RDS instance has enhanced monitoring enabled
rds_instance_enhanced_monitoring_enabled
RDS DB instances are evaluated for Enhanced Monitoring being enabled, which publishes real-time OS-level metrics (CPU, memory, disk, network) to CloudWatch Logs for each instance.
Risk
Without Enhanced Monitoring, you lack real-time OS telemetry, delaying detection of resource saturation and abnormal activity.
This raises MTTR and risks availability impacts (timeouts, failovers), reduces integrity assurance during incidents, and weakens forensic visibility.
prowler aws --checks rds_instance_enhanced_monitoring_enabled
Recommendation
Enable Enhanced Monitoring on RDS, using a >0s collection interval aligned to workload and cost. Assign a least-privilege role for log delivery, and apply defense in depth by centralizing logs, setting alerts on key OS metrics, and defining retention to support incident response and trend analysis.
Remediation
aws rds modify-db-instance --db-instance-identifier <example_resource_id> --monitoring-interval 60 --monitoring-role-arn <monitoring_role_arn>
- In the AWS Console, go to RDS > Databases and select the DB instance
- Click Modify
- In Monitoring, check Enable Enhanced Monitoring and set Granularity to any non-zero value (e.g., 60 seconds)
- Set Monitoring role to Default (creates rds-monitoring-role) or select an existing role
- Click Continue, then Modify DB instance to apply
Source Code
Resource Type
AwsRdsDbInstance