AWS RDS - OpenSRE Documentation

Overview

OpenSRE uses AWS RDS to investigate database instance health and surface recent operational events — failovers, maintenance windows, parameter changes, and backup activity — when you ask about a managed RDS database. All RDS API calls are read-only and routed through the shared aws_sdk_client allowlist, so the integration cannot mutate your RDS resources.

Prerequisites

AWS credentials configured per the AWS integration (role ARN recommended)
An RDS DB instance you want OpenSRE to investigate
IAM permissions for the two RDS describe actions listed below

Setup

Option 1: Interactive CLI

opensre integrations setup rds

Option 2: Environment variables

RDS_DB_INSTANCE_IDENTIFIER=prod-orders-db
AWS_REGION=us-east-1

Variable	Default	Description
`RDS_DB_INSTANCE_IDENTIFIER`	—	Required. The DB instance identifier OpenSRE should investigate
`AWS_REGION`	`us-east-1`	AWS region the instance lives in
`RDS_REGION`	`us-east-1`	Fallback used only when `AWS_REGION` is not set

Region resolution order (highest priority first):

region field on the source dict (when configured via the integrations store)
AWS_REGION environment variable
RDS_REGION environment variable
us-east-1 (default)

Credentials

The integration only needs two read-only RDS actions on the same IAM role or user used for the AWS integration:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeEvents"
      ],
      "Resource": "*"
    }
  ]
}

If you already use the AWS managed ReadOnlyAccess policy, both actions are covered.

Tools

Tool	AWS API call	What it returns
`describe_rds_instance`	`rds:DescribeDBInstances`	Status, engine + version, instance class, Multi-AZ, endpoint, storage, AZ, backup window
`describe_rds_events`	`rds:DescribeEvents`	Recent events (failovers, maintenance, parameter changes, backups). Defaults to last 60 minutes; bounded to 20160 minutes (14 days)

Both tools become available whenever rds.db_instance_identifier is present in the resolved sources.

Use cases

Verifying RDS instance status (available, modifying, failed)
Detecting Multi-AZ failover events around an incident timestamp
Tracing recent maintenance, parameter group changes, or backup activity that may correlate with the incident

Verify

There is no dedicated opensre integrations verify rds target today. Confirm AWS credentials work (see AWS), then start opensre and ask, e.g. “What’s the status of prod-orders-db? Any recent failovers?”

Troubleshooting

Symptom	Fix
AccessDenied on `rds:DescribeDBInstances`	Add the IAM policy above to the role or user used by the AWS integration
DBInstanceNotFound	Confirm `RDS_DB_INSTANCE_IDENTIFIER` matches an instance in `AWS_REGION`
Tool reports the wrong region	Check the region resolution order above for a stale store `region` or wrong `AWS_REGION`

Security

Use read-only IAM (Describe* only).
Prefer role ARN / least privilege over long-lived keys.
Store identifiers and credentials out of source control.

​Overview

​Prerequisites

​Setup

​Option 1: Interactive CLI

​Option 2: Environment variables

​Credentials

​Tools

​Use cases

​Verify

​Troubleshooting

​Security