We want to capture across our uneet-{dev,demo,prod} accounts:

• uptime
• check table id limits
• unicode - utf8mb4 & utf8mb4_unicode_520_ci
• engineversion
• status
• dbInstanceClass
• user_group_map count - so we know if there has been any truncation issues
• schema_version - so we know what version of the data structure we are running
• aurora_version - so we know what version of the database we are running
• snapshot_time (PreferredBackupWindow) - so we know at what time snapshots are being taken
• BackupRetentionPeriod - so we know how far back we can restore
• insync - so we know if all our settings are in affect
• binlog_time - whether binlogs are enabled and how far they go
• iam_auth - whether IAM auth is enabled
• slow_log - whether slow log is enabled, with log_output & log_queries_not_using_indexes
• general_log - whether general log is enabled
• cluster_endpoint - so we know what the cluster endpoint URL is
• backtrack - if we can back track and what is the window
• cloudwatch - check whether logs are being sent to CloudWatch
• check lambda_async is present
• check triggers are enabled
• check innodb_file_format

https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.Concepts.MySQL.html

Policy notes

Requires:

• AmazonRoute53ReadOnlyAccess
• AmazonRDSReadOnlyAccess

Refreshed Parameters needs a need a re-deployment.