AWS RDS

Investigate AWS RDS instance health and recent events during incidents

Overview

OpenSRE uses AWS RDS to investigate database instance health and surface recent operational events — failovers, maintenance windows, parameter changes, and backup activity — when an alert fires against a managed RDS database.

All RDS API calls are read-only and routed through the shared aws_sdk_client allowlist, so the integration cannot mutate your RDS resources.

Prerequisites

• AWS credentials configured per the AWS integration (role ARN recommended)
• An RDS DB instance you want OpenSRE to investigate
• IAM permissions for the two RDS describe actions listed below

Setup

Option 1: Interactive CLI

opensre integrations setup rds

Option 2: Environment variables

RDS_DB_INSTANCE_IDENTIFIER=prod-orders-db
AWS_REGION=us-east-1

Variable	Default	Description
RDS_DB_INSTANCE_IDENTIFIER	—	Required. The DB instance identifier OpenSRE should investigate
AWS_REGION	us-east-1	AWS region the instance lives in
RDS_REGION	us-east-1	Fallback used only when AWS_REGION is not set

Region resolution order (highest priority first):

1. region field on the source dict (when configured via the integrations store)
2. AWS_REGION environment variable
3. RDS_REGION environment variable
4. us-east-1 (default)

Credentials

The integration only needs two read-only RDS actions on the same IAM role or user used for the AWS integration:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:DescribeEvents"
      ],
      "Resource": "*"
    }
  ]
}

If you already use the AWS managed ReadOnlyAccess policy, both actions are covered.

Investigation tools

Tool	AWS API call	What it returns
describe_rds_instance	rds:DescribeDBInstances	Status, engine + version, instance class, Multi-AZ, endpoint, storage, AZ, backup window
describe_rds_events	rds:DescribeEvents	Recent events (failovers, maintenance, parameter changes, backups). Defaults to last 60 minutes; bounded to 20160 minutes (14 days)

Both tools become available whenever rds.db_instance_identifier is present in the resolved sources.

Use cases

• Verifying RDS instance status (available, modifying, failed) when an alert fires
• Detecting Multi-AZ failover events around an incident timestamp
• Tracing recent maintenance, parameter group changes, or backup activity that may correlate with the incident

Upstream correlation validation

OpenSRE includes a deterministic upstream-correlation smoke path for no-trace-ID RDS CPU spike investigations — useful without live Datadog credentials or a full LLM investigation:

opensre tests upstream-correlation-smoke
# machine-readable:
opensre tests upstream-correlation-smoke --json

Expected output includes correlated signals and most likely causal driver(s).

For live validation, configure Datadog and investigate an RDS CPU spike alert. The runtime scopes RDS metrics to the alerting DB instance using the dbinstanceidentifier tag to avoid cross-instance aggregation.

Recommended alert fields:

{
  "service": "orders",
  "resource": "orders-rds-prod",
  "upstream_services": ["orders-web"]
}

Then run:

opensre investigate

Verify

There is no dedicated opensre integrations verify rds target today. Confirm AWS credentials work (see AWS) and that tools can describe your instance during an investigation.

Troubleshooting

Symptom	Fix
AccessDenied on rds:DescribeDBInstances	Add the IAM policy above to the role or user used by the AWS integration
DBInstanceNotFound	Confirm RDS_DB_INSTANCE_IDENTIFIER matches an instance in AWS_REGION
Tool reports the wrong region	Check the region resolution order above for a stale store region or wrong AWS_REGION

Security

• Use read-only IAM (Describe* only).
• Prefer role ARN / least privilege over long-lived keys.
• Store identifiers and credentials out of source control.