> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Event Notifications Should Be Enabled ### More Info: Your AWS RDS resources should have event notifications enabled in order to be notified when an event occurs for a given database instance, database snapshot, database security group or database parameter group ### Risk Level Low ### Address Operational Maturity, Reliability ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration of Event Notifications not being enabled for an AWS RDS instance using the AWS Management Console, follow these step-by-step instructions: 1. **Log in to the AWS Management Console**: Go to [https://aws.amazon.com/](https://aws.amazon.com/) and log in using your credentials. 2. **Navigate to the RDS Console**: Once logged in, navigate to the Amazon RDS console by clicking on the "Services" dropdown menu at the top of the page and selecting "RDS" under the Database category. 3. **Select the RDS Instance**: In the RDS dashboard, locate and select the RDS instance for which you want to enable Event Notifications. 4. **Enable Event Notifications**: In the RDS instance details page, scroll down to the "Event subscriptions" section and click on the "Modify" button. 5. **Configure Event Notifications**: In the Modify RDS instance page, scroll down to the "Event subscriptions" section and click on the "Add event subscription" button. 6. **Set up Event Subscription**: In the Add event subscription dialog box, configure the following settings: * **Subscription name**: Enter a name for the event subscription. * **SNS topic**: Select an existing SNS topic or create a new one to receive the event notifications. * **Event categories**: Select the event categories for which you want to receive notifications. For example, you can choose "All" to receive notifications for all event categories. * **Severity**: Select the severity level of events for which you want to receive notifications. * **Enable**: Make sure the "Enable" checkbox is checked to activate the event subscription. 7. **Save Changes**: Click on the "Add subscription" button to save the event subscription settings. 8. **Verify Configuration**: Once the event subscription is added, verify that the Event Notifications are now enabled for the RDS instance by checking the Event Subscriptions section in the RDS instance details page. By following these steps, you have successfully enabled Event Notifications for the AWS RDS instance using the AWS Management Console. This will ensure that you receive notifications for important events related to the RDS instance. # To remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using AWS CLI, you can follow these steps: 1. **List Current Event Subscriptions**: First, you need to list the current event subscriptions to check if there are any existing subscriptions. You can use the following AWS CLI command: ```bash theme={null} aws rds describe-event-subscriptions ``` 2. **Enable Event Notifications**: If there are no existing event subscriptions or if the required event notification is not enabled, you can enable event notifications for RDS by creating a new event subscription. Use the following AWS CLI command to create a new event subscription: ```bash theme={null} aws rds create-event-subscription --subscription-name --sns-topic-arn --source-type db-instance --source-ids --event-categories ``` * Replace `` with a unique name for the event subscription. * Replace `` with the ARN of the SNS topic to which you want to send the notifications. * Replace `` with the identifier of the RDS instance for which you want to enable event notifications. * Replace `` with the specific event categories you want to receive notifications for (e.g., "configuration change", "failover", "backup", etc.). 3. **Verify Event Subscription**: After creating the event subscription, you can verify if the event notifications are successfully enabled by listing the event subscriptions again using the command in step 1. By following these steps, you can remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using AWS CLI. To remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using Python, you can follow these steps: 1. Import the necessary libraries: ```python theme={null} import boto3 ``` 2. Create an AWS RDS client: ```python theme={null} rds_client = boto3.client('rds', region_name='YOUR_REGION') ``` 3. Enable Event Notifications for the specific RDS instance: ```python theme={null} db_instance_identifier = 'YOUR_DB_INSTANCE_IDENTIFIER' sns_topic_arn = 'YOUR_SNS_TOPIC_ARN' rds_client.modify_db_instance( DBInstanceIdentifier=db_instance_identifier, EnableEventSubscription=True, EventCategories=['availability', 'backup', 'configuration change', 'creation', 'deletion', 'failover', 'failure', 'low storage', 'maintenance', 'notification', 'recovery', 'restoration'], SnsTopicArn=sns_topic_arn ) ``` Make sure to replace `'YOUR_REGION'`, `'YOUR_DB_INSTANCE_IDENTIFIER'`, and `'YOUR_SNS_TOPIC_ARN'` with your actual AWS region, RDS instance identifier, and SNS topic ARN respectively. 4. Verify that Event Notifications have been successfully enabled by checking the RDS instance details or the CloudWatch Events console. By following these steps, you can remediate the misconfiguration of Event Notifications not being enabled for AWS RDS using Python. ```hcl theme={null} # SNS topic to receive RDS cluster events resource "aws_sns_topic" "rds_events" { name = "rds-events-CLUSTER_IDENTIFIER" # replace CLUSTER_IDENTIFIER with your DB cluster identifier } # RDS event subscription for the DB cluster resource "aws_db_event_subscription" "rds_cluster_events" { name = "rds-events-CLUSTER_IDENTIFIER" # replace CLUSTER_IDENTIFIER with your DB cluster identifier sns_topic_arn = aws_sns_topic.rds_events.arn source_type = "db-cluster" source_ids = [ "CLUSTER_IDENTIFIER", # replace with your aws_rds_cluster.cluster_identifier ] event_categories = [ "maintenance", "failure", "failover", "configuration-change", ] enabled = true } ``` If you already have an SNS topic you want to reuse, replace `aws_sns_topic.rds_events.arn` with its ARN (for example from a `data "aws_sns_topic"`), and omit the `aws_sns_topic` resource. This change does not force replacement of the existing RDS cluster; it adds a new subscription only. After you add this, `terraform plan` should show one new `aws_db_event_subscription` (and an `aws_sns_topic` if you create it) with `event_categories` including `maintenance`, `failure`, `failover`, and `configuration-change`. ### Additional Reading: * [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER\_Events.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html)