Check ID: directoryservice_directory_monitor_notifications
Provider: AWS
Service: directoryservice
Severity: MEDIUM
Categories: logging
Resource type: Other

​
What this check verifies

AWS Directory Service directories are associated with Amazon SNS topics to send status change notifications (e.g., Active Impaired). The evaluation looks for directories that have SNS event topics configured for monitoring alerts.

​
Risk

Missing directory notifications reduces visibility into health changes, causing delayed response to Impaired states. This threatens availability of authentication, Kerberos/LDAP lookups, and domain joins; increases MTTR; and can enable silent replication or trust failures that impact integrity across dependent workloads.

​
Recommendation

Configure AWS Directory Service to publish directory status changes to an SNS topic, and subscribe your operations channels for timely alerts. Apply least privilege on topic permissions, integrate alerts with incident response, and use defense in depth by pairing notifications with logs and dashboards.

​
Remediation

aws ds register-event-topic —directory-id <DIRECTORY_ID> —topic-name <SNS_TOPIC_NAME>

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = directoryservice_directory_monitor_notifications. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks