RDS DB security group event subscription is enabled

Check ID: rds_instance_event_subscription_security_groups
Provider: AWS
Service: rds
Severity: MEDIUM
Categories: logging
Resource type: AwsRdsEventSubscription

What this check verifies

RDS event subscriptions are evaluated for database security group events. The check expects an enabled subscription with source type db-security-group that includes the configuration change and failure event categories.

Risk

Missing alerts on security group changes or failures reduces visibility and slows response. Undetected rule changes can expose databases, while unnoticed failures prolong outages, impacting confidentiality and availability through unauthorized access or service disruption.

Recommendation

Create or update an RDS event subscription for source type db-security-group including configuration change and failure. Route alerts to monitored channels, restrict topic access (least privilege), integrate with incident response, and enforce change control and separation of duties for security group updates.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds create-event-subscription —subscription-name <SUBSCRIPTION_NAME> —sns-topic-arn <SNS_TOPIC_ARN> —source-type db-security-group —event-categories “configuration change” “failure”

resource "aws_db_event_subscription" "<example_resource_name>" {
  name            = "<example_resource_name>"
  sns_topic       = "<SNS_TOPIC_ARN>"
  source_type     = "db-security-group"        # Critical: DB security group events
  event_categories = ["configuration change", "failure"]  # Critical: required categories
}

Resources:
  <example_resource_name>:
    Type: AWS::RDS::EventSubscription
    Properties:
      SnsTopicArn: <SNS_TOPIC_ARN>
      SourceType: db-security-group  # Critical: subscribe to DB security group events
      EventCategories:               # Critical: required categories
        - configuration change
        - failure

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_instance_event_subscription_security_groups. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS parameter group event subscription is enabled RDS instance is not enrolled in RDS Extended Support

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires