# Ensure AWS LightSail CPU Utilization Alarm is setup for RDS Instance - Source: https://support.icompaas.com/support/solutions/articles/62000220310-ensure-aws-lightsail-cpu-utilization-alarm-is-setup-for-rds-instance - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [Amazon Lightsail](https://support.icompaas.com/support/solutions/folders/62000167575) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **[](https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/Welcome.html)Description:** Lightsail is a Virtual Private Server (VPS) that provides developers compute, storage, and networking capacity and capabilities to deploy and manage websites and web applications in the cloud. Lightsail includes everything you need to launch your project quickly – virtual machines, containers, databases, CDN, load balancers, DNS management, etc. – for a low, predictable monthly price. ### **Rationale:** CPU utilization refers to a computer's usage of processing resources or the amount of work handled by a CPU. When CPU utilization is high, the burden on the database server increases, which results in inefficiency.  ### **Impact:** The alarm changes to the ALARM state when the average CPU use of a Lightsail RDS instance exceeds a specified threshold for consecutive specified periods and notifies you by email, SMS text message, or both when your alarm conditions are met. This could help you to Autoscale in order to maintain consistent performance. ### **Default Value:**  By default, there exists NO CPU Utilization Alarm for Lightsail RDS instance. ### **Audit:** - **via Management Console** 1. Sign in to the AWS Management console 2. Navigate to Amazon Lightsail service at [https://lightsail.aws.amazon.com/ls](https://lightsail.aws.amazon.com/ls "https://lightsail.aws.amazon.com/ls") 3. On the **Databases** tab, choose the database on which you audit a CPU Utilization Alarm 4. On the **Metrics** tab, set the Metric graphs to **CPU Utilization** and scroll down to see if there any alarms. 5. If you see nothing, there is No CPU Utilization alarm for the chosen RDS instance. ![](https://support.icompaas.com/assets/kb/640a3cb997ea64f6.png) - **via CLI** 1. Use **get-alarms** to return information about the configured alarms. aws lightsail get-alarms --monitored-resource-name \[--alarm-name \] Specify an alarm name in your request to return information about a specific alarm, **or** specify a monitored resource name to return information about all alarms for a specific resource. ### **Remediation:** **Pre-Requisite:** 1. Access to Amazon Lightsail service 2. The Database that you want to work must be Active/Accessible.  **Implementation steps:** - **via Management Console** 1. Sign in to the AWS Management console 2. Navigate to Amazon Lightsail service at [https://lightsail.aws.amazon.com/ls](https://lightsail.aws.amazon.com/ls "https://lightsail.aws.amazon.com/ls") 3. On the **Databases** tab, choose the database on which you want to set up CPU Utilization Alarm ![](https://support.icompaas.com/assets/kb/4b4372442185ceee.png) 4. Navigate to the **Metrics** tab and choose the Metric graph which is **CPU Utilization.** **![](https://support.icompaas.com/assets/kb/f48f240440b4b02e.png)** 5. **Scroll down to** ****Alarms**** **section** **and** **choose **Add Alarm**** ****![](https://support.icompaas.com/assets/kb/cd115d78d66f176a.png)**** 6. ****Set**** ****the**** ****required**** ****configuration for your CPU Utilization**** ****alarm**** ****![](https://support.icompaas.com/assets/kb/70a20a7defda5105.png)**** 7. ****Click **create** when done.**** - **via CLI** 1. Use **put-alarm** to create or update an alarm, and associate it with the specified metric. aws lightsail put-alarm --alarm-name --metric-name --monitored-resource-name --comparison-operator --threshold --evaluation-periods \[--datapoints-to-alarm \] \[--treat-missing-data \] \[--contact-protocols \] \[--notification-triggers \] \[--notification-enabled | --no-notification-enabled\] \[--cli-input-json \] \[--generate-cli-skeleton \] **Backout Plan:** - **via Management Console** You can either **Disable** or **Delete** an alarm. 1. To **Disable** an alarm, turn it **OFF**. ![](https://support.icompaas.com/assets/kb/fd710aa6918683fb.png) 2. To **Delete** an alarm, click the 3 vertical dots and choose **Delete alarm**.  ![](https://support.icompaas.com/assets/kb/c96d0e5ecbaaadc3.png)  - **via CLI** 1. Use **delete-alarm** to delete a created alarm. aws lightsail delete-alarm --alarm-name \[--cli-input-json \] \[--generate-cli-skeleton \] ### **Note:** - You can add two alarms per metric, and choose to be notified by email, SMS text message, or both when your alarm conditions are met. - You can’t give a name to an alarm while creating via the Management console. It’ll be given a default name by AWS. The alarm name can however be viewed on the output of **get-alarms** command ### **Reference:** **[https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/Welcome.html](https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/Welcome.html)** **[https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-alarms.html](https://docs.aws.amazon.com/cli/latest/reference/lightsail/get-alarms.html)** **[](https://docs.aws.amazon.com/cli/latest/reference/lightsail/put-alarm.html)[https://docs.aws.amazon.com/cli/latest/reference/lightsail/put-alarm.html](https://docs.aws.amazon.com/cli/latest/reference/lightsail/put-alarm.html)****[](https://docs.aws.amazon.com/cli/latest/reference/lightsail/put-alarm.html)**[![](https://support.icompaas.com/assets/kb/ff5ed52a80643196.png)](https://docs.aws.amazon.com/lightsail/2016-11-28/api-reference/Welcome.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.