RDS parameter group event subscription is enabled

Check ID: rds_instance_event_subscription_parameter_groups
Provider: AWS
Service: rds
Severity: LOW
Categories: logging
Resource type: AwsRdsEventSubscription

What this check verifies

RDS event subscriptions for DB parameter groups notify on configuration change events (or all categories) when the subscription is enabled

Risk

Missing alerts on parameter changes erodes visibility. Attackers or mistakes can lower TLS requirements, disable auditing, or relax auth, enabling data exposure (confidentiality), unauthorized writes (integrity), or outages from unsafe settings (availability).

Recommendation

Create and maintain an SNS-backed event subscription for DB parameter groups that includes configuration change (or all) and keep it enabled.

Apply least privilege to SNS topics
Route to on-call/SIEM and test alerts
Enforce change control and monitoring across all Regions

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds create-event-subscription —subscription-name <example_resource_name> —sns-topic-arn <sns-topic-arn> —source-type db-parameter-group —event-categories “configuration change” —enabled

resource "aws_db_event_subscription" "<example_resource_name>" {
  name             = "<example_resource_name>"
  sns_topic        = "<sns-topic-arn>"
  source_type      = "db-parameter-group"          # Critical: target DB parameter groups
  event_categories = ["configuration change"]       # Critical: include configuration change events
}

Resources:
  <example_resource_name>:
    Type: AWS::RDS::EventSubscription
    Properties:
      SnsTopicArn: <sns-topic-arn>
      SourceType: db-parameter-group  # Critical: targets DB parameter group events
      EventCategories:
        - configuration change        # Critical: subscribes to configuration change events
      Enabled: true                   # Critical: subscription must be enabled

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_event_subscription_parameter_groups. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS instance has enhanced monitoring enabled RDS DB security group event subscription is enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires