More Info:
Your AWS RDS resources should have event notifications enabled in order to be notified when an event occurs for a given database instance, database snapshot, database security group or database parameter groupRisk Level
LowAddress
Operational Maturity, ReliabilityCompliance Standards
- APRA CPS 234 (Australia)
- BSI C5 (Germany)
- Brazil LGPD
- CCPA / CPRA (California)
- CIS Critical Security Controls v8
- CMMC 2.0
- CSA Cloud Controls Matrix v4
- Cloudanix Best Practice
- DPDPA
- Digital Operational Resilience Act (EU)
- ISO/IEC 27017
- ISO/IEC 27018
- ISO/IEC 27701
- KSA PDPL
- MAS Technology Risk Management (Singapore)
- MITRE ATT&CK (Cloud)
- NIS2 Directive
- NIST SP 800-171
- NYDFS 23 NYCRR 500
- SWIFT Customer Security Controls Framework
- UK NCSC Cyber Assessment Framework
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of Event Notifications not being enabled for an AWS RDS instance using the AWS Management Console, follow these step-by-step instructions:
- Log in to the AWS Management Console: Go to https://aws.amazon.com/ and log in using your credentials.
- Navigate to the RDS Console: Once logged in, navigate to the Amazon RDS console by clicking on the “Services” dropdown menu at the top of the page and selecting “RDS” under the Database category.
- Select the RDS Instance: In the RDS dashboard, locate and select the RDS instance for which you want to enable Event Notifications.
- Enable Event Notifications: In the RDS instance details page, scroll down to the “Event subscriptions” section and click on the “Modify” button.
- Configure Event Notifications: In the Modify RDS instance page, scroll down to the “Event subscriptions” section and click on the “Add event subscription” button.
-
Set up Event Subscription: In the Add event subscription dialog box, configure the following settings:
- Subscription name: Enter a name for the event subscription.
- SNS topic: Select an existing SNS topic or create a new one to receive the event notifications.
- Event categories: Select the event categories for which you want to receive notifications. For example, you can choose “All” to receive notifications for all event categories.
- Severity: Select the severity level of events for which you want to receive notifications.
- Enable: Make sure the “Enable” checkbox is checked to activate the event subscription.
- Save Changes: Click on the “Add subscription” button to save the event subscription settings.
- Verify Configuration: Once the event subscription is added, verify that the Event Notifications are now enabled for the RDS instance by checking the Event Subscriptions section in the RDS instance details page.
Using CLI
Using CLI
To remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using AWS CLI, you can follow these steps:
-
List Current Event Subscriptions: First, you need to list the current event subscriptions to check if there are any existing subscriptions. You can use the following AWS CLI command:
-
Enable Event Notifications: If there are no existing event subscriptions or if the required event notification is not enabled, you can enable event notifications for RDS by creating a new event subscription. Use the following AWS CLI command to create a new event subscription:
- Replace
<subscription-name>with a unique name for the event subscription. - Replace
<sns-topic-arn>with the ARN of the SNS topic to which you want to send the notifications. - Replace
<rds-instance-identifier>with the identifier of the RDS instance for which you want to enable event notifications. - Replace
<event-category>with the specific event categories you want to receive notifications for (e.g., “configuration change”, “failover”, “backup”, etc.).
- Replace
- Verify Event Subscription: After creating the event subscription, you can verify if the event notifications are successfully enabled by listing the event subscriptions again using the command in step 1.
Using Python
Using Python
To remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using Python, you can follow these steps:Make sure to replace
- Import the necessary libraries:
- Create an AWS RDS client:
- Enable Event Notifications for the specific RDS instance:
'YOUR_REGION', 'YOUR_DB_INSTANCE_IDENTIFIER', and 'YOUR_SNS_TOPIC_ARN' with your actual AWS region, RDS instance identifier, and SNS topic ARN respectively.- Verify that Event Notifications have been successfully enabled by checking the RDS instance details or the CloudWatch Events console.
Using Terraform
Using Terraform
aws_sns_topic.rds_events.arn with its ARN (for example from a data "aws_sns_topic"), and omit the aws_sns_topic resource.This change does not force replacement of the existing RDS cluster; it adds a new subscription only. After you add this, terraform plan should show one new aws_db_event_subscription (and an aws_sns_topic if you create it) with event_categories including maintenance, failure, failover, and configuration-change.
