Skip to main content

Security Groups Events Subscriptions Should Be Enabled

More Info:​

Amazon RDS event notification subscriptions should be enabled for database security groups events. AWS RDS groups these events into categories that you can subscribe to.

Risk Level​

Low

Address​

Operational Maturity, Reliability

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration of "Security Groups Events Subscriptions Should Be Enabled" for AWS RDS using the AWS console, follow these step-by-step instructions:

  1. Login to AWS Console: Go to the AWS Management Console (https://console.aws.amazon.com/) and log in with your credentials.

  2. Navigate to RDS Service: From the AWS Management Console, navigate to the Amazon RDS service by clicking on the "Services" dropdown menu at the top left corner, then selecting "RDS" under the Database category.

  3. Select the RDS Instance: In the Amazon RDS dashboard, locate the RDS instance for which you want to enable Security Groups Events Subscriptions and click on its name to open its details.

  4. Enable Event Subscriptions: In the RDS instance details page, navigate to the "Event Subscriptions" section in the left-hand menu and click on it.

  5. Create Event Subscription: Click on the "Create Event Subscription" button to create a new event subscription for the RDS instance.

  6. Configure Event Subscription: In the "Create Event Subscription" wizard, provide the necessary details such as the name of the event subscription, the source type (RDS), the source identifier (select the RDS instance), and the event categories.

  7. Enable Security Groups Events: Under the "Event Categories" section, make sure to select the "Configuration change" event category, as Security Groups Events fall under this category.

  8. Specify SNS Topic (Optional): If you want to receive notifications for these events, you can specify an existing SNS topic or create a new one to subscribe to.

  9. Review and Create: Review the details of the event subscription, ensure that Security Groups Events are included, and click on the "Create" button to save the changes.

  10. Verify Subscription: Once the event subscription is created, verify that Security Groups Events are now enabled for the RDS instance by checking the event subscription details.

By following these steps, you will successfully remediate the misconfiguration of "Security Groups Events Subscriptions Should Be Enabled" for the AWS RDS instance using the AWS console.

Using CLI

To remediate the misconfiguration of "Security Groups Events Subscriptions Should Be Enabled" for AWS RDS using AWS CLI, you can follow these steps:

  1. Enable Event Subscriptions for RDS DB instances:

    Run the following AWS CLI command to enable event subscriptions for the RDS DB instance:

    aws rds create-event-subscription --subscription-name my-rds-event-subscription --sns-topic-arn arn:aws:sns:us-east-1:123456789012:my-sns-topic --source-type db-instance --source-ids my-rds-db-instance --event-categories availability,backup,configuration-change,creation,deletion,failover,failure,low-storage,read-replica,recovery,restoration,success
    • Replace my-rds-event-subscription with your desired subscription name.
    • Replace arn:aws:sns:us-east-1:123456789012:my-sns-topic with the ARN of the SNS topic you want to use for notifications.
    • Replace my-rds-db-instance with the identifier of your RDS DB instance.

  2. Verify the Event Subscription:

    You can verify the event subscription by running the following command:

    aws rds describe-event-subscriptions

    Ensure that the event subscription you created is listed and active.

By following these steps, you can successfully remediate the misconfiguration of "Security Groups Events Subscriptions Should Be Enabled" for AWS RDS using AWS CLI.

Using Python

To remediate the misconfiguration of Security Groups Events Subscriptions not being enabled for an AWS RDS instance using Python, you can follow these steps:

  1. Install the AWS SDK for Python (Boto3) if you haven't already. You can install it using pip:
pip install boto3
  1. Use the following Python script to enable Security Groups Events Subscriptions for the RDS instance:
import boto3

def enable_security_group_events_subscription(rds_instance_identifier):
    client = boto3.client('rds')
    
    response = client.modify_event_subscription(
        SubscriptionName='security_group_events_subscription',
        Enabled=True,
        EventCategories=[
            'configuration change',
        ],
        SourceType='db-instance',
        SourceIds=[
            rds_instance_identifier,
        ]
    )
    
    print("Security Groups Events Subscriptions enabled successfully")

# Replace 'rds_instance_identifier' with the actual identifier of your RDS instance
enable_security_group_events_subscription('rds_instance_identifier')

  1. Replace 'rds_instance_identifier' in the script with the actual identifier of your RDS instance. You can find the RDS instance identifier in the AWS Management Console under the RDS service.

  2. Run the Python script. This will enable Security Groups Events Subscriptions for the specified RDS instance.

By following these steps, you can successfully remediate the misconfiguration of Security Groups Events Subscriptions not being enabled for an AWS RDS instance using Python.

Using Terraform
# Existing legacy RDS DB Security Group
resource "aws_db_security_group" "DB_SECURITY_GROUP" {
  name        = "DB_SECURITY_GROUP_NAME" # replace with the DB security group name ({{asset_label}})
  description = "DB security group for legacy EC2-Classic"

  # ...ingress rules...
}

# SNS topic that will receive RDS security group event notifications
# If you already have a topic, reference it via data "aws_sns_topic" instead.
resource "aws_sns_topic" "rds_security_events" {
  name = "rds-security-events-topic"
}

# (Optional but usually required) subscription so someone actually receives the notifications.
# Replace EMAIL_ADDRESS with the real destination; confirmation by the recipient is still required.
resource "aws_sns_topic_subscription" "rds_security_events_email" {
  topic_arn = aws_sns_topic.rds_security_events.arn
  protocol  = "email"
  endpoint  = "EMAIL_ADDRESS" # e.g. "user@example.com"
}

# RDS event subscription for DB Security Group "security-group" events
resource "aws_db_event_subscription" "db_security_group_events" {
  name      = "${aws_db_security_group.DB_SECURITY_GROUP.name}-security-events-subscription"
  sns_topic = aws_sns_topic.rds_security_events.arn

  source_type = "db-security-group"
  source_ids  = [aws_db_security_group.DB_SECURITY_GROUP.name]

  event_categories = ["security-group"]
  enabled          = true
}

This change does not force replacement of the DB security group; it creates a new SNS topic (if you don’t already have one) and a new aws_db_event_subscription.

To verify, terraform plan should show:

  • + creation of aws_sns_topic.rds_security_events (if new),
  • + creation of aws_sns_topic_subscription.rds_security_events_email (if included),
  • + creation of aws_db_event_subscription.db_security_group_events, and no changes to existing RDS DB security groups other than being referenced by the subscription.

Additional Reading:​