Event Notification Subscriptions Should Be Enabled

More Info:

Amazon RDS event notification subscriptions should be enabled for database instance level events.

Risk Level

Low

Address

Operational Maturity, Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• Cloudanix Best Practice
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of Event Notification Subscriptions not being enabled for an AWS RDS instance using the AWS console, follow these steps:

1. Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and login using your credentials.

2. Navigate to RDS Service: From the AWS Management Console, navigate to the RDS service by clicking on “Services” in the top left corner, then selecting “RDS” under the Database category.

3. Select the RDS Instance: In the RDS dashboard, select the RDS instance for which you want to enable Event Notification Subscriptions by clicking on the checkbox next to the instance.

4. Enable Event Notification Subscriptions: With the RDS instance selected, click on the “Modify” button from the top menu to modify the instance settings.

5. Scroll down to Event Subscriptions: In the Modify DB Instance window, scroll down to the “Event Subscriptions” section.

6. Add Event Subscription: Click on the “Add Event Subscription” button to create a new event subscription for the RDS instance.

7. Configure Event Subscription: Configure the event subscription by selecting the events you want to be notified about, the SNS topic to which the notifications should be sent, and any other relevant settings.

8. Save Changes: Once you have configured the event subscription, click on the “Add Event Subscription” button to save the changes.

9. Verify Configuration: After saving the changes, verify that the Event Notification Subscription has been successfully enabled for the RDS instance by checking the Event Subscriptions section in the RDS dashboard.

By following these steps, you will successfully remediate the misconfiguration of Event Notification Subscriptions not being enabled for an AWS RDS instance using the AWS console.

Using CLI

To remediate the misconfiguration of Event Notification Subscriptions not being enabled for AWS RDS using AWS CLI, you can follow these steps:

1. List current event subscriptions: First, you need to list the current event subscriptions for your RDS instance to check if there are any existing subscriptions. You can use the following AWS CLI command:

   aws rds describe-event-subscriptions
   

2. Enable Event Notification Subscription: If there are no existing event subscriptions or the required subscriptions are not enabled, you can create a new event subscription using the following AWS CLI command:

   aws rds create-event-subscription --subscription-name <subscription-name> --sns-topic-arn <sns-topic-arn> --source-type db-instance --source-ids <rds-instance-identifier> --event-categories <event-categories>
   
   • Replace <subscription-name> with a name for your event subscription.
   • Replace <sns-topic-arn> with the ARN of the SNS topic to which you want to send the notifications.
   • Replace <rds-instance-identifier> with the identifier of your RDS instance.
   • Replace <event-categories> with the specific event categories you want to subscribe to (e.g., availability, backup, failure, notification, etc.).

3. Verify Event Subscription: After creating the event subscription, you can verify if it has been successfully created by listing the event subscriptions again using the describe-event-subscriptions command.

By following the above steps and enabling Event Notification Subscriptions for your AWS RDS instance using the AWS CLI, you can remediate the misconfiguration and ensure that you receive important notifications about events occurring in your RDS environment.

Using Python

To remediate the misconfiguration of Event Notification Subscriptions not being enabled for an AWS RDS instance using Python, you can use the AWS SDK for Python (Boto3) to enable the event subscriptions. Here are the step-by-step instructions to remediate this issue:

1. Install Boto3: If you haven’t already installed the Boto3 library, you can do so using pip:

pip install boto3

2. Configure AWS Credentials: Make sure you have configured your AWS credentials either by setting environment variables or using the AWS CLI aws configure command.

3. Write a Python script to enable Event Notification Subscriptions for the RDS instance. Here is an example script:

import boto3

def enable_event_subscription(rds_instance_identifier, sns_topic_arn):
    client = boto3.client('rds')
    
    response = client.create_event_subscription(
        SubscriptionName='my-rds-event-subscription',
        SnsTopicArn=sns_topic_arn,
        SourceType='db-instance',
        SourceIds=[rds_instance_identifier],
        EventCategories=[
            'availability',
            'backup',
            'configuration change',
            'creation',
            'deletion',
            'failover',
            'failure',
            'maintenance',
            'notification',
            'recovery',
            'restoration'
        ]
    )

    print(response)

# Replace 'my-rds-instance' with your RDS instance identifier
rds_instance_identifier = 'my-rds-instance'

# Replace 'my-sns-topic-arn' with the ARN of your SNS topic
sns_topic_arn = 'my-sns-topic-arn'

enable_event_subscription(rds_instance_identifier, sns_topic_arn)

4. Replace 'my-rds-instance' with the identifier of your RDS instance and 'my-sns-topic-arn' with the ARN of the SNS topic to which you want to subscribe for RDS events.

5. Run the Python script. This will create an event subscription for the specified RDS instance that sends notifications to the specified SNS topic for the specified event categories.

By following these steps and running the Python script, you can successfully enable Event Notification Subscriptions for an AWS RDS instance using Python.

Using Terraform

# SNS topic for RDS event notifications (optional if you already have one)
resource "aws_sns_topic" "rds_events" {
  name = "rds-events-DB_INSTANCE_IDENTIFIER" # Replace DB_INSTANCE_IDENTIFIER with the RDS instance identifier
}

# Allow RDS to publish to the SNS topic
data "aws_iam_policy_document" "rds_events_sns_policy" {
  statement {
    sid    = "AllowRDSServiceToPublish"
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["rds.amazonaws.com"]
    }

    actions   = ["sns:Publish"]
    resources = [aws_sns_topic.rds_events.arn]
  }
}

resource "aws_sns_topic_policy" "rds_events" {
  arn    = aws_sns_topic.rds_events.arn
  policy = data.aws_iam_policy_document.rds_events_sns_policy.json
}

# RDS event subscription for instance-level events
resource "aws_db_event_subscription" "rds_instance_events" {
  name          = "rds-events-DB_INSTANCE_IDENTIFIER" # Must be unique per account/region
  sns_topic     = aws_sns_topic.rds_events.arn
  source_type   = "db-instance"
  source_ids    = ["DB_INSTANCE_IDENTIFIER"] # Replace with your DB instance identifier

  event_categories = [
    "availability",
    "failure",
    "failover",
    "maintenance",
    "deletion",
    "recovery",
    "configuration change",
  ]

  enabled = true
}

Creating or updating aws_db_event_subscription and aws_sns_topic does not replace your DB instance, only these notification resources. After you add this, terraform plan should show creation of aws_sns_topic.rds_events, aws_sns_topic_policy.rds_events, and aws_db_event_subscription.rds_instance_events with the specified source_type, source_ids, and event_categories.

Additional Reading:

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html