RDS instance has enhanced monitoring enabled

Check ID: rds_instance_enhanced_monitoring_enabled
Provider: AWS
Service: rds
Severity: LOW
Categories: logging
Resource type: AwsRdsDbInstance

What this check verifies

RDS DB instances are evaluated for Enhanced Monitoring being enabled, which publishes real-time OS-level metrics (CPU, memory, disk, network) to CloudWatch Logs for each instance.

Risk

Without Enhanced Monitoring, you lack real-time OS telemetry, delaying detection of resource saturation and abnormal activity. This raises MTTR and risks availability impacts (timeouts, failovers), reduces integrity assurance during incidents, and weakens forensic visibility.

Recommendation

Enable Enhanced Monitoring on RDS, using a >0s collection interval aligned to workload and cost. Assign a least-privilege role for log delivery, and apply defense in depth by centralizing logs, setting alerts on key OS metrics, and defining retention to support incident response and trend analysis.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-instance —db-instance-identifier <example_resource_id> —monitoring-interval 60 —monitoring-role-arn <monitoring_role_arn>

# Enable Enhanced Monitoring on an existing RDS instance
resource "aws_db_instance" "<example_resource_name>" {
  # ...existing required configuration...
  monitoring_role_arn = "<monitoring_role_arn>"  # CRITICAL: Role for publishing OS metrics
  monitoring_interval = 60                        # CRITICAL: >0 enables Enhanced Monitoring (seconds)
}

# CloudFormation: enable Enhanced Monitoring on an existing RDS instance
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: <example_resource_id>
      MonitoringRoleArn: <monitoring_role_arn>   # CRITICAL: IAM role RDS uses to publish OS metrics to CloudWatch Logs
      MonitoringInterval: 60                     # CRITICAL: >0 enables Enhanced Monitoring (seconds)

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_enhanced_monitoring_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance uses a supported engine version RDS parameter group event subscription is enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires