RDS instance event subscription covers critical categories

Check ID: rds_instance_critical_event_subscription
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: logging
Resource type: AwsRdsEventSubscription

What this check verifies

RDS event subscriptions for DB instances are assessed for coverage of the critical categories maintenance, configuration change, and failure. The evaluation looks for enabled db-instance subscriptions and confirms these categories are included or that all events are selected.

Risk

Without these notifications, critical DB events go unseen, undermining availability and integrity. Missed outages, unexpected restarts, or silent parameter changes can delay response, prolong downtime, corrupt data flows, and leave misconfigurations unaddressed.

Recommendation

Establish and sustain RDS event subscriptions for db-instance that include maintenance, configuration change, and failure.

Deliver to monitored channels (ticketing/chat/paging)
Enforce least privilege on topics
Test alert delivery and runbooks
Periodically review coverage across Regions

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds create-event-subscription —subscription-name <example_resource_name> —sns-topic-arn <sns-topic-arn> —source-type db-instance —event-categories “maintenance” “configuration change” “failure”

# Terraform: RDS DB instance event subscription
resource "aws_db_event_subscription" "<example_resource_name>" {
  name            = "<example_resource_name>"
  sns_topic       = "<sns-topic-arn>"
  source_type     = "db-instance"                           # critical: DB instance events
  event_categories = ["maintenance", "configuration change", "failure"]  # critical: required categories
}

# CloudFormation: RDS DB instance event subscription
Resources:
  <example_resource_name>:
    Type: AWS::RDS::EventSubscription
    Properties:
      SnsTopicArn: <sns-topic-arn>           # critical: SNS topic to receive notifications
      SourceType: db-instance                # critical: subscribe to DB instance events
      EventCategories:                       # critical: required categories for PASS
        - maintenance
        - configuration change
        - failure

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_critical_event_subscription. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS DB instance has copy tags to snapshots enabled RDS instance does not use the default master username

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires