RDS cluster event subscription covers critical categories

Check ID: rds_cluster_critical_event_subscription
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: logging
Resource type: AwsRdsEventSubscription

What this check verifies

RDS event subscriptions for the db-cluster source type are enabled and cover critical cluster event categories: maintenance and failure (or all cluster events).

Risk

Without notifications for cluster maintenance and failure, teams may miss engine updates, failovers, or node crashes, impacting availability and increasing MTTR. Prolonged degraded states can cause replication lag and potential data integrity issues, hindering timely containment.

Recommendation

Enable event subscriptions for RDS clusters that include maintenance and failure, delivered via SNS to monitored channels.

Enforce least privilege on topics
Separate topics per environment
Integrate with on-call/IR playbooks and test alerts
Add multiple recipients and escalation for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds create-event-subscription —subscription-name <example_resource_name> —sns-topic-arn <example_resource_arn> —source-type db-cluster —event-categories maintenance failure —enabled

resource "aws_db_event_subscription" "<example_resource_name>" {
  name            = "<example_resource_name>"
  sns_topic       = "<example_resource_arn>"           # Critical: SNS topic ARN
  source_type     = "db-cluster"                        # Critical: Scope to clusters
  event_categories = ["maintenance", "failure"]        # Critical: Required categories
  enabled         = true                                  # Critical: Must be enabled
}

Resources:
  <example_resource_name>:
    Type: AWS::RDS::EventSubscription
    Properties:
      SnsTopicArn: <example_resource_arn>       # Critical: SNS topic to receive notifications
      SourceType: db-cluster                    # Critical: Scope to DB clusters
      EventCategories:                          # Critical: Subscribe to required categories only
        - maintenance
        - failure
      Enabled: true                             # Critical: Must be enabled to pass

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_critical_event_subscription. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS DB cluster has copy tags to snapshots enabled RDS cluster master username is not admin or postgres

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires