": topic_arn
                }
            ]
        }

        sns.set_topic_attributes(
            TopicArn=topic_arn,
            AttributeName="Policy",
            AttributeValue=json.dumps(topic_policy),
        )
        ```

        ***

        ## 5. Enable RDS Event Notifications via Event Subscription

        You usually:

        * Select event categories (e.g., availability, configuration change, backup).
        * Select `SourceType` (e.g., `db-instance`, `db-cluster`, `db-parameter-group`).
        * Select specific DB identifiers, or leave empty to cover all in the region.

        Example: Subscribe all DB instances in the region to common events:

        ```python theme={null}
        rds = boto3.client("rds", region_name=region)

        subscription_name = "rds-instance-events-subscription"

        # Choose event categories; common ones:
        event_categories = [
            "availability",
            "configuration change",
            "deletion",
            "failover",
            "failure",
            "notification",
            "maintenance",
            "recovery",
            "restoration",
            "backup",
        ]

        # Get all DB instance identifiers (optional – you can specify a subset)
        db_instances = rds.describe_db_instances()["DBInstances"]
        source_ids = [db["DBInstanceIdentifier"] for db in db_instances]

        try:
            # Try creating a new event subscription
            create_resp = rds.create_event_subscription(
                SubscriptionName=subscription_name,
                SnsTopicArn=topic_arn,
                SourceType="db-instance",
                EventCategories=event_categories,
                SourceIds=source_ids,  # omit this to apply to all db-instance events in account/region
                Enabled=True,
            )
            print("Created event subscription:", create_resp["EventSubscription"]["CustSubscriptionId"])

        except rds.exceptions.EventSubscriptionQuotaExceededFault:
            # If already exists or quota issues, you may need to modify instead
            print("Subscription exists or quota exceeded; modifying existing subscription...")
            modify_resp = rds.modify_event_subscription(
                SubscriptionName=subscription_name,
                SnsTopicArn=topic_arn,
                SourceType="db-instance",
                EventCategories=event_categories,
                SourceIds=source_ids,
                Enabled=True,
            )
            print("Modified event subscription:", modify_resp["EventSubscription"]["CustSubscriptionId"])
        ```

        ***

        ## 6. Verify the Subscription

        ```python theme={null}
        subs = rds.describe_event_subscriptions(
            Filters=[{"Name": "cust-subscription-id", "Values": [subscription_name]}]
        )
        print(subs["EventSubscriptionsList"])
        ```

        Check that:

        * `Enabled` is `True`.
        * `Status` becomes `active`.
        * `SnsTopicArn` is correct.
        * `EventCategoriesList` and `SourceType` match your needs.

        ***

        ## 7. Test

        Trigger a test scenario, for example:

        * Modify an RDS instance parameter or configuration.
        * Perform a manual snapshot or reboot.
          You should receive an email notification via SNS for the corresponding RDS event.

        This completes enabling RDS Event Notifications via Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # SNS topic to receive RDS events
        resource "aws_sns_topic" "rds_events" {
          name = "rds-events-topic"
        }

        # (Optional) subscription to send notifications (e.g., to email)
        resource "aws_sns_topic_subscription" "rds_events_email" {
          topic_arn = aws_sns_topic.rds_events.arn
          protocol  = "email"
          endpoint  = "YOUR_NOTIFICATION_EMAIL@example.com" # replace with your email
        }

        # RDS Event Subscription (enables event notifications)
        resource "aws_db_event_subscription" "rds_event_subscription" {
          name      = "rds-events-subscription"
          sns_topic = aws_sns_topic.rds_events.arn

          # Adjust source type and categories as needed: "db-instance", "db-parameter-group", etc.
          source_type = "db-instance"

          # Example event categories; extend/modify to your requirements
          event_categories = [
            "availability",
            "backup",
            "configuration change",
            "creation",
            "deletion",
            "failover",
            "failure",
            "maintenance",
            "notification",
            "recovery",
            "restoration",
          ]

          # Optionally scope to specific instances; omit to cover all in the account/region
          # source_ids = [aws_db_instance.MY_DB.id]

          enabled = true

          tags = {
            Name = "rds-events-subscription"
          }
        }
        ```

        This does not replace your existing RDS instances; it only creates a new event subscription and SNS topic.

        For verification, `terraform plan` should show `+` (create) for `aws_sns_topic.rds_events`, optionally `aws_sns_topic_subscription.rds_events_email`, and `aws_db_event_subscription.rds_event_subscription` with `enabled = true` and your chosen `event_categories`/`source_type`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>