RDS Enhanced Monitoring is disabled or the monitoring role is invalid

What it checks

RDS Enhanced Monitoring is disabled or the monitoring role is invalid

Where it applies

Terraform: aws_db_instance, aws_rds_cluster_instance, aws_rds_cluster

CloudFormation: AWS::RDS::DBInstance, AWS::RDS::DBCluster

How to fix it

1. Create an IAM role with AmazonRDSEnhancedMonitoringRole policy and assume_role_policy for monitoring.rds.amazonaws.com.
2. Set a supported nonzero monitoring_interval and monitoring_role_arn on the owning cluster or individually managed instance. Do not configure member monitoring while the cluster manages it.

Frameworks

• AWS FSBP RDS.6
• SOC 2 CC7.2
• HIPAA 164.312(b)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules