Control: 22 An RDS event notifications subscription should be configured for critical database security group events

Description

This control checks whether an Amazon RDS event subscription exists with notifications enabled for the following source type, event category key-value pairs.

DBSecurityGroup: ["configuration change","failure"]

RDS event notifications use Amazon SNS to make you aware of changes in the availability or configuration of your RDS resources. These notifications allow for a rapid response. For additional information about RDS event notifications, see Using Amazon RDS event notification in the Amazon RDS User Guide.

Remediation

To subscribe to RDS database parameter group event notifications

Open the Amazon RDS console
In the navigation pane, choose Event subscriptions.
Under Event subscriptions, choose Create event subscription.
In the Create event subscription dialog, do the following:
a. For Name, enter a name for the event notification subscription.
b. For Send notifications to, choose an existing Amazon SNS ARN for an SNS topic. To use a new topic, choose create topic to enter the name of a topic and a list of recipients.
c. For Source type, choose Security groups.
d. Under Instances to include, select All security groups.
e. Under Event categories to include, select Specific event categories. The control also passes if you select All event categories.
f. Select configuration change and failure.
g. Choose Create.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_rds_22

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_rds_22 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when source_type <> 'db-security-group' then 'skip'
    when source_type = 'db-security-group' and enabled and event_categories_list @> '["failure", "configuration change"]' then 'ok'
    else 'alarm'
  end as status,
  case
    when source_type <> 'db-security-group' then cust_subscription_id || ' event subscription of ' || source_type || ' type.'
    when source_type = 'db-security-group' and enabled and event_categories_list @> '["failure", "configuration change"]' then cust_subscription_id || ' event subscription enabled for critical database security group events.'
    else cust_subscription_id || ' event subscription missing critical database security group events.'
  end as reason
  , region, account_id
from
  aws_rds_db_event_subscription;

Control: 22 An RDS event notifications subscription should be configured for critical database security group events

Description

Remediation

Usage

SQL

Tags